Options

This submenu allows you to change various options and settings:

See also Menu Bar submenus.

Text Representation Dialog

This command changes the look of the disassembly. Here you can change the values of the following checkboxes/input fields:

Line prefixes

        This checkbox enables or disables line prefixes display.
        Line prefix is the address of the current byte:

         3000:1000      mov ax, bx
         ^^^^^^^^^

IDA.CFG parameter: SHOW_LINEPREFIXES Number of opcode bytes

        Opcode bytes are shown below:

         3000:1000 55           push    bp
                   ^^^^^^^^^

        The opcode is the operation code of the current instruction.
        For the data items, the opcodes are elements of data directives.
        Sometimes there is not enough place to display all bytes of an item
        (of a large array, for example). In this case, IDA will display just
        the few first bytes of the item. For the code items, IDA will try
        to display all bytes of the instruction, even if it requires adding
        more lines just for the opcode bytes. If this behavior is not desired,
        the number of opcode bytes can be specified as a negative value.
        A negative value -N means to display N opcode bytes on a line but
        never display empty lines just for the opcode bytes.
        By default, IDA does not display the opcodes.

IDA.CFG parameter: OPCODE_BYTES Use segment names

        This option controls the appearance of the segment names in the
        addresses. Example (codeseg has base 3000):

           Enabled:     codeseg:0034
           Disabled:    3000:0034

IDA.CFG parameter: USE_SEGMENT_NAMES Segment addresses

        Marking this checkbox, you can disable segment addresses in the
        disassembly. IDA will show only offsets. Example:

           Enabled:     codeseg:0034
           Disabled:    0034

IDA.CFG parameter: SHOW_SEGMENTS Function offsets

        This option controls the appearance of the line prefixes.
        If it is enabled, the addresses will be displayed as offsets
        from a function beginning. Example:

           Enabled:     somefunc+0x44
           Disabled:    cseg:0x4544

Right margin

        This option controls the length of disassembly lines for data
        directives.

IDA.CFG parameter: MAX_DATALINE_LENGTH Instruction indention

        You can change indention of disassembled instructions:

                         mov ax, bx
         <-------------->
            indention

IDA.CFG parameter: INDENTION Display bad instruction <BAD> marks

        Some assemblers do not understand some instructions even if they
        must. For example, the Z80 processor has several undocumented
        instructions and many assemblers fail to recognize them. IDA knows
        about this fact and tries to produce an output that can be compiled
        without errors, so it replaces such instructions with data bytes.

        The problem is more severe with Intel 80x86 processors: the same
        instruction can be coded differently. There are 2 operation codes
        for ADD instruction, etc. The worst thing is that the different
        operation codes have different lengths. If the assembler used to
        compile a file and your assembler produce different operation codes,
        you may obtain completely different output files.

        That is why IDA can mark such instructions as <BAD> and replace them
        with data bytes. Example:

           Enabled:
                        db 0Fh,86h,7Eh,0,0,0 ; <BAD> jbe     loc_0_205
                        db 0Fh,82h,78h,0,0,0 ; <BAD> jb      loc_0_205
                        db 0Fh,83h,72h,0,0,0 ; <BAD> jnb     loc_0_205
           Disabled:
                        jbe     loc_0_205
                        jb      loc_0_205
                        jnb     loc_0_205

IDA.CFG parameter: SHOW_BAD_INSTRUCTIONS Use tabulations in output

        You can disable the tab chars (0x09) in the output file if you do not
        like them. By default, IDA produces output files with tab chars.

IDA.CFG parameter: USE_TABULATION low suspicious limit high suspicious limit Click here to get information about these fields. Display stack pointer

        If this option is set, IDA will display the value of
        the stack pointer in the line prefix.

IDA.CFG parameter: SHOW_SP

Comments Dialog

This command changes the look of the disassembly comments. Here you can change the values of the following checkboxes/input fields:

Comment indention

        You can change indention of comments:

                mov ax, bx                      ; this is a comment
        <-------------------------------------->
                       indention

IDA.CFG parameter: COMMENTS_INDENTION Display of 'suspicious' marks This option enables or disables suspicious marks display. Usually the suspicious marks are disabled because IDA displays the suspicious operands in red/orange anyway. IDA.CFG parameter: SHOW_SUSPICOUS Display of empty lines

        This option enables or disables the presence of the autogenerated
        empty lines in the disassembly. It could be useful to decrease
        the number of the blank lines on the screen increasing amount
        of information on it.

IDA.CFG parameter: SHOW_EMPTYLINES Display of basic blocks

        This option enables or disables the presence of the autogenerated
        empty lines at the end of basic blocks in the disassembly.

IDA.CFG parameter: SHOW_BASIC_BLOCKS Display borders between data/code

        This command enables or disables the presence of the autogenerated
        border lines in the disassembly. It could be useful to decrease
        the number of the blank lines on the screen increasing amount
        of information on it. A border line looks like this:

         ;---------------------------------------------------------

Note that you can hide a particular border by using hide border command. IDA.CFG parameter: SHOW_BORDERS Display comments

        If this option is disabled, IDA will not show any comments.

Display repeatable comments This command enables or disables the repeatable comments display. IDA.CFG parameter: SHOW_REPEATABLE_COMMENTS Display auto comments

        Autocomments are predefined comments for all instructions.
        If you forgot the meaning of a certain instruction, you can use
        this command to get comments to all lines of the screen.

        IDA does not give comments to very simple instructions such as
        'mov' instruction and does not override existing comments.

IDA.CFG parameter: SHOW_AUTOCOMMENTS Display source lines

        This options controls the presence of the source line number
        information in the disassembly. Some object files have this
        information.

IDA.CFG parameter: SHOW_SOURCE_LINNUM Display try block lines

       This option controls the display of the try block information
       in the disassembly.

IDA.CFG parameter: SHOW_TRYBLOCKS

Cross References Dialog

IDA maintains cross-references automatically. Of course, when IDA starts to disassemble a new file, the cross-references will not appear immediately; they will be collected during background analysis.

This command changes the representation of cross references.

Display segments in xrefs

        This checkbox enables or disables segments in cross references:

           Enabled:     ; CODE XREF: 3000:1025
           Disabled:    ; CODE XREF: 1025

Display xref type mark

        If this option is disabled, IDA will not display "CODE"
        or "DATA" in the cross-references.

IDA.CFG parameter: SHOW_XREF_TYPES Display function offsets

        This option controls the appearance of the cross-reference addresses.
        If it is enabled, the addresses will be displayed as offsets
        from a function beginning. Example:

           Enabled:     somefunc+0x44
           Disabled:    cseg:0x4544

IDA.CFG parameter: SHOW_XREF_FUNC Display xref values

        If this option is disabled, IDA will just display the presence
        of cross-references, like this:

                ; CODE XREF: ...

IDA.CFG parameter: SHOW_XREF_VALUES Right margin

        Determines the maximal length of a line with the cross references.

IDA.CFG parameter: MAX_XREF_LENGTH Cross reference depth

        This value "how many bytes of an object to look at to collect
        cross references". For example we have an array:

                A       db 100 dup(0)

        If some instruction refers to the 5-th element of the array:

                mov     al,A+5

         with TD=3      we'll have no xrefs displayed
         with TD=10     we'll have this xref

IDA.CFG parameter: MAX_TAIL Number of xrefs to display Determines the maximal number of the cross references to display. You may keep this value low because you can access all xrefs by using the Jump to cross reference command. IDA.CFG parameter: SHOW_XREFS

Disable undo

Action    name: DisableUndo
 

This command completely disables the undo feature.

See also

Assembler Directives Dialog

This command enables/disables the generation of some assembler directives, namely:

        assume directive
        origin directive

Sometimes (when you do not intend to assemble the output file), you may want to disable their generation.

Names Representation

 Action    name: SetNameType
 

Dummy names are automatically generated by IDA. They are used to denote subroutines, program locations and data.

Dummy names have various prefixes depending on the item type and value:

  sub_          instruction, subroutine start
  locret_       'return' instruction
  loc_          instruction
  off_          data, contains offset value
  seg_          data, contains segment address value
  asc_          data, string literal
  byte_         data, byte
  word_         data, 16-bit
  dword_        data, 32-bit
  qword_        data, 64-bit
  byte3_        data, 3 bytes
  xmmword_      data, 128-bit
  ymmword_      data, 256-bit
  packreal_     data, packed real
  flt_          floating point data, 32-bit
  dbl_          floating point data, 64-bit
  tbyte_        floating point data, 80-bit
  stru_         structure
  custdata_     custom data type
  algn_         alignment directive
  unk_          unexplored byte

You can change representation of dummy names. IDA supports several types of dummy names:

  0     loc_0_1234     segment base address relative to program base address
                       & offset from the segment base
  1     loc_1000_1234  segment base address & offset from the segment base
  2     loc_dseg_1234  segment name & offset from the segment base
  3     loc_0_11234    segment relative to base address & full address
  4     loc_1000_11234 segment base address & full address
  5     loc_dseg_11234 segment name & full address
  6     loc_12         full address
  7     loc_0012       full address (at least 4 digits)
  8     loc_00000012   full address (at least 8 digits)
  9     dseg_1234      the same as 2, but without data type specifier
 10     loc_1          enumerated names (loc_1,loc_2,loc_3...)

If you have selected names type 10 (enumerated names), you may renumber them using a checkbox. The process is relatively fast, surprisingly.

The best representation for MS DOS programs is #0, for 16-bit processors - #7, and for 32-bit processors - #8. You can change dummy names type any time you want.

You can also set up types of names included in the name list. IDA knows about the following types of names:

        - normal names
        - public names
        - weak public or extern names
        - autogenerated (meaningful) names.
        - dummy (meaningless) names.

Dummy names may be public or weak, but they never appear in the list of names. You can specify the type of a name when you create or modify it.

You can also set maximal length of new names. Old names will not be affected by this parameter.

See also: Rename command.

Demangled Names

 Action    name: SetDemangledNames
 

IDA can demangle mangled C++ names of the most popular C++ compilers:

        - Microsoft
        - Borland
        - Watcom
        - Visual Age
        - GNU

The demangled names are represented in two forms: short and long form. The short form is used when a name is used as a reference, the long form is used at the declaration.

You can set how demangled C++ names must be represented:

        - as comments. this representation allows you to obtain
          recompilable source text
        - instead of mangled names. this representation makes the output
          more readable. the disadvantage is that you cannot recompile the
          output
        - don't display demangled names.

You can setup short and long forms of demangled names. Short form is used when a reference to the name is made; long form is used at the declaration.

To make demangled names more readable, we introduce the possibility to suppress pointer modifiers (near/far/huge).

To demangle GNU C v3.x names, the "Assume GCC v3.x names" checkbox should be set, otherwise such names might not be demangled. furthermore, to make the demangled name more compact, unsigned types may be displayed as uchar, uint, ushort, ulong. The same with signed basic types.

If the "Override type info" checkbox is set, the demangled name overrides the type information if both are present.

See also How to customize demangled names

Compiler

Action    name: SetupCompiler
 

This dialog box allows the user to specify the compiler used to create the program along with the memory model, default calling convention, ABI and other parameters.

Please note that while some combinations of the parameters are meaningless, IDA doesn't check them for validity. It is up to the user to specify a correct combination.

IDA tries to determine the correct values automatically.

The include directories are a list of directories that look for the standard C headers. This parameter is used during parsing C header files. The directories must be separated by ';' in MS Windows and ':' in Linux. The predefined macros field has the same format and is used similarly. Please note that IDA doesn't define any compiler-specific macros by default.

Customize Demangled Names

All your changes will be saved in the current database. If you want to change the form of demangled names for all new databases, then you need to edit the configuration file, variables 'ShortNameForm' and 'LongNameForm'. Below is the list of all checkboxes with examples (spaces are inserted only for the ease of understanding):

Only main name

        on:     func;
        off:    static void __pascal func(void) const;

No underscores in calling conventions

        on:     void   pascal func(void);
        off:    void __pascal func(void);

No calling conventions for parameters and __based()

        on:  void         func(int (*          f2)(void));
        off: void __cdecl func(int (* __pascal f2)(void));

No return type of functions

        on:         func(void);
        off:    int func(void);

No "based()" specifier

        on:   int                            a;
        off:  int __based(__segname("DATA")) a;
        on:   void __based(void) *b;
        off:  void               *b;
        on:   int __based(__self) (*p)(void);
        off:  int                 (*p)(void);

No calling conventions

        on:     void          func(void);
        off:    void __pascal func(void);

No postfix const

        on:     void aclass::func(void);
        off:    void aclass::func(void) const;

No access keywords

        on:             void func(void);
        off:    private void func(void);

No throw descriptions

        on:     void func(void);
        off:    void func(void) throw(Class::Member);

No static and virtual keywords

        on:                    void aclass::func(void);
        off:    static virtual void aclass::func(void);

No UDT keywords

        on:            A & func(      A *,      B *);
        off:     class A & func(class A *, enum B *);

No const and volatile keywords

        on:     char       * func(void);
        off:    char const * func(void);

No __closure keyword

        Do not display '__closure'

No __unaligned keyword

        Do not display '__unaligned'

No __pin/__box/__gc

        Do not display '__pin', '__box', '_gc'

Suppress pointer modifiers

     Selection    16Names     Description
     ---------    -------     -----------
     near           Yes     Do not display 'near'
     near/__ptr64           Do not display 'near' and '__ptr64'
     far            Yes     Do not display 'far'
     all, 16bit     Yes     Do not display any modifiers
     huge           Yes     Do not display 'huge'
     __ptr64                Do not display '__ptr64'
     Display all    Yes     Display all modifiers
     Display none   Auto    Do not display any modifiers

     16bit means that the demangler will assume that
     names were generated by 16bit compilers. Otherwise,
     it will assume names generated by 32/64 bit compilers.

Quash j_

        This option allows IDA to demangle a name even if it was formed
        by adding j_ prefix to a mangled name. The prefix j_ will simply
        be thrown away.

Transfer j_

        This option also allows IDA to demangle names with prefix j_.
        Unlike the previous option, this one will show the prefix
        in the demangled name.

Ignore postfix _nn

        This option allows IDA to demangle names formed by adding
        postfix _nn to a mangled name (n is any digit).

String literal style dialog

 Action    name: SetStrlitStyle
 

With this dialog you can setup string styles and also create a new string immediately at the current location.

The following string styles are defined:

      C-style (zero-terminated)
      DOS style ($ terminated)
      Pascal style (one byte length prefix)
      Wide pascal (two-byte length prefix)
      Delphi (four-byte length prefix)
      Unicode (UTF-16)
      Unicode pascal style (two-byte length prefix)
      Unicode wide pascal style (four-byte length prefix)
      Character terminated

If you select "character terminated" string style then you may specify up to 2 termination characters. The string will be terminated by any of these characters. If the second character is equal to 0, then it is ignored.

In IDA Qt you can also set a specific encoding to be used to display the string, or change the defaults for all strings. See string encodings.

String options

This dialog sets up the string literals options:

Generate names

        If this option is set, IDA will give meaningful names to
        newly created string literals.

Names prefix

        This prefix will be used to form the string name.

Mark as autogenerated If a name is marked as autogenerated, it will be displayed in a different color and will be included in the list of names depending on the current setting. Generate serial names

        IDA can generate serial names for string literals, i.e.

                pref_001,pref_002,pref_003 etc...

        To enable serial names generation, specify
        prefix for names,starting serial number and number of leading zeroes.

Each time you create a string literal, IDA generates a new serial name and assigns it to the string. String literal next line char

        This symbol, when encountered in the string, will make
        IDA start a new line in the string representation in the
        disassembly. Usually it is the line feed character ('\n').

Comment string literal references:

        This option tells IDA to display the contents of the string
        literal next to the instruction or offset that refers to the string.

String encodings

IDA Qt can display program strings using different encodings. You can specify default encodings for all strings or override the encoding of a specific string.

The following encodings can be used:

<default> - the default encoding for this string type (8-bit or 16-bit)

<no conversion> - the string bytes are printed using the current system encoding (after translating with XlatAsciiOutput array in the configuration file).

Windows codepages (e.g. 866, CP932, windows-1251)

Charset names (e.g. Shift-JIS, UTF-8, Big5)

You can add new encodings to the list using the context menu item Insert (Ins hotkey).

On Linux/OS X, you can run "iconv -l" to see the available encodings. Please note that some encodings are not supported on all systems.

Color configuration

This dialog allows you to customize the color settings.

 GUI version:
 ------------

IDA keeps the color configuration in the registry. There are 3 predefined schemes. The user can modify the existing schemes or add his own schemes. New schemes should be added to the "themes" subdirectory in IDA.

 Text version:
 -------------

IDA keeps colors in file IDACOLOR.CF. This file may reside in the IDA directory or in the current directory. It is a binary file. IDA automatically saves all your changes into this file.

If the current item line prefix has "black on black" color, then the current item will not be highlighted. The same is with current line color - if it is "black on black", the current line will not be highlighted.

You can change the colors using the Customize button. You may have up to 4 different color palettes and switch between them on fly. The color palette is saved in IDACOLOR.CF file.

Each line prefix has its own color code depending on the current item: (the fourth color palette values are shown)

 Line prefixes
   Library function             BRIGHT CYAN ON BLUE
   Regular function             WHITE ON BLUE
   Instruction                  BROWN ON BLUE
   Data                         WHITE ON BLUE
   Unexplored                   WHITE ON BLACK
   Externs                      BRIGHT MAGENTA ON BLUE
   Current item                 BRIGHT BLUE ON BLUE
   Current line                 YELLOW ON BLUE
   Default                      BLACK ON BLACK (not used)

If the "current item" or "current line" are BLACK ON BLACK, then they will not be highlighted.

The rest of the line is colored with the following codes:

 Keywords
   Instruction                  WHITE ON BLUE
   Directive                    YELLOW ON BLUE
   Macro name                   MAGENTA ON BLUE
   Register name                WHITE ON BLUE
   Other                        WHITE ON BLUE

 Names
   Dummy data                   WHITE ON BLUE
   Dummy code                   WHITE ON BLUE
   Dummy unexplored             MAGENTA ON BLUE
   Hidden                       GREY ON BLUE
   Library function             BRIGHT CYAN ON BLUE
   Local variable               GREEN ON BLUE
   Regular data                 YELLOW ON BLUE
   Regular code                 YELLOW ON BLUE
   Regular unexplored           RED ON BLUE
   Demangled                    BRIGHT GREEN ON BRIGHT BLUE
   Segment name                 YELLOW ON BLUE
   Imported name                LIGHT MAGENTA ON BLUE

 Constants
   Suspicious                   BRIGHT RED ON BLUE