Copyright: Produced by WebTwin (www.webtwin.com) HTML->WinHelp converter.


The Interactive Disassembler Help Index

For additional information and tutorial please visit our web page at www.datarescue.com/idabase/ida.htm

  Main Idea

  Menu system

  Index of IDC functions

  Credits

Basics

  IDA command line switches
  Configuration file
  Environment variables
  Keyboard Macros
  Calculator
  Segment Register Change Points
  Problems List
  Anchor
  Background Analysis
  Debugger

Windows

  Disassembly window
  Arrows window
  Messages window
  Exports window
  Imports window
  Segments window
  Names window
  Functions window
  Structures window
  Stack variables window
  Enums window
  Problems window
  Type libraries window
  Signatures window
  Cross-references window
  Selectors window
  Segment registers window
  File viewer
  File Editor
  Strings window
  Function calls window

How to...

  How To Use List Viewer
  How to use the Notepad
  How to Enter an Identifier
  How to Enter a Segment Value
  How to Enter an Address
  How to Enter a Number
  How to launch remote debugging

IDC language

  Expressions
  Statements
  Variables
  Functions

Miscellaneous


Main Idea

IDA is an interactive disassembler. It means that the user takes active participation in the disassembly process. IDA is not an automatic analyzer of programs. IDA will give you hints of suspicious instructions, unsolved problems etc. It is your job to inform IDA how to proceed.

If you are starting to use IDA for the very first time, there are some commands you will find very useful:

  - convert to instruction : the hotkey is "C"
  - convert to data : the hotkey is "D"

All the changes made by you are saved to disk. So when you start IDA again, all the information on the file being disassembled is read from the disk and so you can continue your work.

For other commands please refer to the menu system and the help.


Menu system

Main Menu Bar

  File
    Load file
      Reload input file
      IDC file
      Binary file
      IDS file
      Debug information file
      PDB debug information file
      FLIRT signature file
      C header file
    IDA command
    Produce output file
      Generate MAP file
      Generate ASM file
      Generate INC file
      Generate LST file
      Generate EXE file
      Generate DIF file
      Generate HTML file
      Dump database to IDC file
      Dump typeinfo to IDC file
    Save database
    Save database as...
    Abort
    Quit
  Edit
    instruction
    data
    ascii
    array
    undefine
    Rename
    Operand types
      Offset
        Convert operand to offset (data segment)
        Convert operand to offset (code segment)
        Convert operand to offset (any segment)
        Convert operand to offset (user-defined base)
        Convert operand to struct offset
      Number
        Convert operand to number
        Convert operand to hex number
        Convert operand to decimal number
        Convert operand to octal number
        Convert operand to binary number
        Convert operand to floating point number
        Toggle leading zeroes
      Convert operand to character
      Convert operand to segment
      Convert operand to symbolic constant (enum member)
      Convert operand to stack variable
      Change operand sign
      Bitwise negate operand
      User-defined operand
    Comments
      Create a regular comment
      Create a repeatable comments
      Create additional comment lines
      Insert a predefined comment
    Functions
      Create function...
      Edit function...
      Append function tail...
      Remove function tail...
      Delete function...
      Set function end
      Define stack variables...
      Change stack pointer...
      Rename register...
      Set function/item type...
    Structures
      Add struct type...
      Copy struct type...
      Del struct type
      Expand struct type...
      Shrink struct type...
      Move struct type...
      Declare struct var
      Force zero field offset
      Select union member...
      Create struct type from data...
    Enums
      Add enum type...
      Del enum type
      Edit enum type...
      Define an enum member...
      Edit an enum member...
      Delete an enum member
    Segments
      Create a new segment...
      Delete a segment...
      Change segment attributes...
      Move a segment...
      Rebase program...
      Change segment translation...
      Set default segment register value...
      Change segment register value...
    Patch core
      Patch core...
      Assemble...
    Other
      Alignment...
      Manual instruction...
      Color instruction...
      Hide/show border
    Plugins
  Jump
    Jump immediate
    Jump back
    Undo last jump back
    Empty navigation stack
    Jump to address
    Jump to named location
    Jump to segment start
    Jump to segment register change point
    Jump to problematic location
    Mark location
    Jump to marked position
    Jump to cross reference
    Jump to cross reference to operand
    Jump to function
    Jump to entry point
    Jump to file offset
  Search for
    suspicious operands
    string with error
    instruction bytes
    data bytes
    unexplored bytes
    explored bytes
    immediate operand values
    substring in the text representation
    substring in the binary image of the file
    instructions not belonging to any function
    find all suspicious operands
    find all errors
    Search direction
  View
    Open subviews...
      Open notepad
      Open disassembly window
      Open exports window
      Open imports window
      Open functions window
      Open names window
      Open signatures window
      Open segments window
      Open segment registers window
      Open selectors window
      Open cross references window
      Open structures window
      Open enums window
      Open problems window
      Open type libraries window
      Open strings window
      Open function calls window
    Graphs...
      Display function flow-chart
      Display function call graph
      Display chart of xrefs to addresses
      Display chart of xrefs from addresses
      Display user-defined chart of xrefs
    Calculator
    View segment registers
    View internal flags
    Hide
    Unhide
    Del hidden area
    Hide all
    Unhide all
    Setup hidden items...
    View File
    Edit file
  Debugger
    Debugger window
    Thread list
    Module list
    Start process
    Attach to process...
    Process options
    Pause process
    Terminate process
    Detach from process
    Take memory snapshot
    Trace into
    Step over
    Run until return
    Run to cursor
    Set current ip
    Show application screen
    Breakpoints
      Breakpoint list
      Add breakpoint
      Delete breakpoint
    Watchs
      Watchs list
      Add watch
      Del watch
    Tracing
      Trace window
      Clear trace
      Instruction tracing
      Function tracing
      Add write trace
      Add write trace
      Add read/write trace
      Add execution trace
      Stack trace
      Tracing Options
    Debugger options
    Switch debugger...
  Options
    Text representation...
    Comments...
    Representation of cross references...
    Assembler directives...
    Names representation...
    Demangled C++ names...
    Compiler...
    String styles...
    ASCII options...
    Colors...
    Dump/normal View
    Setup data types...
    Processor type...
    Target assembler...
    Analysis options...
    Miscellaneous...
  Windows
    Load desktop...
    Save desktop...
    Delete desktop...
    Reset desktop
    Reset hidden messages...
    Set video mode...
    External help
    Keyboard layout


Alphabetical list of IDC functions

The following conventions are used in the function descriptions:

  'ea' is a linear address
  'success' is 0 if a function fails, 1 otherwise
  'void' means that function returns no meaningful value (always 0)

 AddCodeXref
 AddConstEx
 AddEntryPoint
 AddEnum
 AddHotkey
 AddSourceFile
 AddStrucEx
 AddStrucMember
 AltOp
 AnalyzeArea
 Analysis
 AskAddr
 AskFile
 AskIdent
 AskSeg
 AskSelector
 AskStr
 AskYN
 AutoMark
 AutoMark2
 AutoShow
 Batch
 BeginEA
 Byte
 ChooseFunction
 CmtIndent
 Comment
 Comments
 Compile
 CreateArray
 DelArrayElement
 DelCodeXref
 DelConstEx
 DelEnum
 DelExtLnA
 DelExtLnB
 DelFixup
 DelFunction
 DelXML
 DelHashElement
 DelHiddenArea
 DelHotkey
 DelLineNumber
 DelSelector
 DelSourceFile
 DelStruc
 DelStrucMember
 DeleteAll
 DeleteArray
 Demangle
 Dfirst
 DfirstB
 Dnext
 DnextB
 Dword
 Exec
 Exit
 ExtLinA
 ExtLinB
 Fatal
 FindBinary
 FindCode
 FindData
 FindExplored
 FindFuncEnd
 FindImmediate
 FindProc
 FindSelector
 FindText
 FindUnexplored
 FindVoid
 FirstSeg
 GenerateFile
 GetArrayElement
 GetArrayId
 GetBmaskCmt
 GetBmaskName
 GetCharPrm
 GetColor
 GetConstBmask
 GetConstByName
 GetConstCmt
 GetConstEnum
 GetConstEx
 GetConstName
 GetConstValue
 GetCurrentLine
 GetDisasm
 GetEntryOrdinal
 GetEntryPoint
 GetEntryPointQty
 GetEnum
 GetEnumCmt
 GetEnumFlag
 GetEnumIdx
 GetEnumName
 GetEnumQty
 GetEnumSize
 GetFirstBmask
 GetFirstConst
 GetFirstHashKey
 GetFirstIndex
 GetFirstMember
 GetFirstStrucIdx
 GetFixupTgtDispl
 GetFixupTgtOff
 GetFixupTgtSel
 GetFixupTgtType
 GetFlags
 GetFrame
 GetFrameArgsSize
 GetFrameLvarSize
 GetFrameRegsSize
 GetFrameSize
 GetFuncOffset
 GetFunctionAttr
 GetFunctionCmt
 GetFunctionFlags
 GetFunctionName
 GetHashLong
 GetHashString
 GetIdaDirectory
 GetIdbPath
 GetInputFile
 GetInputFilePath
 GetLastBmask
 GetLastConst
 GetLastHashKey
 GetLastIndex
 GetLastMember
 GetLastStrucIdx
 GetLineNumber
 GetLongPrm
 GetManualInsn
 GetMarkComment
 GetMarkedPos
 GetMemberComment
 GetMemberFlag
 GetMemberName
 GetMemberOffset
 GetMemberQty
 GetMemberSize
 GetMemberStrId
 GetMnem
 GetNextBmask
 GetNextConst
 GetNextFixupEA
 GetNextHashKey
 GetNextIndex
 GetNextStrucIdx
 GetOpType
 GetOperandValue
 GetOpnd
 GetOriginalByte
 GetPrevBmask
 GetPrevConst
 GetPrevFixupEA
 GetPrevHashKey
 GetPrevIndex
 GetPrevStrucIdx
 GetReg
 GetRegValue
 GetSegmentAttr
 GetShortPrm
 GetSourceFile
 GetSpDiff
 GetSpd
 GetStringType
 GetStrucComment
 GetStrucId
 GetStrucIdByName
 GetStrucIdx
 GetStrucName
 GetStrucNextOff
 GetStrucPrevOff
 GetStrucQty
 GetStrucSize
 GetTrueName
 GetType
 GetnEnum
 GetXML
 GuessType
 HideArea
 HighVoids
 Indent
 IsBitfield
 IsUnion
 ItemEnd
 ItemSize
 Jump
 LineA
 LineB
 LoadTil
 LocByName
 LowVoids
 MK_FP
 MakeAlign
 MakeArray
 MakeByte
 MakeCode
 MakeComm
 MakeDouble
 MakeDword
 MakeFloat
 MakeFrame
 MakeFunction
 MakeLocal
 MakeNameEx
 MakeOword
 MakePackReal
 MakeQword
 MakeRptCmt
 MakeStr
 MakeStructEx
 MakeTbyte
 MakeUnkn
 MakeVar
 MakeWord
 MarkPosition
 MaxEA
 Message
 MinEA
 Name
 NextAddr
 NextFunction
 NextHead
 NextNotTail
 NextSeg
 OpAlt
 OpBinary
 OpChr
 OpDecimal
 OpEnumEx
 OpHex
 OpHigh
 OpNot
 OpNumber
 OpOctal
 OpOff
 OpOffEx
 OpSeg
 OpSign
 OpStkvar
 OpStroffEx
 PatchByte
 PatchDword
 PatchWord
 PopXML
 PrevAddr
 PrevFunction
 PrevHead
 PrevNotTail
 PushXML
 RenameArray
 RenameEntryPoint
 Rfirst
 Rfirst0
 RfirstB
 RfirstB0
 Rnext
 Rnext0
 RnextB
 RnextB0
 RptCmt
 RunPlugin
 ScreenEA
 SegAddrng
 SegAlign
 SegBounds
 SegByBase
 SegByName
 SegClass
 SegComb
 SegCreate
 SegDefReg
 SegDelete
 SegEnd
 SegName
 SegRename
 SegStart
 SelEnd
 SelStart
 SetArrayLong
 SetArrayString
 SetBmaskCmt
 SetBmaskName
 SetCharPrm
 SetColor
 SetConstCmt
 SetConstName
 SetEnumBf
 SetEnumCmt
 SetEnumFlag
 SetEnumIdx
 SetEnumName
 SetFixup
 SetFlags
 SetFunctionAttr
 SetFunctionCmt
 SetFunctionEnd
 SetFunctionFlags
 SetHiddenArea
 SetManualInsn
 SetHashLong
 SetHashString
 SetLineNumber
 SetLongPrm
 SetMemberComment
 SetMemberName
 SetMemberType
 SetProcessorType
 SetReg
 SetRegValue
 SetSegmentAttr
 SetSegmentType
 SetSelector
 SetShortPrm
 SetSpDiff
 SetStatus
 SetStrucComment
 SetStrucIdx
 SetStrucName
 SetType
 SetXML
 StringStp
 Tabs
 TailDepth
 Til2Idb
 Voids
 Wait
 Warning
 Word
 XrefShow
 XrefType
 add_dref
 atoa
 atol
 byteValue
 del_dref
 fclose
 fgetc
 filelength
 fopen
 form
 fprintf
 fputc
 fseek
 ftell
 hasName
 hasValue
 isBin0
 isBin1
 isChar0
 isChar1
 isCode
 isData
 isDec0
 isDec1
 isDefArg0
 isDefArg1
 isEnum0
 isEnum1
 isExtra
 isFlow
 isFop0
 isFop1
 isHead
 isHex0
 isHex1
 isLoaded
 isOct0
 isOct1
 isOff0
 isOff1
 isRef
 isSeg0
 isSeg1
 isStkvar0
 isStkvar1
 isStroff0
 isStroff1
 isTail
 isUnknown
 isVar
 loadfile
 ltoa
 ord
 readlong
 readshort
 readstr
 rotate_left
 savefile
 set_start_cs
 set_start_ip
 strlen
 strstr
 substr
 writelong
 writeshort
 writestr
 xtol


Credits

IDA Pro is a complex and multifunctional piece of software.
It contains some third party code with the license requiring to be mentioned in the documentation.
Below is the list:

InfoZIP libraries

  Copyright (C) 1995-2002 Jean-loup Gailly and Mark Adler

  This software is provided 'as-is', without any express or implied
  warranty.  In no event will the authors be held liable for any damages
  arising from the use of this software.

  Permission is granted to anyone to use this software for any purpose,
  including commercial applications, and to alter it and redistribute it
  freely, subject to the following restrictions:

  1. The origin of this software must not be misrepresented; you must not
     claim that you wrote the original software. If you use this software
     in a product, an acknowledgment in the product documentation would be
     appreciated but is not required.
  2. Altered source versions must be plainly marked as such, and must not be
     misrepresented as being the original software.
  3. This notice may not be removed or altered from any source distribution.

  Jean-loup Gailly        Mark Adler
  jloup@gzip.org          madler@alumni.caltech.edu

REGEXP package

  Copyright (c) 1992, 1993, 1994 Henry Spencer.
  Copyright (c) 1992, 1993, 1994
       The Regents of the University of California.  All rights reserved.

  This code is derived from software contributed to Berkeley by
  Henry Spencer.

  Redistribution and use in source and binary forms, with or without
  modification, are permitted provided that the following conditions
  are met:
  1. Redistributions of source code must retain the above copyright
     notice, this list of conditions and the following disclaimer.
  2. Redistributions in binary form must reproduce the above copyright
     notice, this list of conditions and the following disclaimer in the
     documentation and/or other materials provided with the distribution.
  3. All advertising materials mentioning features or use of this software
     must display the following acknowledgement:
       This product includes software developed by the University of
       California, Berkeley and its contributors.
  4. Neither the name of the University nor the names of its contributors
     may be used to endorse or promote products derived from this software
     without specific prior written permission.

  THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  SUCH DAMAGE.

DSP56K analyzer part of DSP56K module

  Copyright (c) 1998 Miloslaw Smyk
  All rights reserved.
  Support for DSP 563xx added by Ivan Litvin

  Redistribution and use in source and binary forms, with or without
  modification, are permitted provided that the following conditions
  are met:
  1. Redistributions of source code must retain the above copyright
     notice, this list of conditions and the following disclaimer.
  2. Redistributions in binary form must reproduce the above copyright
     notice, this list of conditions and the following disclaimer in the
     documentation and/or other materials provided with the distribution.
  3. All advertising materials mentioning features or use of this software
     must display the following acknowledgement:
       This product includes software developed by Miloslaw Smyk
  4. The name of the author may not be used to endorse or promote products
     derived from this software without specific prior written permission

  THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

TVision port to Linux is partially based on modifications made by Sergio Sigala

  All changes copyright (c) 1997 Sergio Sigala, Brescia, Italy.
  All rights reserved.

  Redistribution and use in source and binary forms, with or without
  modification, are permitted provided that the following conditions
  are met:
  1. Redistributions of source code must retain the above copyright
     notice, this list of conditions and the following disclaimer.
  2. Redistributions in binary form must reproduce the above copyright
     notice, this list of conditions and the following disclaimer in the
     documentation and/or other materials provided with the distribution.

  THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Gnome libxml2 library

  Except where otherwise noted in the source code (e.g. the files hash.c,
  list.c and the trio files, which are covered by a similar licence but
  with different Copyright notices) all the files are:

 Copyright (C) 1998-2003 Daniel Veillard.  All Rights Reserved.

  Permission is hereby granted, free of charge, to any person obtaining a copy
  of this software and associated documentation files (the "Software"), to deal
  in the Software without restriction, including without limitation the rights
  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  copies of the Software, and to permit persons to whom the Software is fur-
  nished to do so, subject to the following conditions:

  The above copyright notice and this permission notice shall be included in
  all copies or substantial portions of the Software.

  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FIT-
  NESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
  DANIEL VEILLARD BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
  IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CON-
  NECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

  Except as contained in this notice, the name of Daniel Veillard shall not
  be used in advertising or otherwise to promote the sale, use or other deal-
  ings in this Software without prior written authorization from him.

HASH.C library

  hash.c: chained hash tables

  Reference: Your favorite introductory book on algorithms

  Copyright (C) 2000 Bjorn Reese and Daniel Veillard.

  Permission to use, copy, modify, and distribute this software for any
  purpose with or without fee is hereby granted, provided that the above
  copyright notice and this permission notice appear in all copies.

  THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE AUTHORS AND
  CONTRIBUTORS ACCEPT NO RESPONSIBILITY IN ANY CONCEIVABLE MANNER.

  Author: breese@users.sourceforge.net

LIST.C library

  list.c: lists handling implementation

  Copyright (C) 2000 Gary Pennington and Daniel Veillard.

  Permission to use, copy, modify, and distribute this software for any
  purpose with or without fee is hereby granted, provided that the above
  copyright notice and this permission notice appear in all copies.

  THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE AUTHORS AND
  CONTRIBUTORS ACCEPT NO RESPONSIBILITY IN ANY CONCEIVABLE MANNER.

  Author: Gary.Pennington@uk.sun.com

TRIO library

  Copyright (C) 1998 Bjorn Reese and Daniel Stenberg.

  Permission to use, copy, modify, and distribute this software for any
  purpose with or without fee is hereby granted, provided that the above
  copyright notice and this permission notice appear in all copies.

  THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE AUTHORS AND
  CONTRIBUTORS ACCEPT NO RESPONSIBILITY IN ANY CONCEIVABLE MANNER.


IDA command line switches

IDA is started with one of the following command lines:

        idag input-file        (Windows: start graphical interface)
        idaw input-file        (Windows: start text interface)
        idal input-file        (Linux  : start text interface)

Add the '64' postfix to the command name in order to start the 64-bit version of IDA. For example:

        idag64 input-file

we start 64-bit graphical interface.

You may specify a file mask instead of the file name.

There a special "batch" mode when IDA can be used to analyze files in the unattended mode. See details below.

The following command line switches are allowed:

 -a     disable auto analysis
 -A     autonomous mode. IDA will not display dialog boxes.
        Designed to be used together with -S switch.
 -b#### loading address (hex)
 -B     batch mode. IDA will generate .IDB and .ASM files automatically
 -c     disassemble a new file (delete the old database)
 -ddirective
        A configuration directive which must be processed at the first
        pass. Example:
                -dVPAGESIZE=8192
 -Ddirective
        A configuration directive which must be processed at the second
        pass.
 -f     disable FPP instructions (IBM PC only)
 -h     help screen
 -i#### program entry point (hex)
 -M     disable mouse (text only)
 -O#### options to pass to plugins
 -o#### specify the output database (implies -c)
 -p#### processor type
 -P+    pack database
 -P-    do not pack database (see Abort command)
 -r###  immediately run the built-in debugger
        format of this switch is explained here
 -R     load MS Windows exe file resources
 -S###  execute IDC file. Note that IDA always executes IDA.IDC
        file if it exists.
 -W###  specify MS Windows directory
 -x     do not create segmentation
        (used in pair with Dump database command)
        this switch affects EXE and COM format files only.
 -z     debug:
                00000001 drefs
                00000002 offsets
                00000004 flirt
                00000008 idp module
                00000010 ldr module
                00000020 plugin module
                00000040 ids files
                00000080 config file
                00000100 check heap consistency
                00000200 checkarg
                00000400 demangler
                00000800 queue
                00001000 rollback
                00002000 already data or code
                00004000 type system
                00008000 show all notifications
                00010000 debugger
 -?     this screen
 ?      this screen

For the batch mode IDA must be invoked with the following command line:

        idag -B input-file

which is equivalent to

        idag -c -A -Sanalysis.idc input-file

Some users prefer the text interface in the batch files (idaw)

For more information please see the analysis.idc file in the IDC subdirectory.


Configuration files

The configuration files are searched in the IDA.EXE directory. In the configuration files you can use C,C++ style comments and include files. If it is not found, IDA uses default values. IDA uses the following configuration files:

 IDA.CFG    - general config file
 IDATUI.CFG - text mode interface config file
 IDAGUI.CFG - graphics mode interface config file

In the IDATUI.CFG you can define the hotkeys and keyboard macros for the text version of IDA Pro. Syntax:

        "ActionName" = Value

where value may be:

        a string:       "Ctrl-F5"
        a char:         'F'
        a scancode:     0x4900
        zero:           0

Zero scancode disables the hotkey.

To define the keyboard macros:

     MACRO key { key1 key2 key3 ... keyN }

where key is a string (key name), char or a scancode. Example:

        MACRO   "Alt-W" // this sample macro jumps to "start" label
        {
                "Ctrl-G"
                's' 't' 'a' 'r', 't'
                "Enter"
        }


Environment variables

The following environment variables are used by IDA:

TMP or TEMP     Specifies the directory where the temporary files will
                be created.
                Default: C:\TEMP

IDALOG          Specifies the name of the log file. Everything appearing
                in the messages window will be dumped there.
                Default: none

IDADIR          Specifies the IDA directory.
                Default: the directory where IDA.EXE is located

IDAUSR          Specifies the directory for user-specific settings.
                Default: Windows: "$CSIDL_APPDATA/Datarescue/IDA Pro"
                         Linux:   $HOME/.idapro

IDAIDS          Specifies the directory with the IDS files.
                Default: %IDADIR%\IDS

IDASGN          Specifies the directory with the SIG files.
                Default: %IDADIR%\SIG

IDATIL          Specifies the directory with the TIL files.
                Default: %IDADIR%\TIL

IDAIDC          Specifies the directory with the IDC files.
                Default: %IDADIR%\IDC

IDAPLG          Specifies the directory with the plugin files.
                Default: %IDADIR%\PLUGINS

NONAMES         Disables the name resolution

IDA_NORELOC     Disables processing of the relocation information
                for some file formats

H8_NOSIZER      Disables the display of the operand sizes for H8 module

IDA_NOWIN       (Text MS Windows version only)
                Bypass the code trying to find out the foreground window.
                This code causes problems under WINE.

IDA_DONT_SWITCH_SCREENS

                (text version only)
                Tells IDA to keep only one screen even during local
                debugging sessions. By default for local
                debugging sessions IDA keeps one screen for the
                debugged application and one screen for itself.

TV_DELAY (Text version only under MS Windows'95)

IDA_ELF_PATCH_MODE Overrides the patch mode for the new ELF files. If this variable is defined, it must contain a number. Each bit of this number corresponds to an option from the following list:

   0: Replace PIC form of 'Procedure Linkage Table' to non PIC form
   1: Direct jumping from PLT (without GOT) irrespective of its form
   2: Convert PIC form of loading '_GLOBAL_OFFSET_TABLE_[]' of address
   3: Obliterate auxiliary bytes in PLT & GOT for 'final autoanalysis'
   4: Natural form of PIC GOT address loading in relocatable file
   5: Unpatched form of PIC GOT references in relocatable file
   6: Mark 'allocated' objects as library-objects (MIPS only)

The following variables are used to fine-tune the Linux version of IDA:

TVLOG the name of the log-file if it is not defined, use syslog with LOG_WARNING priority TERM the terminal definition (see terminfo) TVOPT the enduser flags. Has many subfields delimited by commas ','. noX11 - when libX11.so is not compatible noGPM - when libgpm.so is not compatible ansi - OR mono - when the terminfo data of your display does not declare it as haing the ANSI-color support ign8 - ignore '8bit as meta key' in the terminfo description xtrack - if your xterm-emulator in telnet client does not support mode 1002 (only 1000), set this flag alt866 - do not encode pseudographic symbols (for the console with alt-font loaded) cyrcvt= - cyrilic conversion (oem/koi8r). possible values are: linux - for linux russian users and PuTTY (in/out koi8r) kwin - output in koi8 and input in cp1251 - any telnet windows - for many telents and any linux users (in/out 1251)

 Client name | Terminal   | TVOPT  | Client settings
 ------------|------------|--------|---------------------------------------
             |            |        |
 SecureCRT   |xterm-scokey| xtrack | Emulation->Terminal: xterm,
             |            |        | Emulation->keyboard: either the
             |            |        |   built-in keyboard, either custom
             |            |        |                  'xt-sco.key' file
             |            |        | Advanced->Terminaltype: xterm-scokey
             |            |        |
 SecureCRT   |   xterm    | xtrack | Emulation->Terminal: xterm+internal kbd
             |            |        |
             |            |        |
 Putty       |xterm-scokey|   -    | Terminal,Keyboard: Control?, Standard,
             |            |        |                    SCO, Normal, Normal
             |            |        |
 Putty       |   xterm    |   -    | Terminal,Keyboard: ControlH, Standard,
             |            |        |                    ~num, Normal, Normal
             |            |        |
 Console     |   linux    |   -    | default
             |            |        |
 X11:xterm   |   xterm    |   -    | default

We recommend to use the 'xterm-scokey' terminal type for remote clients.

When the terminal type is xterm-scokey then add to /etc/inputrc (or to ~/.inputrc) the following string:

"\e[.": delete char

When working on the console without GPM installed, append "noGPM" to TVOPT.

Russian users should append the following settings to the above:

                  | APPEND  TO TVOPT  | APPEND TO Client Settings
 -----------------|---------------------|----------------------------
 Console          | alt866,cyrcvt=linux |
                  |                     |
 X11              | cyrcvt=linux        |
                  |                     |
 Putty            | cyrcvt=linux        | Window,Translation: use font in
                  |                     |           both ANSI and OEM modes
                  |                     |
 SecureCRT        |                     |
   with koi8font  |                     |
    and kbd-hook  | cyrcvt=linux        |
    with koi8font | cyrcvt=kwin         |
   with ANSI-font | cyrcvt=windows      |
                  |                     |
    The best settings for russian users on the console are:
         setfont alt-8x16.psf.gz -m koi2al
         loadkey ru-ms.map
         export TVOPT=cyrcvt=linux,alt866


Keyboard Macros

You can define a keyboard macro to automate frequent keystroke sequences. They are defined in the same manner as in the Borland IDE:

        - Press Alt--
        - Press <key> - macro name
        - Enter macro body
        - Press Alt-=

All macros are lost when you exit IDA. If you want to have a static macro which is not lost when you quit IDA, then write it down into IDATUI.CFG file. The format of a macro definition is explained here.

NOTE: keyboard macros are available only in the text version of IDA Pro.


Calculator

 Action    name: Calculate

A simple calculator is provided. You can enter constant C-style expressions. Syntax of the expressions is the same is the syntax of IDC expressions. Result is displayed in the message window in three forms: hexadecimal,decimal and character.

All the names created during a disassembly may be used in these expressions. IDA can also pick up the name or number under the cursor and to store it into the input line.

See also

         View submenu.
         How to Enter a Number.


Segment Register Change Points

When IDA encounters an instruction which changes a segment register, it creates a segment register change point. So, mostly change points are maintained by IDA itself. IDA assumes that between change points the segment registers do not change their values. If you find out that IDA failed to locate a segment register changing, or you want to change a register value, you can create a change point using Change Segment Register command. You can change the value of a segment register using Set default segment register value command too.

IDA classifies the change points. In the list of the change points you can see the following postfixes after the register values:

 a (auto)     - Created by IDA. May be changed by IDA afterwards.
 u (by user)  - Created by user. IDA will not change it.

IDA generates the appropriate 'assume' instructions for the change points if it was not disabled by the corresponding command.


Problems List

The following problems may occur:

 NOOFFSET Can't find offset base
 NONAME   Can't find name
 NOFORCED Can't find alternative string for an operand
 NOCMT    Can't find comment
 NOREF    Can't find references
 INDIRJMP Indirect execution flow
 NODISASM Can't disassemble
 ALREADY  Already data or code
 BOUNDS   Execution flows beyond limits
 OVERFLOW Too many lines
 BADSTACK Failed to trace the value of the stack pointer
 LOOKHERE Attention! Probably erroneous situation
 DECISION Decision to convert to instruction/data is made by IDA
 ROLLBACK The decision made by IDA was wrong and rolled back
 COLISION FLAIR collision: the function with the given name already exists

See also Jump submenu.


Anchor

Various IDA commands use an anchor. For example to select a portion of file to output or to specify a segment to move... you need an anchor. To drop the anchor, you can use the Alt-L key. Or, a more convenient way is the Shift-<arrow> combination. You can drop the anchor with the mouse also: simply click and drag.

After you've dropped the anchor, you can move freely using arrows, etc. Any command that uses the anchor, raises it.

The anchored area is displayed with another color.

When you exit from IDA, the anchor value is lost.


Background Analysis

IDA can analyze the program when it is not occupied performing an action you prompted. Thus IDA and you disassemble the program together, but your requests have priority.

The state of background analysis is shown on the upper right-hand corner of the screen.

You can disable autoanalysis, but in this case some functions of IDA will produce strange results (e.g. if you try to convert data into instructions, IDA will NOT trace all the threads of control flow and the data will be converted into instructions only on the screen...)

See also analysis options.


Debugger submenu

Here are the commands to use the debugger.

  Debugger window
  Thread list
  Module list
  Start process
  Attach to process...
  Process options
  Pause process
  Terminate process
  Detach from process
  Take memory snapshot
  Trace into
  Step over
  Run until return
  Run to cursor
  Set current ip
  Show application screen
  Breakpoints
  Watchs
  Tracing
  Debugger options
  Switch debugger...

See also Menu Bar submenus.


Open disassembly window

 Action    name: WindowOpen

Opens a new window with the disassembly. IDA automatically opens one disassembly window at the start.

Use the disassembly editing commands to disassemble the input file.

In this window you can switch between the normal mode and the dumping mode.

Use Shift-<arrows> or Alt-L to drop anchor. If you have a mouse, you can drop the anchor with it too.

A double click of the mouse is equvalent to the <Enter> key.

To the left of disassembly, there is an arrows window (GUI version). Also the GUI version highlights the current identifier.

See also View|Open subviews submenu.


The arrows window

In the graphical version, there is a small window with arrows on the left of the disassembly. These arrows represent the execution flow, namely the branch and jump instructions. The arrow color can be:

        - red: means that the arrow source and destination don't
        belong to the same function. Usually the branches are
        within functions and the red color will conspicuously
        represent branches from or to different functions.
        - black: the currently selected arrow. The selection
        is made by moving to the beginning or the end of the
        arrow using the Up or Down keys or left-clicking on the arrow
        start or the arrow end. The selection is
        not changed by pressing the PageUp, PageDown, Home, End keys or using
        the scrollbar. This allows to trace the selected arrow far away.
        - grey: all other arrows

The arrow thickness can be:

        - thick: a backward arrow. Backward arrows usually represent
        loops. Thick arrows represent the loops in a clear and
        notable manner.
        - thin: forward arrows.

Finally, the arrows can be solid or dotted. The dotted arrows represent conditional branches when the solid arrows represent unconditional branches.

You can resize the arrows window using a vertical splitter or even fully hide it. If it is hidden, the arrows window will not be visible on the screen but you can reveal it by dragging the splitter to the right. IDA remembers the current arrow window size in the registry when you close the disassembly window.


Messages Window

IDA opens a special non-closable window at the start. This window is called a messages window. In this window you see various IDA messages.

If the messages window is hidden behind other windows, you will not see the IDA messages.

You can duplicate all messages appearing in this window to a file. For this, you have to define an environment variable:

        set IDALOG=logfile


Open exports window

 Action    name: OpenExports

This command opens the exports window.

You can use list viewer commands in this window.

See also View|Open subviews submenu.


Open imports window

 Action    name: OpenImports

This command opens the imports window.

You can use list viewer commands in this window.

See also View|Open subviews submenu.


Open segments window

 Action    name: ShowSegments

This command opens the segments window. The format of this window is explained here.

You can use list viewer commands in this window.

In order to change the selector values use selectors window.

See also View|Open subviews submenu.


Open names window

 Action    name: OpenNames

This command opens the names window.

You can use list viewer commands in this window.

The GUI version displays a small icon for each name:

        L (dark blue)   - library function
        F (dark blue)   - regular function
        C (light blue)  - instruction
        A (dark green)  - ascii string
        D (light green) - data
        I (purple)      - imported name

See also View|Open subviews submenu.


Open functions window

 Action    name: OpenFunctions

A list of all functions in the program is displayed. You can add, delete, modify functions using list viewer commands.

Listed for each function are:

        - function name
        - segment that contains the function
        - offset of the function within the segment
        - function length in bytes

The last column of this window has the following format:

        R       - function returns to the caller
        F       - far function
        L       - library function
        S       - static function
        B       - BP based frame. IDA will automatically convert
                  all frame pointer [BP+xxx] operands to stack
                  variables.
        T       - function has type information
        =       - Frame pointer is equal to the initial stack pointer
                  In this case the frame pointer points to the bottom of the frame
        M       - reserved
        S       - reserved
        I       - reserved
        C       - reserved
        D       - reserved
        V       - reserved

See also View|Open subviews submenu.


Open structures window

 Action    name: OpenStructures

This command opens the structure definitions window.

You can modify structure definitions here: add/rename/delete structures, add/delete/define structure members.

Each structure must have a unique name. A field name must be unique in the structure. In order to create or delete a field, use data definitions commands (data, ascii, array, undefine, Rename). Also you may define regular or repeatable comments.

In order to modify member types, use commands from the Edit|Operand types... submenu. For example, to convert a structure member to an offset, use one of the following commands:

      Convert to offset (automatic)
      Convert to offset (from a segment base)
      Convert to offset (complex offset expression)

See also View|Open subviews submenu.


Open Stack Variable Window

 Action    name: OpenStackVariables

This command opens the stack variables window for the current function.

The stack variables are internally represented as a structure. This structure consists of two parts: local variables and function arguments.

You can modify stack variable definitions here: add/delete/define stack variables, enter comments for them.

There may be two special fields in this window: " r" and " s". They represent the size of the function return address and of the saved registers in bytes. You can't modify them directly. To change them, use edit function command.

Offsets at the line prefixes represent offsets from the frame pointer register (BP). The window indicator at the lower left corner of the window displays offsets from the stack pointer.

In order to create or delete a stack variable, use data definitions commands (data, ascii, array, undefine, Rename). Also you may define regular or repeatable comments.

The defined stack variables may be used in the program by converting operands to stack variables.

Esc closes this window.

See also

         Edit|Functions submenu.
         Convert to stack variable


Open enums window

 Action    name: OpenEnums

This command opens the enum definitions window.

You can modify enum definitions here: add/edit/delete enums, add/edit/delete enum members (i.e. user-defined symbolic constants)

Please note that you can create bitfield definitions here.

Also you can add a comment for the enum and for each enum member. In order to specify an enum comment, you have to stand at the enum name. Comments are set using regular commands:

      Regular comments
      Repeatable comments

See also View|Open subviews submenu.


Open problems window

 Action    name: OpenProblems

This command opens the problems window. The problem window contains the list of all problems encountered by IDA during disassembling the program.

You can jump to a problem by pressing Enter. The selected problem will be deleted from the list.

See also View|Open subviews submenu.


Open type libraries window

 Action    name: OpenTypeLibraries

This command opens the type libraries window. Here the user can load and unload standard type libraries.

The standard type libraries contain type definitions from the standard C header supplied with compilers. Usually IDA tries to determine the target compiler and its type libraries automatically but if it fails, this window allows you to load the appropriate type library.

Also don't forget to specify the compiler and memory model in the compiler setup dialog box.

See also View|Open subviews submenu.


Open signatures window

 Action    name: OpenSignatures

This command opens the signatures window.

For each signature the following is displayed:

        - name of file with the signature
        - state of signature:
                - Planned: the signature will be applied
                - Current: the signature is being applied
                - Applied: the signature has been applied
        - number of functions found using the signature
        - description of the signature

You can modify the planned signatures list here: add/delete library modules to be used during the disassembling.

You cannot delete an applied signature from the list.

To add a signature to the list for the application press <Ins>. You will see a list of signatures that can be applied to the program being disassembled.

Text version: Not all signature files will be displayed (for example, 32 bit signatures will not be shown for a 16 bit program). If you want to see the full list of signatures, select the first line of the list saying SWITCH TO FULL LIST OF SIGNATURES.

Signature files reside in the subdirectories of the SIG directory. Each processor has its own subdirectory. The name of the subdirectory is equal to the name of the processor module file (z80 for z80.w32, for example). Note: IBM PC signatures are located in the SIG directory itself. Note: the IDASGN environment variable can be used to specify the location of the signatures directory.

See also

         View|Open subviews submenu.
         How To Use List Viewer


Open cross references window

 Action    name: OpenXrefs

This command opens the cross-references window. This window contains all references to the current location.

You can use list viewer commands in this window.

You can add and delete cross references here too by pressing Ins or Del. Right clicking on the mouse will work too.

Add a cross reference: the from and to address, as well as the xref type should be specified.

Del a cross reference: if the 'undefine if no more xrefs' is check, then the instruction at the target address will be undefined upon the deletion of the last xref. IDA undefines instructions only if they do not start a function.

See also View|Open subviews submenu.


Open selectors window

 Action    name: ShowSelectors

This command opens the selector window. Here you can change selector-base mapping.

You can use list viewer commands in this window:

        - jump to the paragraph pointed by the selector
        - add a new selector
        - delete selector (if it is not used by any segment)
        - change selector value (this leads to reanalysis of all program)

See also View|Open subviews submenu.


Open segment registers window

 Action    name: ShowSegmentRegisters

This command opens the segment registers window. The window will contain segment register change points list.

You can use list viewer commands in this window.

Depending on the current processor type, you will see DS,ES,SS with or without FS,GS.

See also Edit|Segments submenu. View|Open subviews submenu.


File Viewer

 Action    name: ViewFile

This command is available in the text version only.

You can create an additional window to look at the file contents. Using this command you can look at files of any size. To close the opened window, press Alt-F3.

You can move around using normal arrows, etc., and:

        @<AskNextText>           search for a text
        @<JumpText>          search again
        Alt-G           goto line number...

You can edit small files using EditFile command.

See also View submenu.


Edit File

 Action    name: EditFile

This command is available in the text version only.

Here is a built-in text editor in IDA. You may use it to edit small files.

 You can use the following keys in the file editor:

 Ctrl-Q F       Search                  Shift-<arrow>   Select
 Ctrl-L         Search Again            Ctrl-K B        Start Select
 Ctrl-Q A       Replace (no prompts)    Ctrl-K H        Hide Select
 Ctrl-U         Undo                    Ctrl-Ins        Copy
                                        Ctrl-Del        Clear
 Ctrl-Left      Word Left               Shift-Ins       Paste
 Ctrl-Right     Word Right              Shift-Del       Cut
 Ctrl-PgUp      Text Start
 Ctrl-PgDn      Text End                Ctrl-Y          Delete Line
                                        Ctrl-Q H        Delete Line Start
 Ctrl-O         Indent Mode             Ctrl-Q Y        Delete Line End
                                        Ctrl-T          Delete Word

When you close this window using 'WindowClose' command (hotkey @<WindowClose>), IDA will ask you to save the file if it was modified. No backup files will be created.

You can view files of arbitrary size using ViewFile command.

See also View submenu.


Open strings window

 Action    name: OpenStrings

This command opens the strings window.

The strings window contains all strings in the program.

You can setup the list parameters by right-clicking (or pressing Ctrl-U in the text version) on the list.

The list always contains strings defined in the program regardless of the settings in this dialog box but the user can ask IDA to display strings not yet explicitly defined as strings.

The following parameters are available:

Display only defined strings

        If checked, IDA will display only strings explicitly marked
        as string items (using the create ascii command).
        In this case the other checkboxes are ignored.

Ignore instructions/data definitions

        If checked, IDA will ignore instruciton/data definitions
        and will try to treat them as strings. If it can build a string
        with the length greater than the minimal length, the string
        will be displayed in the list.
        This setting is ignored if 'only defined strings' is on.

Strict ASCII (7-bit) strings

        If checked, only strings containing exclusively 7-bit characters
        (8th bit must be zero) will be added to the list. Please note that
        the user can specify which characters are accepted in the strings
        by modifying the AsciiStringChars parameter in the ida.cfg file.
        This setting is ignored if 'only defined strings' is on.

Allowed string types

        Allows the user to specify the string types included in the list.
        This setting is ignored if 'only defined strings' is on.

Minimal string length

        The minimal length the string must have to be added to the list.

See also View|Open subviews submenu.


Open function calls window

 Action    name: OpenCallers

This command opens the function calls window.

All functions who call the current function are displayed at the top of the window.

All functions called from the current function are displayed at the bottom of the window.

The list is automatically refreshed when the cursor is moved to another function.

See also View|Open subviews submenu.


How To Use List Viewer

1. You can use all movement keys: PgUp,PgDn,Home,End and arrows.

2. You can position to a line simply by typing in the desired line number.

3. You can find a line typing in the beginning of it. In this case you can use Backspace key to erase the last character typed in. Ctrl-Enter to find another line with the same prefix. Please note that list viewer ignores the prefix of a line up to the last backslash (\\) or slash (/) if it exists.

4. Alt-T search for a substring (case-insensitive) Ctrl-T repeat last search

5. If the list is not in dialog mode you can use the following keys: Enter jump to the selected item in the last IDA View window Ctrl-E edit the current item Del delete the current item Ins insert a new item Ctrl-U refresh information in the window

Esc or Enter closes the window.


How to use The Notepad

 You can use the following keys in the notepad:

 Enter          starts a new line
 Ctrl-Enter     finishes the input
 Esc            cancels the input
 F1             gives some help

                                        Shift-<arrow>  Select
 Ctrl-L         Search Again            Shift-Ins       Paste
 Ctrl-O         Indent Mode             Shift-Del       Cut
 Ctrl-T         Delete Word             Ctrl-Ins        Copy
 Ctrl-U         Undo                    Ctrl-Del        Clear
 Ctrl-Y         Delete Line             Ctrl-K B        Start Select
 Ctrl-Left      Word Left               Ctrl-K H        Hide Select
 Ctrl-Right     Word Right
 Ctrl-PgUp      Text Start              Ctrl-Q A        Replace
 Ctrl-PgDn      Text End                Ctrl-Q F        Search
                                        Ctrl-Q H        Delete Line Start
                                        Ctrl-Q Y        Delete Line End

Input containing only whitespaces is equal to an empty input.

Do not forget that you can use the clipboard.


How to Enter an Identifier

An identifier is a name which starts with a letter and contains only letters and digits. The list of allowed characters is specified in config file IDA.CFG. All names are case-sensitive.

Maximal length of a name is specified in the configuration file too:

        MAX_NAME_LENGTH=120     // Maximal length of new names

Default is 120.

Some assemblers have lower name length limit, beware!

If you enter an illegal name, IDA will warn you.


How to Enter a Segment Value

You must enter a segment base value as a hexadecimal number or a segment name. If you enter an invalid segment, IDA will warn you.

You may enter a segment register name too.


How to Enter an Address

You must enter an address as a hexadecimal number or a location name. When you enter the address in the hexadecimal format, you can omit the segment part of the address and the current segment will be used. Addresses beyond the program limits are invalid.

Also, you can enter a location name with a displacement:

        name+5

And finally you can specify a relative address:

        +10             0x10 bytes further
        -5              5 bytes backwards

Special addresses:

        $ - current location (depends on the current assembler)

Examples:

        456             current segment, offset 0x456
        5E              current segment, offset 0x5E
        3000:34         segment 0x3000,  offset 0x34
        ds:67           segment pointed by ds, offset 0x67
        start           a location with name 'start'


How to Enter a Number

You can enter any 'C' expression with constants. Long arithmetic will be used for calculations.

In these expressions you can use all names which you created in your program.


Remote debugging

1. Launch a remote IDA debugger server on the remote host. The remote server is started from the command line and accepts command line parameters. Eventually specify a password if you want to protect your debugger server from strangers. For example, to launch the server under MS Windows, you could enter:

        win32_remote -pmy_secret_password

2. Specify the remote debugger parameteres in the Debugger, Process options. The file paths must be valid on the remote host. Don't forget to specify the same password as you have specified when launching the server. For example, to debug notepad.exe on the remote computer remote.company.com:

        Application: c:\windows\notepad.exe
        Input file:  c:\windows\notepad.exe
        Directory:   c:\windows
        Hostname:    remote.company.com
        Port:        23946
        Password:    my_secret_password

3. The rest of debugging is the same as with local debugging.

 NOTE

The debugger server can handle one debugger session at once. If you need to debug several applications simultaneously, launch several servers at different network ports.

The following debugger servers are shipped with IDA Pro

    File name        IDA version  Operating system   Debugged programs
 ------------------  -----------  -----------------  -----------------
 win32_remote.exe    32-bit       MS Windows 32-bit  32-bit PE files
 win32_remote64.exe  64-bit       MS Windows 32-bit  32-bit PE files
 win64_remotex64.exe 64-bit       MS Windows 64-bit  64 or 32-bit PE files
 linux_server        32-bit       Linux              ELF files
 linux_server64      64-bit       Linux              ELF files


IDC language

IDC language is a C-like language. It has the same lexical tokens as C does: character set,constants,identifiers,keywords, etc. A program in IDC consists of function declarations. By default, execution starts from a function named 'main'. Select a topic to read:

  Variables
  Functions
  Statements
  Expressions
  Index of IDC functions


IDC: Expressions

In the IDC expressions you can use almost all C operations except:

  complex assigment operations as '+='
  , (comma operation)

You can use the following construct in the expressions:

  [ s, o ]

(This means to calculate linear (effective) address for segment 's' offset 'o'.) The calculation is made using the following formula:

  (s << 4) + o

If a string constant is specified as 's', it denotes a segment by its name.

There are 3 type conversion operations:

  long( expr )          float number is truncated during conversion
  char( expr )
  float( expr )

However, all type conversions are made automatically:

  - addition:
        if both operands are strings,
          string addition is performed (strings are concatenated);
        if floating point operand exists,
          both operands are converted to floats;
        otherwise
          both operands are converted to longs;
  - subtraction/multiplication/division:
        if floating point operand exists,
          both operands are converted to floats;
        otherwise
          both operands are converted to longs;
  - comparisions (==,!=, etc):
        if both operands are strings, string comparison is performed;
        if floating point operand exists,
          both operands are converted to floats;
        otherwise
          both operands are converted to longs;
  - all other operations:
        operand(s) are converted to longs;


IDC: Statements

In IDC there are the following statements:

  expression;        (expression-statement)
  if (expression) statement
  if (expression) statement else statement
  for ( expr1; expr2; expr3 ) statement
  while (expression) statement
  do statement while (expression);
  break;
  continue;
  return <expr>;
  return;              the same as 'return 0;'
  { statements... }
  ;                    (empty statement)


IDC: variables

All variables in IDC are automatic local variables (sic!). A variable can contain: - a 32-bit signed long integer - a character string (max 255 characters long) - a floating point number (extra precision, up to 25 decimal digits)

A variable is declared in this way:

  auto var;

This declaration introduces a variable named 'var'. It can contain a string or a number. All C and C++ keywords are reserved and cannot be used as a variable name. The variable is defined up to the end of the function.

NOTE: Processor register names can be used in the IDC scripts when the debugger is active.

NOTE: to emulate global scope variables you may use array functions and create global persistent arrays.


IDC: Functions

A function in IDC returns a value. There are 2 kinds of functions:

  - built-in functions
  - user-defined functions

A user-defined function is declared in this way:

  static func(arg1,arg2,arg3)
  {
    statements ...

  }

where arg1,arg2,arg3 are the function parameters,'func' is the function name. It is not nesessary to specify the types of the parameters because any variable can contain a string or a number. All necessary type conversions are handled automatically.


Various dialog help messages

Packed Files
Bad Relocation Table
Additional information at the end of file
Overlayed files
Error loading overlays
Maximal number of segments is reached
Can't generate executable file
Bad input file format
Bad Syntax for Comments Retrieval
Choose mark number
Enter mark description
Choose marked location
Can't Rename a Byte
Can't find file segmentation
Negative Offsets
Can't move segment start address
Can't move segment start address
Can't Create Database
DataBase is not closed
Obsolete Database Format
The Name List is Empty
Upgrading IDA database
Unexpected Database Format
Imported module is not found
Renaming old database files
Load file dialog
PE .idata section has additional data
Repeat search for instruction/data with the specified operand
Repeat search for substring in the disassembly
Repeat search for substring in the file
Moving Segment
Deleting a Segment
Auto analysis is not completed
Silent mode of IDA
Rename a structure/member
Delete a structure member
Unpacked database is dangerous
Database Is Empty
Illegal Usage of the Switch
Can't Find Input File
Patched Bytes Are Skipped
Patched bytes have relocation information
No Segment for the current byte
Window is in Dumping Mode
Empty Program
Load additional binary file
Patching Relocation Bytes
NotVaFile
VaBadAddress
MaxChunk
Desktops
CanCreateSegReg
CantSplit


Convert to instruction

 Action    name: MakeCode

This command converts the current unexplored bytes to instruction(s). If it is not possible, IDA will warn you.

If you've selected an area using the anchor, all bytes in the area will be converted to instructions.

If you apply this command to an instruction, it will be reanalyzed.

See also Edit submenu


Convert to data

 Action    name: MakeData

This command converts the current unexplored bytes to data. If it is not possible, IDA will warn you. Multiple using of this command will change data type:

  db -> dw -> dd -> float -> dq -> double -> dt -> packreal -> octa\    ;
  ^                                                                |    ;
  \---------<----------------<--------------<----------------------/    ;

You may remove some items from this list using setup data command.

If the target assembler does not support double words or another data type, it will be skipped.

 To create a structure variable, use Declare struct var command.
 To create an array, use Array command.
 To convert back, use Undefine command.

See also Edit submenu


Main Menu Bar

All IDA commands are available from the followings menus:

 File
 Edit
 Jump
 Search
 Debugger
 View
 Options
 Windows


File submenu

In this submenu you can:

  Load file           Load file
  IDA command         Execute an IDC command
  Produce output file Generate output file
  OS shell            Execute OS commands
  Save database       Save database in packed form
  Save database as... Save database in packed form
                      in another file
  Abort               Abort - do not save changes
  Quit                Quit to DOS - save changes

See also Menu Bar submenus.


File|Load file submenu

This submenu allows you to load additional files into the database.

  Reload input file
  IDC file
  Binary file
  IDS file
  Debug information file
  PDB debug information file
  FLIRT signature file
  C header file

See also other File... submenu commands.


Reload the input file

 Action    name: ReloadFile

This command reloads the same input file to the database. IDA tries to retain as much information as possible in the database. All the names, comments, segmentation information and similar will be retained.

The only thing that is changed is the values of individual bytes.

This command works for some input file types only. If the file was loaded into the database with special settings, this command may fail. In this case use Dump database to IDC file command and reload the file manually.

See also Load... submenu commands.


IDC File

 Action    name: Execute

    You can select and run an IDC script file.

See also

         Immediate execution of IDC commands
         Load... submenu commands.


Load additional file

 Action    name: LoadFile

This command loads a binary file. The new file is appended to the current database and all existing information is retained.

The file's content will appear as unexplored bytes in the program.

This command only allows you to load binary files.

See also Load... submenu commands.


Load IDS file

 Action    name: LoadIdsFile

This command loads an IDS file.

An IDS file contains information about well-known functions (such as functions from MS Windows API), namely:

        - their names
        - their ordinal number in the DLL
        - an eventual informative comment
        - the number of parameters passed on the stack
        - the number of parameters purged when returning

IDS files are automatically loaded if they are found in the IDS directory. This command allows you to load an IDS file from any directory and even after the main file has been loaded into the database.

See also Load... submenu commands.


Load debug information file

 Action    name: LoadDbgFile

This command loads a DBG file.

If the program being disassembled has a companion DBG file, then this command may be used to load the DBG file's information into the database. IDA loads the DBG file automatically if it can find the DBG file in the directory with the input file.

The built-in debug information loader can't load NB10 format files and PDB files. For them please use a special plugin PDB.PLW which can be run manually using Edit->Plugins submenu. This plugin uses MS Windows DLLs to load the debug information and therefore has the following limitations:

        - it works only under MS Windows
        - it will load only PDBs compatible with the currently
          installed IMAGEHLP.DLL

See also Load... submenu commands.


Load PDB debug information file

 Action    name: LoadPdbFile

This command loads a PDB file.

If the program being disassembled has a companion PDB file, then this command may be used to load information from the PDB file into the database.

Please note that the PDB loader uses the system DLL IMAGEHLP.DLL to load the PDB file. The system DLL may refuse to load the PDB file if it is from another version of the operating system or for some other reason.

The system searches for the PDB file in the system directories (usually something like \WINNW\Symbols) and in the current directory.

The LoadPdbFile command launches a special plugin PDB.PLW which can be run manually using Edit->Plugins submenu. This plugin uses MS Windows DLLs to load the debug information and therefore has the following limitations:

        - it works only under MS Windows
        - it will load only PDBs compatible with the currently
          installed IMAGEHLP.DLL

See also Load... submenu commands.


Load FLIRT signature file

 Action    name: LoadSigFile

This command allows you to apply an additional signature file to the program.

A signature file contains patterns of standard runtime functions. With their help, IDA is able to recognize the standard functions and names them accordingly.

IDA attempts to detect the necessary signature files automatically. Unfortunately, this is not always possible. This command puts the specified signature file into the queue of the planned signature files.

Signature files reside in the subdirectories of the SIG directory. Each processor has its own subdirectory. The name of the subdirectory is equal to the name of the processor module file (z80 for z80.w32, for example). Note: IBM PC signatures are located in the SIG directory itself. Note: the IDASGN environment variable can be used to specify the location of the signatures directory.

There is another way to load a signature file: you may insert/delete signature files in the following way:

        - open the signatures window
        - press Ins to insert a signature file to the queue
        - press Del to delete a signature file from the queue

This way of applying signatures is the preferred way because useful information, such as the number of identified functions, is displayed in the signature window.

See also Load... submenu commands.


Load C header

 Action    name: LoadHeaderFile

This command allows you to apply type declarations from a C header file to the program.

IDA reads and parses the specified header file as a C compiler does. In other words, it mimics the front-end of a C compiler with some restrictions:

        - only type declarations are allowed. The function definitions
          in the input file are skipped
        - C++ header files are not supported
        - the compiler specific predefined macros are not defined,
          you have to define them manually in the header file

Don't forget to specify the compiler and memory model in the compiler setup dialog box before loading a header file.

All type declarations found in the input file are stored in the current database in the form of a type library. These type declarations can be used to define new structure and enumeration definitions by pressing "Add standard structure" or "Add standard enum" buttons in the Add enum type... and Add struct type... dialog boxes.

In the case of an error in the input file the error messages appear in the messages window. In any case the function declarations that are already parsed are not deleted from the database. IDA stops parsing the input file when 20 errors occur.

See also Load... submenu commands.


IDC Command

 Action    name: ExecuteLine

You can enter and execute a small script written in the built-in language named IDC.

Here is the list of built-in functions.

See also

         IDC language overview
         Execute IDC file command
         File... submenu commands
         How to use notepad.


File|Produce output files submenu

This submenu allows you to produce various output files. It also allows you to unload the database.

 Generate MAP file
 Generate ASM file
 Generate INC file
 Generate LST file
 Generate EXE file
 Generate DIF file
 Generate HTML file
 Dump database to IDC file
 Dump typeinfo to IDC file

See also other File... submenu commands.


Create MAP File

 Action    name: ProduceMap

Please enter a file name for the map. IDA will write the following information to this file:

  - current segmentation
  - list of names sorted by values

You may disable the generation of the segmentation information. Also you may enable or disable dummy names in the output file.

You can use this map file for your information and you can use it for debugging (for example, Periscope from Periscope Company or Borland's Turbo Debugger can read this file).

See also other Produce output file commands.


Create ASM File

 Action    name: ProduceAsm

Please enter a file name for the assembler text file. IDA will write the disassembled text to this file.

If you've selected an area on the screen using Drop Anchor command, IDA will write only the selected area (from the current address to the anchor).

If some I/O problem (e.g. disk full) occurs during writing to the file, IDA will stop and a partial file will be created.

Please note that demo version can't produce assembler files.

See also other Produce output file commands.


Create INC File

 Action    name: ProduceInc

Please enter a file name for the assembler include file. IDA will write the information about the defined types (structures and enums) to this file.

If some I/O problem (e.g. disk full) occurs during writing to the file, IDA will stop and a partial file will be created.

Please note that demo version can not produce assembler include files.

See also other Produce output file commands.


Create LST File

 Action    name: ProduceLst

Enter a file name for the assembler listing file. IDA will write the disassembled text to this file.

If you've selected an area on the screen using Drop Anchor command, IDA will write only the selected area (from the current address to the anchor).

If some I/O problem (e.g. disk full) occurs during writing to the file, IDA will stop and a partial file will be created.

Please note that demo version can't produce assembler listing files.

See also other Produce output file commands.


Create Executable File

 Action    name: ProduceExe

Enter a file name for the new executable file. Usually this command is used after patching (see commands Patch byte and Patch word) to obtain a patched version of the file.

IDA produces executable files only for:

  - MS DOS .exe
  - MS DOS .com
  - MS DOS .drv
  - MS DOS .sys
  - general binary
  - Intel Hex Object Format
  - MOS Technology Hex Object Format

For other file formats please create a difference file.

NOTE: only Patch byte/word commands affect the executable file contents, other commands (including User-Specified String for the #th Operand) will not affect the content of the disassembled file.

EXE files: Output files will have the same EXE-header and relocation table as the input file. IDA PRO will fill unused areas of the EXE file (e.g. between relocation table and loadable pages) with zeroes.

See also

         File|Produce output file submenu,
         Edit|Patch core submenu.


Create Difference File

 Action    name: ProduceDiff

This command will prompt you for a filename and then will create a plain text difference file of the following format:

 comment

 filename
 offset: oldval  newval

See also

         File|Produce output file submenu,
         Edit|Patch core submenu.


Create HTML File

 Action    name: ProduceHtml

Please enter a file name for the HTML file. IDA will write the disassembled text to this file.

If you've selected an area on the screen using Drop Anchor command, IDA will write only the selected area (from the current address to the anchor).

If some I/O problem (e.g. disk full) occurs during writing to the file, IDA will stop and a partial file will be created.

Please note that demo version can't produce HTML files. This command is available only in the graphical version of IDA Pro.

See also other Produce output file commands.


Dump database to IDC file

 Action    name: DumpDatabase

This command saves current IDA database into a text file.

You can use it as a safety command:

  - to protect your work from disasters
  - to migrate information
    into new database formats of IDA.

This command is used when you want to switch to a new version of IDA. Usually each new version of IDA has its own database format. To create a new format database, you need:

  1. to issue the 'Dump...' command for the old
     database (using old version of IDA). You will
     get an IDC file containing all information
     from your old database.
  2. to reload your database using new IDA with switch -x.
  3. to compile and execute the IDC file with command
    'Execute IDC file' (usually F2)

Please note that this command doesn't save everything to text file. Information about the local variables will be lost!

See also other Produce output file commands.


Dump typeinfo to IDC file

 Action    name: DumpTypes

This command saves information about the user-defined types from the IDA database into a text file.

Information about enums, structure types and other user-defined types is saved in a text form as an IDC program.

You can use this command to migrate the type definitions from one database to another.

See also other Produce output file commands.


Save database

 Action    name: SaveBase

This command saves and packs the current database.

See also other File... submenu commands. Save database as... command.


Save database as...

 Action    name: SaveBaseAs

This command saves and packs the current database. IDA will prompt you to enter a new name for the database file. Databases are saved with an .IDB extension. Use this command if you don't want to overwrite an earlier database.

See also

         other File... submenu commands.
         Save database command.


Abort IDA

 Action    name: Abort

This command terminates the current IDA session. The Abort command is not available if the database was not packed.

IDA will NOT save changes to the disk.

See also

         other File... submenu commands.
         Quit command.


Exit IDA

 Action    name: Quit

This command terminates the current IDA session. IDA will write all changes to the disk and will close all databases.

You can enable/disable database packing. When the database is packed, it consists of one file with IDB extension. When the database is not packed, it consists of several files on the disk. If packing is disabled, in the next session you can't abort IDA. We do not recommend to leave the database in the unpacked form because you will not have a backup copy.

Also you can perform garbage collection on the database before packing it. The garbage collection removes the unused database pages, making it smaller. However, IDA needs some free database pages when it works, so it will allocate them again when you reuse the database. Removing and adding free pages takes time and what is most important it changes the database control blocks.

Use garbage collection only when you do not intend to work with the database in the near future.

IDA will remember all information about the screen, cursor position, jumps stack, etc. The following information will be lost:

        keystroke macros,
        the anchor position

To resume a disassembly session simply type: "ida file"

See also

         other File... submenu commands.
         Abort command.


Edit submenu

This submenu allows you to modify text representation and to patch the file. Also, here you'll find commands to control program analysis. There are the following commands:

 Convert to instruction
 Convert to data
 Convert to ASCII string
 Convert to array
 Undefine
 Rename

 Operand types submenu
 Comments submenu

 Functions submenu
 Structures submenu
 Enums submenu
 Segments submenu
 Patch program submenu
 Other submenu
 Plugins submenu

See also Menu Bar submenus.


Convert to ASCII string

 Action    name: MakeAscii

This command converts the current unexplored bytes to a string.

Set of allowed characters is specified in the configuration file, parameter AsciiStringChars. Character '\0' is not allowed in any case. If the current assembler does not allow ASCII characters with high bit set, characters with high bit set are not allowed.

If the anchor was dropped then IDA takes for the string all characters between the current cursor position and the anchor.

Use the anchor if the string starts a disallowed character.

This command also generates a name for the string. In the configuration file you can specify character translation (XlatAsciiName) and characters allowed in names (NameChars).

You can change ASCII string length using Array command.

The GUI version allows you to assign a special hotkey to create Unicode strings. For that, change the value of the MakeUnicode parameter in the IDAGUI.CFG file.

Pascal Strings

To create Pascal style strings (with first byte indicating string length) use Set Ascii Style command.

See also Edit submenu


Convert to array

 Action    name: MakeArray

This command allows you to create arrays and change their sizes.

The arrays are created in 2 simple steps:

  1. Create the first element of array using the data
     definition commands (data, string, structs)
  2. Apply the array command to the created data item.

Enter array size in current array elements (not bytes). The suggested array size is the maximal size so that no user-defined names would be destroyed.

You can use this command for ASCII strings to change the length of the string.

The dialog box contains the following fields:

Items on a line (meaningless for ASCII strings):

        0               place maximal number of items on a line
        other value     number of items on a line

Please note that the margin parameter affects the number of items on a line too.

Alignment (meaningless for ASCII strings):

        -1              do not align items
        0               align automatically
        other value     width of each item

 Signed elements:       if checked, IDA treats all elements as signed numbers.
                        meaningful only for numbers (not for offsets and
                        segments and strings)

 Create as array:       if not checked, IDA will create a separate item for
                        each array element. Useful to create huge arrays.
                        If this checkbox is clear when this command is
                        applied to ascii string, IDA will create many
                        ascii strings instead of one big string.

If this command is applied to a variable sized structure, then it is used to specify the overall size of the structure. You can't create arrays of variable sized structures.

See also

 Edit submenu
 How to Enter a Number.


Undefine a byte

 Action    name: MakeUnknown

This command deletes the current instruction or data converting it to 'unexplored' bytes. IDA will delete the subsequent instructions if there are no more references to them (functions are never deleted).

If you've selected an area using the anchor, all bytes in the area will be converted to 'unexplored' bytes. In this case IDA will not delete any other instructions even if they have no references to them after the deletion.

See also Edit submenu


Give Name to the Location

 Action    name: MakeName

This command gives name/renames/deletes name for the current item.

To delete a name, simply give an empty name.

If the current item is referenced, you can't delete its name. Even if you try, IDA will generate a dummy name.

Local name prefix

  If the name has this prefix, it will be automatically converted to a
  local name as if you have selected "local name" checkbox.

Local name

  The name is considered to be defined only in the current function.
  Please note that IDA doesn't check the uniqueness of the local names
  in the whole program. But it does check that the name is unique for the
  function.

Include in names list

  Here you can also include/remove the name from the name list.
  If the name is hidden you will not see it in names window.

Public name

  You can declare a name as a public (global) name. If the current
  assembler supports the "public" directive, IDA will use it.
  Otherwise the publicness of the name will be displayed as a comment.

Autogenerated name

  An autogenerated name will appear in a different color.
  Also, it will disappear automatically if the item is indefined.

Weak name

  You can declare a name as a weak name. If the current
  assembler supports the "weak" directive, IDA will use it.
  Otherwise the weakness of the name will be displayed as a comment.

Create name anyway

  If this flag is on and the specified name already exists,
  IDA will try to variate the specified name by appending a suffix to it.

See also

         Edit submenu.
         How to Enter an Identifier.
         Names representation.


Edit|Operand types submenu

This submenu allows you to change the operand types to offsets, numbers, chars, etc. Use it to make disassembled text more understandable.

 Convert operand to offset
 Convert operand to number
 Convert operand to character
 Convert operand to segment
 Convert operand to enum
 Convert operand to stack variable
 Change operand sign
 Bitwise negate operand
 User-defined operand

If IDA suspects that an operand can be represented as something different from a plain number, it will mark the operand as "suspicious" and show it in red. Use these commands to delete suspicious marks.

Some of these commands can be applied to a selected area. Click here to learn about the rules applied to such operations.

See also Edit submenu.


Edit|Operand types|Offset submenu

 Convert operand to offset (data segment)
 Convert operand to offset (code segment)
 Convert operand to offset (any segment)
 Convert operand to offset (user-defined base)
 Convert operand to struct offset

See also Edit|Operand types submenu.


Convert operand to offset (data segment)

 Action    name: OpOffset

This command converts the immediate operand of the current instruction/data to an offset from the current data segment (DS).

If current DS value is unknown (or equal 0xFFFF) IDA will warn you -- it will beep. In this case you have to define DS register value for the current byte. The best way to do it is:

  - jump to segment register change point
  - change value of DS
  - return

or you can change default value of DS for the current segment.

If you want to delete offset definition, you can use this command again - it works as trigger.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise all other operands are affected.

If an area is selected using the anchor, IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected area to offsets. However, first IDA will ask you the lower and upper limits of immediate operand value. If the operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise it will be left unmodified.

To create offsets to structure members use Convert to struct offset command.

See also:

          offset by data segment/no offset
          offset by any segment
          offset by any user-specified base
          Edit|Operand types|Offset submenu.
          Enter #th operand manually commands.


Convert operand to offset (code segment)

 Action    name: OpOffsetCs

This command converts the immediate operand of the current instruction/data to an offset from the current segment (CS).

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise all other operands are affected.

If an area is selected using the anchor, IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected area to offsets. However, first IDA will ask you the lower and upper limits of immediate operand value. If the an operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise it will be left unmodified.

If this command is applied to a structure member in the structure window, then IDA will create "an automatic offset". An automatic offset is an offset with the base equal to 0xFFFFFFFF. This base value means that the actual value of the base will be calculated by IDA when a structure instance is created.

To create offsets to structure members use Convert to struct offset command.

See also:

          offset by data segment/no offset
          offset by any segment
          offset by any user-specified base
          Edit|Operand types|Offset submenu.
          Enter #th operand manually commands.


Convert operand to offset (any segment)

 Action    name: OpAnyOffset

This command converts the immediate operand of the current instruction/data to an offset from any segment.

IDA will ask to choose a base segment for the offset.

If an area is selected using the anchor, IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected area to offsets. However, first IDA will ask you the lower and upper limits of immediate operand value. If the an operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise it will be left unmodified.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise all other operands are affected.

To create offsets to structure members use Convert to struct offset command.

See also:

          offset by data segment/no
          offset by current segment
          Edit|Operand types|Offset submenu.
          Enter #th operand manually commands.


Convert operand to offset (user-defined base)

 Action    name: OpUserOffset

This command converts the immediate operand of the current instruction/data to a complex offset expression.

Please click here to learn more about complex offsets.

If an area is selected using the anchor, IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected area to offsets. However, first IDA will ask you the lower and upper limits of immediate operand value. If the an operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise it will be left unmodified.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise all other operands are affected.

If the offset base is specified as 0xFFFFFFFF, then IDA will create "an automatic offset". Automatic offsets mean that the actual value of the base will be calculated by IDA.

To create offsets to structure members use Convert to struct offset command.

See also:

          offset by data segment/no
          offset by current segment
          Edit|Operand types|Offset submenu.
          Enter #th operand manually commands.


Convert operand to structure offset

 Action    name: OpStructOffset

 GUI version:
 ------------

This command permits to convert all immediate operands of instructions in a range selection to a path of offsets through a structure and its possible sub unions. If no selection is active, IDA will simply permit to convert the current operand.

You can select the interesting register in the drop-down list: all operands relative to this register will be added to the 'Offsets' list. A special empty line in the drop-down list is used to directly work on immediate values. Checkboxes in the 'Offsets' list allow you to select which operand you indeed want to modify. By default, IDA will select only undefined operands, to avoid overwriting previous type definitions. This list is sorted by operand value, by instruction address and finally by operand number. You can easily see instructions related to the operand by moving the mouse over it, and wait for a hint to be displayed.

The 'Structures and Unions' tree will contain all selectable structures, and sub unions. Once you select or move over a structure, the 'Offsets' list updates itself for each checked offset: the computed name of the operand is printed, according to the selected structure in the tree. An icon is also drawn, to easily know if a specific structure matchs the offset or not, or if the offset is too bif for the selected structure. The structures who match the most offsets will be near the top of the tree. You can also move your mouse over structures in the tree to obtain an interesting hint.

A '?' icon can also appear, if the offset can be specialized by selecting an union member. In this case, if you expand the structure in the tree, you can select the adequate union member simply by checking the desired radio button. IDA automatically corrects the related name in the 'Offsets' list.

The 'Offset delta' value represents the difference between the structure start and the pointer value. For example, if you have an operand 4 and want to convert in into an expression like "mystruct.field_6-2", then you have to enter 2 as the delta. Usually the delta is zero, i.e. the pointer points to the start of the structure.

The 'Hide sub structures without sub unions' option (checked by default) avoids to add unnecessary sub structures to the tree, to keep it as small as possible. If you uncheck this option, all sub structures will be added to the tree.

By default, IDA displays the structure member at offset 0. To change this behaviour, you can directly disable the 'Force zero offset field' in the 'Options' frame.

 Text version:
 -------------

This command converts immediate operand(s) type of the current instruction/data to an offset within the specified struct. Before using this command you have to define a structure type.

First of all IDA will ask a so called "struct offset delta". This value represents the difference between the structure start and the pointer value. For example, if you have an operand 4 and want to convert in into an expression like "mystruct.field_6-2", then you have to enter 2 as the delta. Usually the delta is zero, i.e. the pointer points to the start of the structure.

If an area is selected using the anchor, IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected area to offsets. However, first IDA will ask you the lower and upper limits of immediate operand value. If the an operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise it will be left unmodified.

When you use this command, IDA deletes the manually entered operand.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise all other operands are affected.

By default IDA doesn't display the structure member at offset 0. To change this behaviour use Force zero field offset command.

Also, if there are several possible representations (this can happen if unions are used), select the desired representation using the Select union member... command.

See also:

          offset by data segment/no
          offset by current segment
          offset by any segment
          offset by any user-specified base
          Edit|Operand types|Offset submenu.
          Enter #th operand manually command.


Edit|Operand types|Number submenu

 Convert operand to number
 Convert operand to hex number
 Convert operand to decimal number
 Convert operand to octal number
 Convert operand to binary number
 Convert operand to floating point number
 Toggle leading zeroes

See also Edit|Operand types submenu.


Convert operand to number

 Action    name: OpNumber

This command converts immediate operand(s) type of the current instruction/data to a number. So you can delete suspicious mark of the item.

The number is represented in the default radix for the current processor (usually hex, but octal for PDP-11, for example).

When you use this command, IDA deletes the manually entered operand.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise all other operands are affected.

See also Edit|Operand types|Number submenu.


Convert operand to hexadecimal number

 Action    name: OpHex

This command converts immediate operand(s) type of the current instruction/data to hex number. So you can delete suspicious mark of the item.

When you use this command, IDA deletes the manually entered operand.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise all other operands are affected.

See also Edit|Operand types|Number submenu.


Convert operand to decimal number

 Action    name: OpDecimal

This command converts the immediate operand(s) type of the current instruction/data to decimal. Therefore, it becomes a 'number'.

When you use this command, IDA deletes the manually entered operand.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise all other operands are affected.

See also Edit|Operand types|Number submenu.


Convert operand to octal number

 Action    name: OpOctal

This command makes the current instruction or data operand type octal. IDA always uses 123o notation for octal numbers even if the current assembler does not support octal numbers.

When you use this command, IDA deletes the manually entered operand.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise all other operands are affected.

See also Edit|Operand types|Number submenu.


Convert operand to binary number

 Action    name: OpBinary

This command makes the current instruction or data operand type binary. IDA always uses 123b notation for binary numbers even if the current assembler does not support binary numbers.

When you use this command, IDA deletes the manually entered operand.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise all other operands are affected.

See also Edit|Operand types|Number submenu.


Convert operand to floating point number

 Action    name: OpFloat

This command makes the current operand type floating point.

When you use this command, IDA deletes the manually entered operand.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise all other operands are affected.

See also Edit|Operand types|Number submenu.


Toggle leading zeroes

 Action    name: ToggleLeadingZeroes

This command displays or hides the leading zeroes of the current operand. Example: if the instruction looked like this:

        and     ecx, 40h

then after applying the command it will look like this:

        and     ecx, 00000040h

If you prefer to see leading zeroes in all cases, then open the calculator and enter the following expression:

        SetCharPrm(INF_GENFLAGS, INFFL_LZERO)

This will toggle the default for the current database and all numbers without leading zeroes will becode with leading zeroes and vice versa.

See also Edit|Operand types|Number submenu.


Convert operand to character

 Action    name: OpChar

This command converts immediate operand(s) type of the current instruction/data to character.

When you use this command, IDA deletes the manually entered operand.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise all other operands are affected.

See also Edit|Operand types submenu.


Convert operand to segment

 Action    name: OpSegment

This command converts the immediate operand(s) type of the current instruction/data to segment base. The segments bases usually are displayed like this:

        mov     ax, seg dseg

When you use this command, IDA deletes the manually entered operand.

If IDA can't find a segment with the immediate operand's value, it simply displays it as hex number.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise all other operands are affected.

See also Edit|Operand types submenu.


Convert operand to symbolic constant (enum)

 Action    name: OpEnum

This command converts immediate operand(s) type of the current instruction/data to an enum member. Before using this command you have to define an enumeration type.

If an area is selected using the anchor, IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected area to symbolic constants. However, first IDA will ask you the lower and upper limits of immediate operand value. If the operand value is >= lower limit and <= upper limit then the operand will be converted to offset, otherwise it will be left unmodified.

When you use this command, IDA deletes the manually entered operand.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise all other operands are affected.

See also:

          Edit|Operand types submenu.
          Enter #th operand manually commands.


Convert operand to stack variable

 Action    name: OpStackVariable

This command converts immediate operand(s) type of the current instruction to an offset to stack variables, i.e. a local variable or function argument in the stack.

You need to define stack variables before using this command.

If the current operand is based on the value of the stack pointer ([ESP+xxx]) and the SP value is traced incorrectly, then you need to correct SP value using change stack pointer command.

If an area is selected using the anchor, IDA will perform 'en masse' conversion. It will convert immediate operands of all instructions in the selected area to stack variables. However, first IDA will ask you the lower and upper limits of immediate operand value. If the operand value is >= lower limit and <= upper limit then the operand will be converted to stack variable, otherwise it will be left unmodified.

When you use this command, IDA deletes the manually entered operand.

If the cursor is on the first operand (the cursor is before ',') then the first operand will be affected; otherwise all other operands are affected.

See also:

          Edit|Operand types submenu.
          Enter #th operand manually commands.
          Define stack variables...


Change operand sign

 Action    name: ChangeSign

This command changes the sign of the current operand. Please note that not all operands can change their sign.

See also:

          Edit|Operand types submenu.
          Enter #th operand manually commands.


Bitwise negate operand

 Action    name: BitwiseNegate

This command bitwisely negates the current operand. Please note that not all types of operands can be negated. It is not possible to negate and change sign of an operand simultaneously.

This command works only if the current assembler supports the bitwise negation operation.

See also:

          Edit|Operand types submenu.
          Enter #th operand manually commands.


User-defined operand

 Action    name: ManualOperand

You may specify any string instead of an operand when IDA does not represent the operand in the desired form. In this case IDA will simply display the specified string in the instruction instead of the operand.

The current operand (near the cursor) will be affected.

You can use this command not only with the instructions but with data directives too.

IDA proposes the previous manual operand as the default value in the input form.

If you want to delete the manual operand, specify an empty string.

If the "Check operand" checkbox is on, IDA will try to check operand and if the value of the manual operand differs from its original value, will warn you. This feature works only for certain processors, namely: IBM PC, Intel 8051, DEC PDP-11.

IDA automatically deletes the manually entered operands when you change operand representation using operand types submenu.

NOTE: No offset references are generated if a user-defined operand is used.

See also Edit|Operand types submenu.


Edit|Comments submenu

This submenu allows you to manipulate with different kinds of comments. Use them to make the disassembled text more understandable.

 Create a regular comment
 Create a repeatable comments
 Create additional comment lines

 Insert a predefined comment

See also Edit submenu.


Create a regular comment

 Action    name: MakeComment

If you stand at the function start and your cursor is on a function name, IDA will ask you to enter a function comment.

If you stand at the segment start and your cursor is on a segment name, IDA will ask you to enter a segment comment.

If this command is issued in the structures window, it allows you to change comment of a structure or structure member. If the cursor is on the structure name, it will be changed, otherwise the member name.

Otherwise this command allows you to enter a normal indented comment for the current item.

You can show/hide all comments in Comments Dialog.

See also

        "How to use the notepad"
         Edit|Comments submenu
         Repeatable comments
         How to use the notepad


Create a repeatable comment

 Action    name: MakeRptCmt

This command allows you to enter a repeatable comment. A repeatable comment will appear attached to the current item and all other items referencing it.

If you stand at the function start, IDA will ask you to enter a function comment.

If this command is issued in the structures window, it allows you to change the comment of a structure or structure member. If the cursor is on the structure name, it will be changed, otherwise the member name.

Otherwise this command allows you to enter a repeatable comment for the current item.

You can't enter repeatable segment comments.

All items that refer to the current item will have this comment by default.

Note that if you have defined both comment types (regular and repeatable), the regular comment will be displayed for the current item and the repeatable comment will be displayed for all items that refer to the current item if they do not have their own comments.

The repeatable comments may be used to describe subroutines, data items etc., because all calls to the subroutine will have the repeatable comment.

You can show/hide all comments in the Comments Dialog.

You can show and hide repeatable comments in the Comments Dialog.

See also

        "How to use the notepad"
         Edit|Comments submenu
         Regular comments


Create additional comment lines

 Action                 Name
 ------                 ----
 edit anterior lines    MakeExtraLineA
 edit posterior lines   MakeExtraLineB

If you want to enter multi-line comments or additional instructions, you can use this feature of IDA.

There are two kinds of extra lines: the ones generated before instruction line and the ones generated after instruction line.

Do not forget that maximal number of lines for an item is 500.

IDA does not insert a comment symbol at the beginning of the lines.

See also

        "How to use the notepad"
        Edit|Text|Comments submenu.
        How to use the Notepad


Insert a predefined comment

 Action    name: MakePredefinedComment

You can retrieve a predefined comment for the current instruction. Usually a predefined comment describes what the instruction does. For example, "xor" will have a comment like "excluse bitwise or".

IDA keeps a database of predefined comments for the system calls too. For example, "int 21h with ax=4C" will have something like "quit to dos".

If you want to insert a predefined comment for the current instruction, you need to specify the instruction mnemonics and so-called "comment index".

Comment Index for Instruction

The correct syntax is:

  Reg=Value ....

where 'reg' can be

        - register name (e.g. AX,BX,CX)
        - "Op1" - for first operand
        - "Op2" - for second operand

and 'value' is a valid C number.

For example:

  int
  Op1=0x21 AX=0x4C01

means

        int     21h     where AX=4C01h

if the program being disassembled is a MS DOS executable, the predefined comment will be:

        DOS - 2+ - QUIT WITH EXIT CODE (EXIT)
        AL = exit code

See also Edit|Comments submenu.


Functions submenu

This submenu allows you to manipulate functions in the disassembly:

      Create function...
      Edit function...
      Append function tail...
      Remove function tail...
      Delete function...
      Set function end
      Define stack variables...
      Change stack pointer...
      Rename register...
      Set function/item type...

See also Edit submenu.


Create Function

 Action    name: MakeFunction

This command defines a new function in the disassembly text.

You can specify function boundaries using the anchor. If you do not, IDA will try to find the boundaries automatically:

   - function start point is equal to the current cursor position;
   - function end point is calculated by IDA.

A function can't contain references to undefined instructions. If a function has already been defined at the specified addresses, IDA will jump to its start address, showing you a warning message.

A function must start with an instruction.

See also

         Edit|Functions submenu.
         Edit a function
         Delete a function


Edit Function

 Action    name: EditFunction

Here you can change function bounds, its name and flags. In order to change function end address you could use FunctionEnd command.

If the current address does not belong to any function, IDA beeps.

This command allows you to change function frame parameters too. You can change the size of some parts of frame structure.

IDA considers the stack as the following structure:

      +------------------------------+
      | function arguments           |
      +------------------------------+
      | return address               |
      +------------------------------+
      | saved registers (SI,DI,etc)  |
      +------------------------------+  <- BP
      | local variables              |
      +------------------------------+  <- SP

For some processors or functions BP may be equal to SP, that is it can point to the bottom of the stack frame.

You may specify the number of bytes in each part of the stack frame. The size of the return address is calculated by IDA itself.

"BP based frame" allows IDA to automatically convert [BP+xxx] operands to stack variables.

"BP equal to SP" means that the frame pointer points to the bottom of the stack. It is usually used for the processors who set up the stack frame with EBP and ESP both pointing to the bottom of the frame (currently MC6816, M32R).

If you press <Enter> even without changing any parameter then IDA will reanalyze the function.

Sometimes EBP points to the middle of the stack frame. FPD (frame pointer delta) is used to handle such situations. FPD is the value substracted from the EBP before accessing variables. An example:

           push    ebp
           lea     ebp, [esp-78h]
           sub     esp, 588h
           push    ebx
           push    esi
           lea     eax, [ebp+74h]

      +------------------------------+
      | function arguments           |
      +------------------------------+
      | return address               |
      +------------------------------+
      | saved registers (SI,DI,etc)  |
      +------------------------------+  <- typical BP
      |                              |
      |                              |
      |                              |  <- real BP
      | local variables              |
      |                              |
      |                              |
      |                              |
      +------------------------------+  <- SP

In our example, the saved registers area is empty (since EBP has been immediately initialized before saving EBX and ESI). The difference between the 'typical BP' and 'real BP' is 0x78 and this is the value of FPD.

After specifying FPD=0x78 the last instruction of the example becomes

           lea     eax, [ebp+78h+var_4]

where var_4 = -4

Most of the time IDA calculates the FPD value automatically. If it fails, the user can specify the value manually.

See also

         Edit|Functions submenu.
         Make a function
         Delete a function


Append Function Tail

 Action    name: AppendFunctionTail

This command appends an arbitrary area of the program to a function definition. An area must be selected before applying this command. This area must not intersect with other function chunks.

IDA will ask to select the parent function for the selection and will append the area to the function definition.

See also

         Edit|Functions submenu.
         Remove function tail


Remove Function Tail

 Action    name: AppendFunctionTail

This command removes the function tail at the cursor from a function definition.

If there are several parent functions for the current function tail area, IDA will ask to select the parent function.

After the confirmation the current function tail area will be removed from the selected function definition.

If the parent was the only owner of the current tail, then the tail will be destroyed. Otherwise it will still be present in the database. If the removed parent was the owner of the tail, then another function will be selected as the owner.

See also

         Edit|Functions submenu.
         Append function tail


Delete Function

 Action    name: DelFunction

Deleting a function deletes only information about a function: information about stack variables, comments, function type, etc.

The instructions compising the function will remain intact.

See also

         Edit|Functions submenu.
         Make a function
         Edit a function


Set Function End

 Action    name: FunctionEnd

This command changes the current or previous function bounds so that its end will be set at the cursor. If it is not possible, IDA beeps.

See also Edit|Functions submenu. Make a function Edit a function


Change Stack Pointer

 Action    name: ChangeStackPointer

This command allows you to specify how the stack pointer (SP) is modified by the current instruction.

You can't use this command if the current instruction does not belong to any function.

You need to use this command only if IDA was not able to trace the value of the SP register. Usually IDA can handle it but in some special cases it fails. An example of such a situation is an indirect call of a function that purges its parameters from the stack. In this case IDA has no imformation about the function and cannot properly trace the value of SP.

Please note that you need to specify the difference between the old and new values of SP.

The value of SP is used if the current function accesses local variables by [ESP+xxx] notation.

See also

         Edit|Functions submenu.
         Convert to stack variable


Rename register

 Action    name: RenameRegister

This command allows you to rename a processor general register to some meaningful name. While this is not used very often on IBM PCs, it is especially useful on RISC processors with lots of registers.

For example, a general register R9 is not very meaningful and a name like 'CurrentTime' is much better.

This command can be used to define a new register name as well as to remove it. Just move the cursor on the register name and press enter. If you enter the new register name as an empty string, then the definition will be deleted.

If you have selected an area before using this command then the definition will be restricted to the selected area. But in any case the definition cannot cross the function boundaries. If no area was selected, the definition is for the range of addresses starting at the cursor and ending at the next definition.

You can't use this command if the current instruction does not belong to any function.

See also

         Edit|Functions submenu.


Set function/item type

 Action    name: SetType

This command allows you to specify the type of the current item.

If the cursor is located within a function, then the function type will be edited. Otherwise the type of the current item will be edited. In this case the current item must have a name.

The function type must be entered as a C declaration. IDA will use the type information to ameliorate the disassembly.

Here is an example of a function declaration:

        int main(int argc, const char *argv[]);

To delete a type declaration, please enter an empty string.

The name used in the declaration is ignored by IDA Pro.

See also

         Edit|Functions submenu.


Structures submenu

Commands of this submenu are available in the structures window. Only Declare struct var... is available in the disassembly window.

      Add a struct type...
      Copy struct type...
      Delete a struct type...
      Expand struct type...
      Shrink struct type...
      Move a struct type...
      Declare struct var...
      Force zero field offset
      Select union member...
      Create struct type from data...

Use regular commands to specify struct and union members, their types, comments, etc.

A union is a special kind of structure. Use structure definition commands to manipulate unions.

See also Edit submenu.


Define a new structure

 Action    name: AddStruct

This command defines a new structure or a new union. The new structure is created with zero length. You will have to add structure members using structure manipulation commands.

If the entered structure name denotes a standard structure type from a loaded type library, then its definition will be automatically used.

This command is available when you open a structures window.

You can add new members to the structure using the following commands:

        command         hotkey
        -------         ------
    make data            D
    make ascii           A
    make array           *
    rename               N

Also you may insert/delete undefined bytes into the middle of the structure by using expand and shrink commands.

"Create before current structure" means that the new structure will be placed immediately before the current structure type. Otherwise the new structure is placed after the current structure.

"Don't include in the list" means that the structure will not be included in the list of the structures which appears when the user applies the structure definition, for example, when he creates a variable of this structure type. We recommend to mark this checkbox when you have defined all variables of this structure type and want to reduce the number of choices in the list.

See also Edit|Structs submenu. How to Enter an Identifier


Copy a structure type

 Action    name: CopyStruct

This command make a copy of the current structure type. The new structure type will have the same members as the current one but its name will be autogenerated (something like struc_333)

By default the new structure type will be placed after the current structure type.

See also Edit|Structs submenu.


Delete a structure

 Action    name: DelStruct

This command deletes the current structure. Beware, when you delete a structure all references to it will be destroyed, even if you recreate it later, you'll have to respecify all references to it.

You may use this command to delete unions also.

This command is available when you open a structures window.

See also Edit|Structs submenu.


Expand a structure

 Action    name: ExpandStruct

This command expands the current structure by inserting undefined bytes at the cursor location. The cursor must not be at the end of the structure. To define a member at the end of the structure, just use normal data definition commands.

This command is available when you open a structures window.

See also Edit|Structs submenu.


Shrink a structure

 Action    name: ShrinkStruct

This command shrinks the current structure by deleting undefined bytes at the cursor location. The cursor must be at an undefined byte. IDA will ask the user the number of bytes to remove.

This command is available when you open a structures window.

See also Edit|Structs submenu.


Move a structure

 Action    name: MoveStruct

This command moves the current structure type definition to another place in the structure window.

Each structure has its ID and serial number. The ID is a number used to refer to the structure, while a serial number is used to order structures during output. Changing the serial number moves the structure to another place.

The serial number of a structure is displayed at the lower left corner of the window.

You can specify any number, IDA will move the structure to the specified place. 1 - the current structure becomes the first structure 2 - to the second place ...

This command is available when you open a structures window.

See also Edit|Structs submenu. How to Enter a Number.


Declare a structure variable

 Action    name: MakeStructVar

This command declares a variable of the specified structure type.

IDA will ask you to choose a structure type. You must have some structure types defined in order to use this command.

You can use this command to declare a structure field in another structure (i.e. nested structures are supported too).

See also Edit|Structs submenu.


Force zero field offset

 Action    name: ZeroStructOffset

This command forces IDA to display a full structure member name even if the offset of the member is equal to zero.

Used twice it cancels itself.

Example: Suppose we have the following structure:

        xxx     struc
        a       db ?
        b       db ?
        c       db ?
        xxx     ends

        dloc    xxx ?

  Normally IDA displays references to it like this:

        mov     eax, offset dloc
        mov     eax, offset dloc.b

  If you force IDA, then it displays member 'a':

        mov     eax, offset dloc.a
        mov     eax, offset dloc.b

See also Edit|Structs submenu.


Select union member

 Action    name: SelectUnionMember

This command tells IDA how to display references to a union from the current cursor location.

Example: Suppose we have the following union:

        xxx     union
        a       db ?
        b       dw ?
        c       dd ?
        ends   xxx

        dloc    xxx ?

  Normally IDA displays references to "dloc" like this:

        mov     al,  byte ptr dloc
        mov     eax, word ptr dloc

  After using this command IDA can display the union members:

        mov     al,  dloc.b
        mov     eax, dloc.d

See also Edit|Structs submenu.


Create a new structure from current data

 Action    name: CreateStructFromData

This command defines a new structure from data already defined. The new structure is created with adequate data types, and each member uses the current data name if it is available.

This command is available only in the graphical version of IDA Pro.

See also Edit|Structs submenu.


Enums submenu

Commands of this submenu are available in the enums window:

      Add an enum
      Delete an enum
      Edit an enum
      Define an enum member
      Edit an enum member
      Delete an enum member

All enum members names must be unique in the program. You can not define more than 256 enum members (symbolic constants) with the same value.

Please note that you can create bitfield definitions here.

Also you can add a comment for the enum and for each enum member. In order to specify an enum comment, you must stand at the enum name. Comments are set using regular commands:

      Regular comments
      Repeatable comments

See also Edit submenu.


Add/Edit an enum

 Action    name: AddEnum

 Action    name: EditEnum

This command allows you to define and to edit an enum type. You need to specify:

        - name of enum
        - its serial number (1,2...)
        - representation of enum members

Each enum has its ID and a serial number. The ID is a number used to refer to the enum, while a serial number is used to order enums during output. Changing the serial number moves the enum to another place.

The serial number of an enum is displayed at the lower left corner of the window.

You can specify any number as a serial number, IDA will move the enum to the specified place.

        1 - the current enum becomes the first enum
        2 - the current enum becomes the second enum
        ...

Also,you need to specify representation of enum constants. You may choose from various number bases (hex,dec,oct,bin) and character constants.

Please note that you can create bitfield definitions here by checking the "bitfield" checkbox.

These command is available when you open the enums window.

See also

         Edit|Enums submenu.
         How to Enter a Number.


Delete an enum type

 Action    name: DelEnum

This command deletes the current enum. Beware, when you delete an enum all references to it will be destroyed, Even if you recreate it later, you'll have to respecify all references to it.

This command is available when you open the enums window.

See also Edit|Enums submenu.


Define an enum member

 Action    name: AddConst

This command allows you to define an enum member. An enum member is a symbolic constant. You have to specify its name and value. You can not define more than 256 constants with the same value in an enum.

If the current enum is a bitfield, you need to specify the bitmask. To learn about bitmasks, read about bitfields.

See also Edit|Enums submenu.


Edit an enum member

 Action    name: EditConst

This command allows you to rename an enum member. An enum member is a symbolic constant. Its name must be unique in the program.

To rename an enum type name, position the cursor over the name of the enum.

See also Edit|Enums submenu.


Delete an enum member

 Action    name: DelConst

Please remember that deleting a member also deletes all the information about the member, including comments, member name etc.

See also Edit|Enums submenu.


Edit|Segments submenu

This submenu allows you to manipulate segments of the program:

 Create a new segment...
 Delete a segment...
 Change segment attributes...
 Move a segment...
 Rebase program...
 Change segment translation...

 Set default segment register value...
 Change segment register value...

See also:

 How to choose a segment
 How to jump to a segment
 Edit submenu.


Create a new segment

 Action    name: CreateSegment

This command allows you to create a new segment.

If you select an area using the anchor, IDA will propose the start address and the end address of the selection as defaults for the segment bounds.

You need to specify at least: - the segment start address - the segment end address (excluded from the range) - the segment base

Click here to learn about addressing model used in IDA.

If another segment already exists at the specified address, the existing segment is truncated and the new segment lasts from the specified start address to the next segment (or specified end address, whichever is lower). If the old and the new segments have the same base address, instructions/data will not be discarded by IDA. Otherwise IDA will discard all instructions/data of the new segment.

An additional segment may be created by IDA to cover the area after the end of the new segment.

See also Edit|Segments submenu.


Delete a segment

 Action    name: KillSegment

This command allows you to delete a segment.

IDA will ask your permission to disable the addresses occupied by the segment. If you allow this operation, information about the segment will be deleted. In other words, IDA will discard the information about instructions or data, comments etc.

If you check "disable addresses" checkbox, IDA will mark the addresses occupied by the segment as "nonexistent" in the program. You will lose *ALL* information, including byte values.

It is impossible to disassemble the content of adresses not located in any segment, therefore you must create a new segment if you want to resume the disassembly of that part of the code.

Also, you can edit (see below) an adjacent segment to [expand] it to those addresses.

IDA will ask your permission to disable addresses occupied by the segment. If you give your permission, ALL information about the segment will be deleted, otherwise IDA will discard information about instruction/data, comments etc, but retain byte values so that you will be able to create another segment afterwards.

To disassemble the addresses occupied by the segment you need to create a new segment again (i.e. you can't disassemble bytes without a segment). Also, you can expand another adjacent segment to these addresses.

See also Edit|Segments submenu.


Change segment attributes

 Action    name: EditSegment

This command allows you to change segment attributes. You can change all attributes except the segment base. To change the segment base you have to delete the segment and create it again.

Please use the following links to learn about the segment attributes:

      How to change segment name
      How to change segment class
      How to change segment addressing mode (16/32)
      How to change segment alignment
      How to change segment combination

Changing the segment class may change the segment type.

MOVE ADJACENT SEGMENTS: means that previous and next segments will be shrunk or expanded filling appearing gaps between segments when you change the current segment. Click here for more information.

DISABLE ADDRESSES: when you shrink the segment, it completely removes all information about bytes going out of the segment. Otherwise IDA will discard information about instructions/data, comments etc, but retain byte values so that you will be able to create another segment afterwards.

If IDA creates 2 segments where only one segment must exist, you may try the following sequence:

        - delete one segment. Choose one with
          bad segment base value. Do not disable addresses occupied
          by the segment being deleted.
        - change bounds of another segment.

Note that the create segment command changes the boundaries of the overlapping segment automatically.

Segments with the 'debugger' attribute are the segments whose memory contents are not saved in the database. Usually these segments are created by the debugger to reflect the current memory state of the program.

However, the user can modify this attribute.

If it is cleared, then the segment will permanently stay in the database after closing the debugger session. The database will reflect the state of the segment which was at the time when the status is changed.

If it is set, then the segment will become a temporary segment and will be deleted at the end of the debugging session.

The "debugger segment" checbkox is available only during debugging sessions.

The 'loader' segments are the segment created by the file loader. The segment having this attribute are considered to be part of the input file.

A segment with the 'debugger' attribute set and the 'loader' attribute cleared is considered to be an ephemeral segment. Such segments are not analyzed automatically by IDA Pro.

See also Edit|Segments submenu.


Move a segment

 Action    name: MoveSegment

This command allows you to move segment(s) to another address. Use it if the segment(s) are loaded at a wrong address.

This command shifts (moves) the selected segments in the memory to the target address. There must be enough free space at the target address for the segments.

All information in the segment will be moved to the new address, but since the addresses change, the disassembly might be not valid anymore (especially if the program is moved to the wrong addresses and the relocation information is not available).

 Fix up relocations

        This option allows IDA to modify the references
        to/from the relocated segment(s). If it is turned
        off, the references might be wrong after the move.

See also Edit|Segments submenu.


Rebase program

 Action    name: Rebase program

The whole program will be shifted by the specifed amount of bytes in the memory. The following options are available (we strongly recommend to leave them turned on):

 Fix up relocations

        This option allows IDA to modify the references
        to/from the relocated segment(s). If it is turned
        off, the references might be wrong after the move.

 Rebase the whole image

        This option is accessible only if the whole program
        is selected. It allows IDA to adjust internal
        variables on the whole program.

Please note rebasing the program might remove user-defined xrefs.

See also Edit|Segments submenu.


Change segment translation

 Action    name: SegmentTranslation

  A segment translation is a sequence of other segments to use
when resolving the references to instructions from the current segment.
Only code references are affected by the segment translation.

This feature is available only for selected processors (it is not available for IBM PC processors).

I hope it is easier to give an example than to give a formal definition. Suppose we have 3 segments:

                start   end
        A       0000    1000
        B       1000    2000
        C       3000    4000

 The instruction

        call    1000

 in the segment C obviously refers to the segment B while the instruction

        call    500

 refers to the segment A.

 But IDA does not try to link these references unless you tell it to do so:
 include the segments A and B into a translation list of the segment C.
 That is, you have to create a translation list

        A B

 for the segment C.

 Below is a more complicated example:

                start   end
        A       0000    1000
        B       1000    2000
        C       1000    2000
        D       3000    4000
        E       3000    4000

  translations

        B:      A
        C:      A
        D:      A B
        E:      A C

  allow you to emulate overlays (the first set is A B D, the second A C E)

IMPORTANT NOTE1: If you use the segment translations, make sure that all segments have unique segment bases. If two segments are placed in the linear address space so that they must have the same segment base, you may assign different selectors with equal values to them.

IMPORTANT NOTE2: IDA supports only one mapping for the entire segment. These mappings are the default ones. If the segment uses other mappings, then these individual mappings can be specified for each instruction separately by using the make offset commands.

IMPORTANT NOTE3: Since only code references are affected by the segment translation, try to create the RAM segment at its usual place (i.e. its linear address in IDA corresponds to its address in the processor memory). This will make all data references to it to be correct without any segment translation. For the data references to other segments you'll need to use the make offset command for each such reference.

See also

         addressing space concepts
         Edit|Segments submenu.


Set Default Segment Register Value

 Action    name: SetSegmentRegisterDefault

Meaningful only for processors with the segment registers.

You can specify a default value of a segment register for the current segment. When you change the default value, IDA will reanalyze the segment, taking the default value when it can not determine the actual value of the register. This takes time, so do not be surprised if references are not corrected immediately.

To specify other than default value of a segment register you can use change segment register value command.

 See also Edit|Segments submenu.
 See also How to enter segment value.


Change Segment Register Value

 Action    name: SetSegmentRegister

Meaningful only for processors with the segment registers. Currently this command works for IBM PC, TMS320C2, Intel80196, and PowerPC processors.

This command creates or updates a segment register change point.

See jump to segment register change point for more info.

ALPHA DISASSEMBLY

For Alpha processors the user must enter the difference between the real GP value and the start of the GOT (global offset table). For example:

         .got
         ....
         ; gp points here
 label:

If you want to specify that a register points to "label", you must calculate and enter the difference "label-.got" as the register value.

ARM DISASSEMBLY

The ARM processor module has a virtual segment register T which reflects the state of the T bit of the processor state register (PSR). Therefore, the value of this register controls THUMB/ARM mode. If its value is non zero, then the disassembly will be in the thumb mode.

POWER PC DISASSEMBLY

For PowerPC processors the user must enter an offset from the beginning of the TOC to the TOC entry which contains the address of the target. An example:

 TOC:    .toc
         ....
 sometc: .tc sometc[tc], datachunk

If you want to specify that a register points to "datachunk", you must calculate and enter the difference "sometc-TOC" as the register value. You can change the TOC value in the processor specific options (which is accessible from the analysis options).

INTEL 80196 DISASSEMBLY

For Intel 80196NP/NU processors the user must enter the value of WSR or WSR1 register. IDA will automatically take into account the new value.

 See also Edit|Segments submenu.
 See also How to enter segment value.
 See also How to Enter a Number.


Edit|Patch core submenu

This submenu allows you to patch the image of the input file. To be exact, IDA never modifies the input file. The image of the input file which was loaded to the database will be modified.

You can modify the image of the input file:

        - change a byte
        - change a word
        - enter an assembler instruction (only for IBM PC)

IDA will display the original value, the current value and file offset. If the file offset is equal to 0xFFFFFFFF then the current byte comes from a compressed page (LX/LE/NE iterated pages, for example) and/or it is not possible to tell the file position.

You can create a difference file afterwards.

The following commands are avaialbe:

 Patch byte or word
 Assemble...

See also:

 Produce EXE file
 Produce DIF file
 Edit submenu.


Patching the Image

 Action    name: PatchByte, PatchWord

You can modify the executable file and eventually generate a new file. You may modify unexplored items only.

If you patch bytes, then you may enter multiple bytes. Follow this link to learn about format of the input string.

You can create a difference file too.

See also

         Edit|Patch core submenu.
         How to Enter a Number.


Assemble an instruction

 Action    name: Assemble

This command allows you to assemble instructions. Currently only the IBM PC processors support the assembler.

The assembler requires to enclose all memory references into square brackets. For example:

        mov ax, [counter]

Also, the 'offset' keyword must not be used. Instead of

        mov eax, offset name

you must write

        mov eax, name

See also

         Edit|Patch core submenu.
         How to Enter a Number.


Edit|Other Submenu

      Create alignment directive...
      Manual instruction...
      Color instruction...
      Hide/show border

See also Edit submenu.


Create alignment directive

 Action    name: MakeAlignment

This command allows you to create an alignment directive. The alignment directive will replace a number of useless bytes inserted by the linker to align code and data to paragraph boundary or any other address which is equal to a power of two.

You can select an area to be converted to an alignment directive. If you have selected an area, IDA will try to determine a correct alignment automatically.

The are at least two requirements for this command to work: - there must be enough unexplored bytes at the current address. - an alignment directive must always end at an address which is divisible by a power or two.

See also

         Edit|Other submenu
         How to Enter an Address.


Specify instruction representation manually

 Action    name: ManualInstruction

This command allows you to specify representation of an instruction or data in the program.

Use it if IDA cannot represent the current instruction as you wish. If the instruction itself is ok and only an operand is misrepresented, then use Enter operand manually command.

To get rid of the manual representation specify an empty string as a manual representation.

See also Edit|Other submenu.


Specify instruction color

 Action    name: ColorInstruction

This command allows you to specify the background color for the current instruction or data item.

Only GUI version supports different background colors. Specifying a non-defined custom color will reset the instruction color and the default color specified in the Options, Color dialog box will be used.

See also Edit|Other submenu.


Hide/unhide a border

 Action    name: ToggleBorder

This command allows you to hide a thin border which is like the one generated automatically by IDA between instructions and data. If the border was already hidden then it is displayed again.

Note that you can hide all borders at once in the Comments Dialog.

See also Edit|Other submenu


Plugin modules

A plugin module is a module written on C++ that provides additional functionality to IDA.

Usually a plugin is invoked by a hotkey or through the menu system. The registered and loaded plugins will appear in a special Edit|Plugins submenu. A plugin may provide better analysis, automation of tedious tasks, etc.

The plugin modules reside in the "plugins" subdirectory of IDA. IDA is able to find and load all the plugings from this directory automatically.

However, you can write a configuration file and tell IDA how to load plugins. For that you need to modify "plugins.cfg" file in the "plugins" subdirectory.

The format of this file is simple:

Empty lines and lines starting with ';' are comment lines. Other lines must have the following structure:

           menuname filename hotkey arg

 Example:

           Undefine undef    Alt-U  0

If the filename doesn't include the file extension or the directory, IDA will add them. The plugin modules have the following extensions:

        Windows 32 bit:        *.plw
        Windows 64 bit:        *.p64
        Linux 32 bit:          *.plx
        Linux 64 bit:          *.plx64

For more information see information on individual plugin modules.

See also Edit submenu.


Jump submenu

In this menu you can select a command to jump to the specified location in the file. Jumps are very fast and your previous position is saved. This submenu contains the following items:

 Jump immediate
 Jump back
 Undo last jump back
 Empty navigation stack
 Jump to address
 Jump to named location
 Jump to segment start
 Jump to segment register change point
 Jump to problematic location
 Mark location
 Jump to marked position
 Jump to cross reference
 Jump to cross reference to operand
 Jump to function
 Jump to entry point
 Jump to file offset

See also

        Search menu for fast navigating.
        Jumps Stack concept.
        Menu Bar submenus


Jump Immediate

 Action    name: JumpEnter

By pressing <Enter> you navigate in the program in the same way as in a hypertext (the way the web browers and help screens use).

This is the easiest way to explore the program: just position the cursor at the desired name and press "@<JumpEnter>".

Your current address is saved in the jumps stack.

The Jump back command (usually Esc) will return you back.

If the cursor is at a stack variable, a window with stack variables is opened and the definition of the stack variable is displayed.

See also

         Jump submenu
         Empty Stack command.


'Jump back' Command

 Action    name: Return

This command returns you back to the previous position. It takes positions from Jumps Stack.

See also

         Jump submenu
         Undo "jump back" command.
         Empty Stack command.


Undo the last 'Return' Command

 Action    name: UndoReturn

This command undoes the last Jump back command.

See also

         Jump submenu
         Empty navigation stack command.


Empty navigation stack

 Action    name: EmptyStack

This command makes the jumps stack empty.

See also

         Jump submenu
         Jump back command.


Jump to the specified address

 Action    name: JumpAsk

This command jumps to the specified address in the program. IDA will ask you for the target address. You can enter a name or an address as a hexadecimal number with or without a segment. If you enter a valid address then:

  - the current address is saved in the jumps stack.
  - the cursor is positioned to the specified address.

The Jump back command (usually Esc) will return you back.

See also

         Jump submenu
         How to Enter an Address.


Jump to the named location

 Action    name: JumpName

This command allows you to jump to a name definition by selecting it from the list of the names.

IDA will display the list of the names (sorted by addresses) and you can choose a name. Dummy names (generated by IDA) are not listed. Hidden names are not listed either. You can control which names are listed in the Names representation dialog box.

See also

         Jump submenu
         How to use the lister.


Jump to the specified segment

 Action    name: JumpSegment

This command jumps to the start of the selected segment. IDA will ask you to select the target segment. After:

  - the current address is saved in the jumps stack.
  - the cursor is positioned to the specified address.

The Jump back command (usually Esc) will return you back.

See also:

        How to choose a segment
        Other segment related commands
        Jump submenu


Jump to the specified segment register change point

 Action    name: JumpSegmentRegister

This command jumps to the selected Segment Register Change Point. IDA will ask you to select a target change point. And after:

  - the current address is saved in the jumps stack.
  - the cursor is positioned to the specified address.

The Jump back command (usually Esc) will return you back.

See also Jump submenu.


Jump to a problematic location

 Action    name: JumpQ

This command allows you to jump to a problematic location. IDA will display the Problems List and allow you to select a problem.

The Jump back command (usually Esc) will return you back.

See also Jump submenu.


Mark Position

 Action    name: MarkPosition

You can mark certain locations of the file to be able to jump to them quickly. Text description of the location may help to find a desired location easily.

First you select a slot for the mark, after you enter a description for the location.

See also Jump submenu.


Jump to previously marked position

 Action    name: JumpPosition

This command jumps to the selected position. IDA will ask you to select a target position. After: - the current address is saved in the jumps stack. - the cursor is positioned to the specified address.

The Jump back command (usually Esc) will return you back.

You can mark position using Mark Position command.

See also Jump submenu.


Jump to cross reference

 Action    name: JumpXref

This command shows you a list of cross-references to the current location and you can jump to the selected one by pressing Enter.

See also

         Jump submenu
         Jump to Cross References to Operand


Jump to cross references to operand

 Action    name: JumpOpXref

This command shows you a list of cross-references to the current operand and you can jump to the selected one by pressing Enter.

See also

         Jump submenu
         Jump to Cross References


Jump to function

 Action    name: JumpFunction

This command shows you a list of functions and you can jump to the selected one by pressing Enter.

See also

        Jump submenu
        How to choose a function


Jump to Entry Point

 Action    name: JumpEntryPoint

This command shows you a list of entry points and you can jump to the selected one by pressing Enter.

See also Jump submenu.


Jump to the specified file offset

 Action    name: JumpFileOffset

IDA will ask you for a target file offset. This command jumps to the address corresponding to this specified file offset. If this file offset corresponds to a valid address then:

  - the current address is saved in the jumps stack.
  - the cursor is positioned to the corresponding address.

The Jump back command (usually Esc) will return you back.

See also

         Jump submenu


Search submenu

In this menu you can select a command to search for something in the disassembly. Searches are relatively slow and your previous position is saved in the jumps stack.

You can search for:

   suspicious operands (instructions that need your attention)
   instructions
   data bytes
   unexplored bytes
   explored bytes
   immediate operand values
   substring in the text representation
   substring in the binary image of the file
   bytes not belonging to any function
   find all suspicious operands
   string with error
   find all errors

 in both directions (up and down).

See also

        Jump menu for fast navigating.
        Menu Bar submenus


Search for next suspicious operand

 Action    name: JumpSuspicious

Suspicious operands are the operands that need your attention because they contain an immediate value that could be a number or an offset. IDA does not know about it, so it marks these instructions as 'suspicious'. You can change the 'suspiciousness' of the operands using set lower limit of suspicious operands and set upper limit of suspicious operands commands.

Data arrays are considered to be suspicious if the first element of the data array is within the lower and upper suspicious limits. Values of other elements are not examined.

You can disable the display of the 'suspicious' marks in the Comments Dialog.

NOTE: We strongly recommend that before producing an ASM file you go through all 'suspicious' marks and get rid of them. After this you have a certain level of confidence that the file has been disassembled correctly.

See also Search submenu


Search for next string with error

 Action    name: JumpError

This commands searches for the 'error' operands. Usually these operands are displayed with a red color.

Below is the list of probable causes of error operands:

        - reference to an unexisting address
        - illegal offset base
        - unprintable character constant
        - invalid structure or enum reference
        - and so on...

See also Search submenu


Search for next code

 Action    name: JumpCode

This command searches for the first instruction in the current direction.

See also Search submenu


Search for next data

 Action    name: JumpData

This command searches for the first defined data item in the current direction.

See also Search submenu


Search for next unexplored byte

 Action    name: JumpUnknown

This command searches for the first unexplored byte in the current direction.

See also Search submenu


Search for next explored byte

 Action    name: JumpExplored

This command searches for the first defined byte (instruction or data) in the current direction.

See also Search submenu


Search for next instruction/data with the specified operand

 Action    name: AskNextImmediate

This command searches for the first instruction or data byte that contains the specified immediate value. The command is relatively slow (but much faster than the text search), because it disassembles each instruction to find the operand values.

If the checkbox "any untyped value" is checked, then the "value" field is ignored. IDA will look for all immediate values without type in this case.

See also

         Search submenu
         How to Enter a Number.


Search for substring in the disassembly

 Action    name: AskNextText

This command searches for the specified substring in the text representation of the disassembly. This command is a slow command, because it disassembles each instruction to get the text representation. IDA will show its progress on the indicator. You can interrupt this command pressing Ctrl-Break.

You may search for regular expressions too.

If an area is selected using anchor, IDA will search for the specified substring in the area.

Note that this command searches the same as what you see on your screen (and not in binary image).

For binary search look at Search for substring in the file

See also Search submenu


Search for substring in the file

 Action    name: AskBinaryText

This command searches for the specified substring in the file being disassembled. This command can be used for fast lookups of text strings in the executable file or even to find references to a data. You can interrupt it pressing Ctrl-Break.

If an area is selected using anchor, IDA will search for the specified substring in the area.

The substring is specified like this:

        "This is substring to search"

i.e. in the double-quotes. Also you can specify individual byte values as numbers:

        6A 10

Follow this link to learn more about the format of the input string.

For example, if you want to find a reference to the following string:

 35F2:106A      db 'Hello',0

you could search for number 106A in the file.

See also

         the input string format
         search for text command.
         Search submenu


Search for bytes not belonging to any function

 Action    name: JumpNotFunction

This command searches for the first byte not beloning to any function in the current direction.

See also Search submenu


Find all suspicious operands

 Action    name: FindAllSuspicious

This command searches for all suspicious operands and presents a list of them. You may use this list to examine the operands and modify them as needed.

 See also suspicious operands
          Search submenu


Find all suspicious operands

 Action    name: FindAllErrors

This command searches for all strings containing any error and presents a list of them. You may use this list to examine errors and correct them as needed.

 See also string with error
          Search submenu


Set Direction for Searches

 Action    name: SetDirection

The current direction for searches is displayed in the right upper corner of the screen. Using this command you can toggle it.

See also

         Search submenu,
         Options submenu.


View submenu

Here are commands to open various windows, display information etc.

  Open subviews...
  Graphs...

  Calculator
  View segment registers
  View internal flags

  Hide
  Unhide
  Del hidden area
  Hide all
  Unhide all
  Setup hidden items...

  View File
  Edit file

See also Menu Bar submenus.


View submenu

Here are commands to open various windows, display information etc.

  Open notepad
  Open disassembly window
  Open exports window
  Open imports window
  Open functions window
  Open names window
  Open signatures window
  Open segments window
  Open segment registers window
  Open selectors window
  Open cross references window
  Open structures window
  Open enums window
  Open problems window
  Open type libraries window
  Open strings window
  Function calls window

Some windows allow you to manipulate the window contents by using the list viewer commands.

See also View submenu.


Open notepad

 Action    name: OpenNotepad

Opens a small notepad window for the general notes about the current database. The entered notes will be saved in the current database.

See also View|Open subviews submenu.


Graphs submenu

Here are commands to draw various graphs:

  Display function flow-chart
  Display function call graph
  Display chart of xrefs to addresses
  Display chart of xrefs from addresses
  Display user-defined chart of xrefs

IDA Pro uses an external program to display graphs. The program name is wingraph32.exe and it is located in the current directory.

The user can change the name of this program using the GRAPH_VISUALIZER parameter in the IDA.CFG file.

The user can zoom the graph and move it around the window.

See also View submenu.


Display function flow chart

 Action    name: GraphFunc

This command displays the flow chart of the current function.

The colored egdes of the flow chart represent the outcome of conditional jump instructions. Green means that the condition is satisfied, red means not satisfied.

See also View|Graphs submenu.


Display function call graph

 Action    name: CallFlow

This command displays the graph of all function calls in the program.

The functions are represented as nodes. The calls are represented as edges between nodes. Instructions outside functions are ignored.

See also View|Graphs submenu.


Display chart of xrefs to addresses

 Action    name: ChartXrefsTo

This command displays the graph of code and data xrefs to current address/range of selected addresses in the program.

The addresses are represented as nodes. The xrefs are represented as edges between nodes.

See also View|Graphs submenu.


Display chart of xrefs from addresses

 Action    name: ChartXrefsFrom

This command displays the graph of code xrefs from the current address/range of selected addresses in the program.

In this direction, data xrefs aren't analyzed to avoid overloaded graphs.

The addresses are represented as nodes. The xrefs are represented as edges between nodes.

See also View|Graphs submenu.


Display used-defined chart of xrefs

 Action    name: ChartXrefsUser

This command displays a user-defined graph of xrefs from/to the current address/range of selected addresses in the program.

The direction of the xrefs to analyze can be chosen. If the Recursive flag is checked, all founded xrefs are themselves analyzed to find new xrefs. You can choose to search for xrefs to new referenced addresses only in the current direction. Only External, data xrefs, xrefs from library functions and to library functions can possibly be ignored.

A recursion depth can be specified. If 'Print recursion dots' is checked, and a function has others xrefs outside of the range defined by the 'recursion depth' setting, small nodes containing dots are printed.

The 'Print comments' flag causes the generated function node to also contain the function's comment.

The addresses are represented as nodes. The xrefs are represented as edges between nodes. The used colors are the same as in IDA.

See also View|Graphs submenu.


View segment registers

 Action    name: ShowRegisters

This command displays segment register contents in the messages window.

You may use this command to refresh the disassembly window too.

See also

         Edit|Segments submenu.
         View submenu.


View Internal Flags

 Action    name: ShowFlags

This command displays the internal flag values for the current item. The information appears in the messages window.

See also View submenu.


Hide

 Action    name: Hide

This command allows you to hide a part of disassembly. You can hide a function, a segment, or create a special hidden area.

If a range is specified, a special hidden area is created on this range.

If the cursor is on the segment name at the start of the segment, the segment will be hidden. IDA will display only the header of the hidden segment.

Otherwise the current function will be hidden. IDA will display only the header of the hidden function.

If there is no current function then IDA will beep.

If you want to see hidden items on the screen, you may use unhide command or enable the display of the hidden items. If you want to delete a previously created hidden area, you may use del hidden area command.

See also Edit|View submenu


Unhide

 Action    name: Unhide

This command allows you to unhide a hidden part of disassembly.

If the cursor is on the hidden function name, the function will be unhidden.

If the cursor is on the hidden segment name, the segment will be unhidden.

See also hide command and setup hidden command.

See also Edit|View submenu


Del hidden area

 Action    name: DelHiddenArea

This command allows you to delete a hidden area of disassembly (previously defined by using the hide command).

See also hide command.

See also Edit|View submenu


Hide all items

 Action    name: HideAll

This command allows you to hide all functions, structures or enumerations of the current view. IDA will display only the header of the hidden items.

If you want to see hidden items on the screen, you may use unhide command or enable the display of the hidden items.

See also Unhide all command.

See also Edit|View submenu


Unhide all items

 Action    name: UnhideAll

This command allows you to unhide all functions, structures or enumerations of the current view.

See also Hide all command.

See also Edit|View submenu


Setup hidden items

 Action    name: SetupHidden

This command allows you to toggle the display of hidden items.

Automatically hide library functions

        This option hides the functions recognized by FLIRT.
        If will have effect only from the time it is set.

Display hidden instructions

        If this option is set, IDA will display all the instructions
        as unhidden even if they were hidden.

Display hidden functions

        If this options is set, IDA will display all the functions
        as unhidden even if they were hidden.

Display hidden segments

        If this options is set, IDA will display all the segments
        as unhidden even if they were hidden.

See also View submenu.


Debugger window

 Action    name: Debugger

Opens the debugger window.

In this window you can view information related to existing threads. The debugger always selects the thread where the latest debugging event occured. The user can switch from one thread to another simply by selecting it in the list.

This window also prints register values. For most registers, we have two different boxes:

       - the first box (on the left) indicates the current value of the register.
         A light blue color indicates the value changed since the last debugging event.
         A dark blue color indicates the value was modified by the user.
         A popup menu is available on this control, offering different commands.

       - the second box (on the right) shows the current value of the register,
         interpreted like an address (if possible).

For segment registers, we only have one box indicating the register's current value.

For the flags register, we have one box indicating the register's current value, and small boxes indicating the status of the most important flags.

A popup menu is accessible everywhere in the window, which allows the user to show or hide different parts of the window: toolbar, thread list and available register classes.

See also Debugger submenu.


Thread list

 Action    name: Threads

Opens the threads window.

In this window you can view all the threads of the debugged process. Double click on a thread to jump to its current instruction. This window is especially usefull if you want to switch between threads during the debugging of multithreaded process.

 See also Debugger submenu.


Module list

 Action    name: Modules

Opens the modules window.

In this window you can view all the modules loaded by the debugged process. Double click on a module to jump to its base address.

 See also Debugger submenu.


Start process

 Action    name: ProcessStart

This command starts the process in the debugger. If the process was suspended, it will continue its execution.

 See also Attach to process...
          Process options
          Pause process
          Terminate process
          Detach from process
          Debugger submenu.


Attach to process

 Action    name: ProcessAttach

This command displays running processes corresponding to the disassembled file in the database and allows the user to choose a process to attach to.

 See also Start process
          Process options
          Pause process
          Terminate process
          Detach from process
          Debugger submenu.


Process options

 Action    name: SetupProcess

This dialog box allows to specify different settings related to the process being debugged.

Application

        Host application to launch. For executable files this field is equal to the 'input file'.

Input file

        The input file used to create the database. If this field is wrong, IDA won't be able
        to launch the program.

Directory

        Directory to start the application. If empty, then the current directory
        will be used.

Parameters

        Optional parameters to pass to the debugged application (or the host application)
        when it starts. This field may be empty.

Hostname

        If entered, denotes the name of the remote host with the application
        to debug. In this case a remote IDA server on this host must be launched.
        The following remote debugging servers are/will be available:

        win32_remote   MS Windows
        linux_remote   Linux

        There are also 64-bit versions of these servers (with '64' suffix)

Port

        The port number of the remote server

Password

        Optional password to protect your server from strangers connecting to
        it and running arbitrary commands. The same password switch be
        specified on the remote server.

 See also Start process
          Debugger submenu.


Pause process

 Action    name: ProcessPause

This command pauses a running process.

 See also Start process
          Terminate process
          Debugger submenu.


Terminate process

 Action    name: ProcessTerminate

This command terminates the debugged process.

 See also Start process
          Pause process
          Detach from process
          Debugger submenu.


Detach from process

 Action    name: ProcessDetach

This command detaches the debugger from the debugged process. Note: this command is only available on Windows XP or Windows 2003 Server !

 See also Start process
          Pause process
          Terminate process
          Debugger submenu.


Take memory snapshot

 Action    name: TakeSnapshot

This command copies the contents of the process memory to the database. It is available during a debugging session.

The memory contents will be copied to the database. The user can specify that only the segments with the 'loader' attribute will be saved in the database.

The segments with the loader attribute are created by the input file loader and usually contain information from the input file. However, in some cases (like attaching to an existing process), there won't be any loader segments because the input file was not loaded by IDA.

To be able to make a partial snapshot in this and similar cases, the user can set or clear the 'loader' attribute of the desired segments using the edit segment command.

After applying this command the user can terminate the debugging process and continue to analyze the program in the database.

Please note that it is possible to save the database without taking a memory snapshot. Such a database might be used to keep global information about the program like the breakpoint information, notes, etc. However we recommend to take a memory snapshot of at least the 'loader' segments because it will allow to save also information about the program functions, names, comments, etc.

See also Debugger submenu.


Trace into

 Action    name: ThreadTraceInto

This command executes one assembler instruction at a time, tracing into functions.

 See also Step over
          Run until return
          Debugger submenu.


Step over

 Action    name: ThreadStepOver

This command executes one assembler instruction at a time, stepping over procedures while executing them as a single unit.

Internally, in the case of a function call, IDA setups a temporary breakpoint on the instruction following this function call.

 See also Trace into
          Run until return
          Debugger submenu.


Run until return

 Action    name: ThreadRunUntilReturn

This commands execute assembler instructions and stops on the instruction immediatly following the instruction that called the current function.

Internally, IDA executes each instruction until a 'return from function' instruction is reached.

 See also Trace into
          Step over
          Debugger submenu.


Run to cursor

 Action    name: ThreadRunToCursor

This command executes instructions until the instruction under the cursor is reached.

Internally, IDA setups a temporary breakpoint on the instruction under the cursor.

 See also Debugger submenu.


Set current ip

 Action    name: ThreadSetCurrentIp

This command sets the instruction pointer of the current suspended thread to the current cursor location.

It is accessible only when the debugger is active and the process is suspended.

 See also Debugger submenu.


Show application screen

 Action    name: ShowUserScreen

This command displays the application screen.

It is useful for the text mode debugger.

When the debugged application runs in the same window as IDA itself, the application output is hidden by IDA windows. This command allows to see the application screen in this case.

To return to IDA display, please press any key.

This command is available when the application is suspended or finished.

 See also Debugger submenu.


Breakpoints submenu

Here are the commands to use the debugger breakpoints.

  Breakpoints list
  Add breakpoint
  Edit breakpoint
  Delete breakpoint

See also Debugger submenu.


Breakpoints list

 Action    name: Breakpoints

Opens the breakpoints window.

In this window you can view information related to existing breakpoints. Breakpoints are saved in the database, and restored as soon as possible (once the memory becomes writeable).

The 'Pass count' column indicates how many times the debugger reached the breakpoint.

 See also Add breakpoint
          Delete breakpoint
          Edit breakpoint
          Breakpoints submenu.


Add breakpoint

 Action    name: BreakpointAdd

This command adds a breakpoint at the current address. If an instruction exists at this address, an instruction breakpoint is created. Or else, IDA offers to create a hardware breakpoint, and allows the user to edit breakpoint settings.

 See also Breakpoints list
          Add breakpoint
          Delete breakpoint
          Edit breakpoint
          Breakpoints submenu.


Delete breakpoint

 Action    name: BreakpointDel

This command deletes an existing breakpoint at the current address.

 See also Breakpoints list
          Add breakpoint
          Edit breakpoint
          Breakpoints submenu.


Watchs submenu

Here are the commands to use the debugger watchs.

  Watchs list
  Add watch
  Del watch

See also Debugger submenu.


Watchs list

 Action    name: WatchList

Opens the watchs list window.

In this window you can view memorized watchs. A watch allows the user to continuously see the value of a defined item.

 See also Add watch
          Delete watch
          Watchs submenu.


Add watch

 Action    name: AddWatch

This command adds a watch at the current address. The watch is visible in the Watchs List window.

 See also Watchs list
          Delete watch
          Watchs submenu.


Delete watch

 Action    name: DelWatch

This command deletes an existing watch.

 See also Watchs list
          Add watch
          Watchs submenu.


Tracing submenu

Here are the commands to use the tracing features of the debugger.

  Trace window
  Clear trace
  Instruction tracing
  Function tracing
  Add write trace
  Add read/write trace
  Add execution trace
  Stack trace
  Tracing Options

See also Debugger submenu.


Trace window

 Action    name: TraceWindow

Opens the trace window.

In this window you can view information related to all traced events. Tracing events are information saved during the execution of a program. Different type of trace events are available: instruction tracing events , function tracing events and write, read/write or execution tracing events.

During the execution, the list of traced events is disabled, as it couldn't be continuously synchronised with the execution without rendering the whole tracing very slow.

If a '=' character is displayed in the 'Thread' and 'Address' columns, it indicates the trace event occured in the same thread and at the same address as the previous trace event.

 See also Clear trace
          Instruction tracing
          Function tracing
          Add write trace
          Add read/write trace
          Add execution trace
          Tracing options
          Tracing submenu.


Clear trace

 Action    name: ClearTrace

This command removes all trace events available in the Trace window.

 See also Trace window
          Instruction tracing
          Function tracing
          Add write trace
          Add read/write trace
          Add execution trace
          Tracing options
          Tracing submenu.


Instruction tracing

 Action    name: ToggleTraceInstructions

This command starts instruction tracing. You can then use all debugger commands as usual: the the debugger will save all modified register values for each instruction.

When you click on an instruction trace event in the trace window, IDA displays the corresponding register values preceding the execution of this instruction. In the 'Result' column of the Trace window, you can also see which registers were modified by this instruction. By using this information, you can for example quickly determine which instruction modified a specific register, or you can even backtrace the execution flow. Remark the IP register is never printed in the 'Result' column, although it is usually modified by almost any instruction (except perheaps some prefixed instructions like REP MOVSB, ...).

Internally, the debugger runs the current thread step by step to properly obtain all the required register values. This explains why instructions tracing is slower than a normal execution.

 See also Trace window
          Clear trace
          Function tracing
          Add write trace
          Add read/write trace
          Add execution trace
          Tracing options
          Tracing submenu.


Function tracing

 Action    name: ToggleTraceFunctions

This command starts function tracing. You can then use all debugger commands as usual: the debugger will save all addresses where a call to a function or a return from a function occured.

Internally, the debugger runs the current thread step by step to properly detect all function calls and returns. This explains why functions tracing is slower than a normal execution.

 See also Trace window
          Clear trace
          Instruction tracing
          Add write trace
          Add read/write trace
          Add execution trace
          Tracing options
          Tracing submenu.


Add write trace

 Action    name: WriteTraceAdd

This command adds a write trace to the current address.

Each time the given address will be accessed in write mode, the debugger will add a trace event to the Trace window.

In fact, write traces are nothing more than breakpoints with special properties: they don't stop and they simply add a trace event when the breakpoints are reached.

Internally, the debugger will add a hardware breakpoint on the given address. So all restrictions for hardware breakpoints are also valid for write traces.

 See also Trace window
          Clear trace
          Instruction tracing
          Function tracing
          Add read/write trace
          Add execution trace
          Tracing options
          Tracing submenu.


Add read/write trace

 Action    name: ReadWriteTraceAdd

This command adds a read/write trace to the current address.

Each time the given address will be accessed in read or write mode, the debugger will add a trace event to the Trace window.

In fact, read/write traces are nothing more than breakpoints with special properties: they don't stop and they simply add a trace event when the breakpoints are reached.

Internally, the debugger will add a hardware breakpoint on the given address. So all restrictions for hardware breakpoints are also valid for read/write traces.

 See also Trace window
          Clear trace
          Instruction tracing
          Function tracing
          Add write trace
          Add execution trace
          Tracing options
          Tracing submenu.


Add execution trace

 Action    name: ExecTraceAdd

This command adds an execution trace to the current address.

Each time the instruction at the given address will be run, the debugger will add a trace event to the Trace window.

In fact, execution traces are nothing more than breakpoints with special properties: they don't stop and they simply add a trace event when the breakpoints are reached.

Internally, the debugger will add a breakpoint instruction at the given address.

 See also Trace window
          Clear trace
          Instruction tracing
          Function tracing
          Add write trace
          Add read/write trace
          Tracing options
          Tracing submenu.


Stack trace

 Action    name: StackTrace

Opens the stack trace window.

This window displays the function calls that brought the current instruction.

The top of the Stack Trace window lists the last function called by the program. Below this is the listing for the previously called functions. Each line indicates the name of the function which called the function represented by the previous line.

Double clicking on a line jumps to the exact address of the instruction realizing this call.

Currently IDA uses the EBP frame pointer values to gather the stack trace information. It will fail for functions using other methods for the frame.

 See also Tracing submenu.


Tracing options

 Action    name: SetupTracing

This dialog box allows you to specify different settings related to the tracing features.

Trace buffer size

        This setting indicates how many tracing events can fit in the trace buffer.
        If the debugger must insert a new event and the buffer is full,
        the oldest tracing event will be removed.
        However, if you specify a size of 0, the buffer size isn't limited.
        Notice that, for example, in the case of an instructions trace,
        all executed instructions could be logged, which would quickly fill
        up the memory!

Trace file

        if a filename is specified, all future traced events will be appended to this file.

Stop condition

        This IDC expression will be evaluated before the execution of each instruction.
        If the expression returns true, the debugger will stop the execution.
        Please note that you can use register names in this condition.

Tracing

        - Trace over debugger segments

            If selected, the debugger will not step by step in debugger segments
            (segments not available in the database).

        - Trace over library functions

            If selected, the debugger will not step by step in library functions.

        Enabling these options will speed up the execution, as many instructions
        (from debugger segments and/or library functions) won't be traced.
        Disabling these options can quickly fill the Trace window, as all instructions
        in DLLS and system functions will be executed step by step.
        Notice that both options influence the way instruction and function tracings
        will work.
        Internally, the debugger proceeds like this:
        - memorize the return address associated with the last executed call instruction
          in database segments (the previous saved one is overwriten if any).
        - setup a temporary breakpoint on this address once IP is in a debugger segment
          or library function, disable step by step, and run the thread.
        - reenable step by step once this temporary breakpoint is reached.

Instruction tracing

        - Log if same IP

            If selected, the debugger will also log all register modifications occuring
            during the execution of prefixed instructions like REP MOVSB, ...

Function tracing

        - Log return instructions

            If selected, the debugger will also log function returns.
            If disabled, only function calls are logged.

 See also Trace window
          Clear trace
          Instruction tracing
          Function tracing
          Add write trace
          Add read/write trace
          Add execution trace
          Tracing submenu.


Debugger options

 Action    name: SetupDebugger

This dialog box allows to specify different settings related to the debugger.

Events

  - Stop on debugging start

      If selected, the debugger will stop directly once the debuggin
      starts.

  - Stop on process entry point

      If selected, the debugger will insert a temporary breakpoint
      at the main entry point of the debugged application.

  - Stop on thread start/exit

      If selected, the debugger will stop if a new thread starts
      or if an existing thread terminates.

  - Stop on library load/unload

      If selected, the debugger will stop if a new library is
      loaded or if a previously loaded library is unloaded.

  - Stop on breakpoint instruction

      If selected, the debugger will stop on breakpoint instructions
      not inserted by the debugger itself.

  - Stop on debugging message

      If selected, the debugger will stop if the debugged application
      generates a message destined to the debugger.

Log

  - Segment modifications

      If selected, the debugger will print information regarding
      segment modifications (creation, deletion, or resizing of
      segments) since the last event. Note that the debugger
      doesn't continuously track segment modifications, but detects
      those only if a debugging event occurs.

  - Thread start/exit

      If selected, the debugger will print a message if a new thread
      starts or if an existing thread terminates.

  - Library load/unload

      if Selected, the debugger will print a message if a new library is
      loaded or if a previously loaded library is unloaded.

  - Breakpoint instruction

      If selected, the debugger will print a message if the debugged process
      reaches a breakpoint

  - Debugging message

      If selected, the debugger will print debugging messages from
      the application.

Options

  - Reconstruct the stack

      If selected, the debugger will try to reconstruct the chain of stack
      frames, based on information available on the stack and in the
      function stack variables.

  - Show debugger breakpoint instructions

      If selected, the debugger will show breakpoint instructions inserted
      by the debugger itself. This function is mainly useful if the user
      wants to see the real contents of the memory.

Edit exceptions

      This button allows the user to setup
      how the debugger will react to specific exceptions.

Reload exceptions

      This button reloads the exception table from the exceptions.cfg
      file.

 See also Debugger submenu.


Switch debugger

 Action    name: SwitchDebugger

This command allows the user to select a debugger if there are several debuggers available for the current database. For example, Window32 program can be debugged with a remote or a local debugger.


Options Submenu

This submenu allows you to change various options and settings:

    Text representation...
    Comments...
    Representation of cross references...
    Assembler directives...
    Names representation...
    Demangled C++ names...
    Compiler...
    String styles...
    ASCII options...
    Colors...
    Dump/normal View
    Setup data types...

    Processor type...
    Target assembler...

    Analysis options...

See also Menu Bar submenus.


Text Representation Dialog

This command changes the look of the disassembly. Here you can change the values of the following checkboxes/input fields:

Line prefixes

        This checkbox enables or disables line prefixes display.
        Line prefix is the address of the current byte:

         3000:1000      mov ax, bx
         ^^^^^^^^^

        IDA.CFG parameter: SHOW_LINEPREFIXES

Number of opcode bytes

        Opcode bytes are shown below:

         3000:1000 55           push    bp
                   ^^^^^^^^^

        The opcode is the operation code of the current instruction.
        For the data items the opcodes are elements of data directives.
        Sometimes there is not enough place to display all bytes of an item
        (of a large array, for example). In this case IDA will display just
        a few first bytes of the item. By default IDA does not display
        the opcodes.

        IDA.CFG parameter: OPCODE_BYTES

Use segment names

        This option controls the appearance of the segment names in the
        addresses. Example (codeseg has base 3000):

           Enabled:     codeseg:0034
           Disabled:    3000:0034

        IDA.CFG parameter: USE_SEGMENT_NAMES

Segment addresses

        Using this checkbox you can disable segment addresses in the
        disassembly. IDA will show only offsets. Example:

           Enabled:     codeseg:0034
           Disabled:    0034

        IDA.CFG parameter: SHOW_SEGMENTS

Function offsets

        This option controls the appearance of the line prefixes.
        If it is enabled, the addresses will be displayed as offsets
        from a function beginning. Example:

           Enabled:     somefunc+0x44
           Disabled:    cseg:0x4544

Margin

        This option controls the length of disassembly lines for data
        directives.

        IDA.CFG parameter: MAX_DATALINE_LENGTH

Instruction indention

        You can change indention of disassembled instructions:

                         mov ax, bx
         <-------------->
            indention

        IDA.CFG parameter: INDENTION

Display bad instruction <BAD> marks

        Some assemblers do not understand some instructions even if they
        must. For example, the Z80 processor has several undocumented
        instructions and many assemblers fail to recognize them. IDA knows
        about this fact and tries to produce an output that can be compiled
        without errors, so it replaces such instructions with data bytes.

        The problem is more severe with Intel 80x86 processors: the same
        instruction can be coded differently. There are 2 operation codes
        for ADD instruction, etc. The worst thing is that the different
        operation codes have different lengths. If the assembler used to
        compile a file and your assembler produce different operation codes,
        you may obtain completely different output files.

        That is why IDA can mark such instructions as <BAD> and replace them
        with data bytes. Example:

           Enabled:
                        db 0Fh,86h,7Eh,0,0,0 ; <BAD> jbe     loc_0_205
                        db 0Fh,82h,78h,0,0,0 ; <BAD> jb      loc_0_205
                        db 0Fh,83h,72h,0,0,0 ; <BAD> jnb     loc_0_205
           Disabled:
                        jbe     loc_0_205
                        jb      loc_0_205
                        jnb     loc_0_205

        IDA.CFG parameter: SHOW_BAD_INSTRUCTIONS

Use tabulations in output

        You can disable the tab chars (0x09) in the output file if you do not
        like them. By default IDA produces output files with tab chars.

        IDA.CFG parameter: USE_TABULATION

low suspicious limit high suspicious limit

        Click here to get information about these fields.

Display stack pointer

        If this option is set, then IDA will display the value of
        the stack pointer in the line prefix.

        IDA.CFG parameter: SHOW_SP

See also Options submenu.


Comments Dialog

This command changes the look of the disassembly comments. Here you can change the values of the following checkboxes/input fields:

Comment indention

        You can change indention of comments:

                mov ax, bx                      ; this is a comment
        <-------------------------------------->
                       indention

        IDA.CFG parameter: COMMENTS_INDENTION

Display of 'suspicious' marks

        This option enables or disables suspicious marks display.
        Usually the suspicious marks are disabled because IDA displays the suspicious
        operands in red/orange anyway.

        IDA.CFG parameter: SHOW_SUSPICOUS

Display of empty lines

        This command enables or disables the presence of the autogenerated
        empty lines in the disassembly. It could be useful to decrease
        the number of the blank lines on the screen increasing amount
        of information on it.

        IDA.CFG parameter: SHOW_EMPTYLINES

Display borders between data/code

        This command enables or disables the presence of the autogenerated
        border lines in the disassembly. It could be useful to decrease
        the number of the blank lines on the screen increasing amount
        of information on it. A border line looks like this:

         ;---------------------------------------------------------

        Note that you can hide a particular border by using hide border command.

        IDA.CFG parameter: SHOW_BORDERS

Display comments

        If this option is disabled, IDA will not show any comments.

Display repeatable comments

        This command enables or disables the repeatable comments display.

        IDA.CFG parameter: SHOW_REPEATABLE_COMMENTS

Display auto comments

        Autocomments are predefined comments for all instructions.
        If you forgot the meaning of a certain instruction, you can use
        this command to get comments to all lines of the screen.

        IDA does not give comments to very simple instructions such as
        'mov' instruction and does not override existing comments.

        IDA.CFG parameter: SHOW_AUTOCOMMENTS

Display source lines

        This options controls the presence of the source line number
        information in the disassembly. Some object files have this
        information.

        IDA.CFG parameter: SHOW_SOURCE_LINNUM

See also Options submenu.


Cross References Dialog

IDA maintains cross-references automatically. Of course, when IDA starts to disassemble a new file the cross-references will not appear immediately; they will be collected during background analysis.

This command changes the representation of cross references.

Display segments in xrefs

        This checkbox enables or disables segments in cross references:

           Enabled:     ; CODE XREF: 3000:1025
           Disabled:    ; CODE XREF: 1025

Display xref type mark

        If this option is disabled, IDA will not display "CODE"
        or "DATA" in the cross-references.

        IDA.CFG parameter: SHOW_XREF_TYPES

Display function offsets

        This option controls the appearance of the cross-reference addresses.
        If it is enabled, the addresses will be displayed as offsets
        from a function beginnig. Example:

           Enabled:     somefunc+0x44
           Disabled:    cseg:0x4544

        IDA.CFG parameter: SHOW_XREF_FUNC

Display xref values

        If this option is disabled, IDA will just display the presence
        of cross-references, like this:

                ; CODE XREF: ...

        IDA.CFG parameter: SHOW_XREF_VALUES

Right margin

        Determines the maximal length of a line with the cross references.

        IDA.CFG parameter: MAX_XREF_LENGTH

Cross reference depth

        This value "how many bytes of an object to look at to collect
        cross references". For example we have an array:

                A       db 100 dup(0)

        If some instruction refers to the 5-th element of the array:

                mov     al,A+5

         with TD=3      we'll have no xrefs displayed
         with TD=10     we'll have this xref

        IDA.CFG parameter: MAX_TAIL

Number of xrefs to display

        Determines the maximal number of the cross references to display.
        You may keep this value low because you can access all xrefs by
        using the Jump to cross reference command.

        IDA.CFG parameter: SHOW_XREFS

See also Options submenu.


Assembler Directives Dialog

This command enables/disables the generation of some assembler directives, namely:

        assume directive
        origin directive

Sometimes (when you do not intend to assemble the output file), you may want to disable their generation.

See also Options submenu.


Names Representation

 Action    name: SetNameType

Dummy names are automatically generated by IDA. They are used to denote subroutines, program locations and data.

Dummy names have various prefixes depending on the item type and value:

  sub_          instruction, subroutine start
  locret_       'return' instruction
  loc_          instruction
  off_          data, contains offset value
  seg_          data, contains segment address value
  asc_          data, ascii string
  byte_         data, byte (or array of bytes)
  word_         data, 16-bit (or array of words)
  dword_        data, 32-bit (or array of dwords)
  qword_        data, 64-bit (or array of qwords)
  flt_          floating point data, 32-bit (or array of floats)
  dbl_          floating point data, 64-bit (or array of doubles)
  tbyte_        floating point data, 80-bit (or array of tbytes)
  stru_         structure (or array of structures)
  algn_         alignment directive
  unk_          unexplored byte

You can change representation of dummy names. IDA supports several types of dummy names:

  0     loc_0_1234     segment base address relative to program base address
                       & offset from the segment base
  1     loc_1000_1234  segment base address & offset from the segment base
  2     loc_dseg_1234  segment name & offset from the segment base
  3     loc_0_11234    segment relative to base address & full address
  4     loc_1000_11234 segment base address & full address
  5     loc_dseg_11234 segment name & full address
  6     loc_12         full address
  7     loc_0012       full address (at least 4 digits)
  8     loc_00000012   full address (at least 8 digits)
  9     dseg_1234      the same as 2, but without data type specifier
 10     loc_1          enumerated names (loc_1,loc_2,loc_3...)

If you have selected names type 10 (enumerated names), you may renumber them using a checkbox. The process is relatively fast, surprisingly.

The best representation for MS DOS programs is #0, for 16-bit processors - #7, and for 32-bit processors - #8. You can change dummy names type any time when you want.

Also, here you can set up types of names included in the names list. IDA knows about the following types of names:

        - normal names
        - public names
        - weak public or extern names
        - autogenerated (meaningful) names.
        - dummy (meaningless) names.

Dummy names may be public or weak, but they never appear in the list of names. You can specify the type of a name when you create or modify it.

Also, here you can set maximal length of new names. Old names will not be affected by this parameter.

See also:

  Rename command
  Options submenu


Demangled Names

 Action    name: SetDemangledNames

IDA can demangle mangled C++ names of the most popular C++ compilers:

        - Microsoft
        - Borland
        - Watcom
        - Visual Age
        - GNU

The demangled names are represented in two forms: short and long form. The short form is used when a name is used as a reference, the long form is used at the declaration.

You can set how demangled C++ names must be represented:

        - as comments. this representation allows you to obtain
          recompilable source text
        - instead of mangled names. this representation makes the output
          more readable. the disadvantage is that you can't recompile the
          output
        - don't display demangled names.

You can setup short and long forms of demangled names. Short form is used when a reference to the name is made; long form is used at the declaration.

To make demangled names more readable, we introduce the concept of a default memory model for demangled names. IDA will not display memory model modifier (near/far/huge) if it is equal to the default memory model.

Also, to make the demangled name more compact, unsigned types may be displayed as uchar, uint, ushort, ulong. The same with signed basic types.

See also How to customize demangled names


Compiler

 Action    name: SetupCompiler

This dialog box allows the user to specify the compiler used to create the program along with the memory model, default calling convention and other parameters.

Please note that while some combinations of the parameters are meaningless IDA doesn't check them for validity. It is up to the user to specify a correct combination.

IDA tries to determine the correct values automatically.

The include directories are a list of directories that look for the standard C headers. This parameter is used during parsing C header files. The directories must be separated by ';'. The predefined macros field has the same format and is used similarly. Please note that IDA doesn't define any compiler-specific macros by default.

See also Options submenu


String styles dialog

 Action    name: SetAsciiStyle

In this dialog you can setup string styles and also define a new string immediately.

The following string styles are defined:

      C-style (0 terminated)
      DOS style ($ terminated)
      Pascal style (length 1 byte)
      Wide pascal (length 2 bytes)
      Delphi (length 4 bytes)
      Unicode
      Unicode pascal style (length 1 byte)
      Unicode wide pascal style (length 2 bytes)
      Character terminated

If you select "character terminated" string style then you may specify up to 2 termination characters. The string will be terminated by any of these characters. If the second character is equal to 0, then it is ignored.

See also Options submenu.


String options

This dialog sets up the ascii string options:

Generate names

        If this option is set, IDA will give meaningful names to
        newly created ascii strings.

Names prefix

        This prefix will be used to form the string name.

Mark as autogenerated

        If a name is marked as autogenerated, it will be
        displayed in a different color and will be included in the
        list of names depending on the current setting.

Generate serial names

        IDA can generate serial names for ASCII strings, i.e.

                pref_001,pref_002,pref_003 etc...

        To enable serial names generation, specify
        prefix for names,starting serial number and number of leading zeroes.

        Each time you create an ASCII string, IDA generates
        a new serial name and assigns it to the string.

ASCII next line char

        This symbol will force IDA to start a new line in the string
        representation in the disassembly. Usually it is a line
        feed character ('\n').

Comment ascii references:

        This option allows IDA to display the contents of the ascii
        string along with the instruction that refers to the string.

See also Options submenu.


Color configuration

This dialog allows you to customize the color settings.

 GUI version:
 ------------

IDA keeps the color configuration in the registry. There are 4 palettes which can be configured independently.

 Text version:
 -------------

IDA keeps colors in file IDACOLOR.CF. This file may reside in the IDA directory or in the current directory. It is a binary file. IDA automatically saves all your changes into this file.

If the current item line prefix has "black on black" color, then the current item will not be highlighted. The same is with current line color - if it is "black on black", the current line will not be highlighted.

You can change the colors using the Customize button. You may have up to 4 different color palettes and switch between them on fly. The color palette is saved in IDACOLOR.CF file.

Each line prefix has its own color code depending on the current item: (the fourth color palette values are shown)

 Line prefixes
   Library function             BRIGHT CYAN ON BLUE
   Regular function             WHITE ON BLUE
   Instruction                  BROWN ON BLUE
   Data                         WHITE ON BLUE
   Unexplored                   WHITE ON BLACK
   Externs                      BRIGHT MAGENTA ON BLUE
   Current item                 BRIGHT BLUE ON BLUE
   Current line                 YELLOW ON BLUE
   Default                      BLACK ON BLACK (not used)

If the "current item" or "current line" are BLACK ON BLACK, then they will not be highlighted.

The rest of the line is colored with the following codes:

 Keywords
   Instruction                  WHITE ON BLUE
   Directive                    YELLOW ON BLUE
   Macro name                   MAGENTA ON BLUE
   Register name                WHITE ON BLUE
   Other                        WHITE ON BLUE

 Names
   Dummy data                   WHITE ON BLUE
   Dummy code                   WHITE ON BLUE
   Dummy unexplored             MAGENTA ON BLUE
   Hidden                       GREY ON BLUE
   Library function             BRIGHT CYAN ON BLUE
   Local variable               GREEN ON BLUE
   Regular data                 YELLOW ON BLUE
   Regular code                 YELLOW ON BLUE
   Regular unexplored           RED ON BLUE
   Demangled                    BRIGHT GREEN ON BRIGHT BLUE
   Segment name                 YELLOW ON BLUE
   Imported name                LIGHT MAGENTA ON BLUE

 Constants
   Suspicious                   BRIGHT RED ON BLUE
   Char in instruction          BRIGHT CYAN ON BLUE
   String in instruction        BRIGHT CYAN ON BLUE
   Number in instruction        BRIGHT GREEN ON BLUE
   Char in data                 BRIGHT GREEN ON BLUE
   String in data               BRIGHT GREEN ON BLUE
   Number in data               WHITE ON BLUE

 Xrefs
   Code                         GREEN ON BLUE
   Data                         CYAN ON BLUE
   Code to tail                 BRIGHT RED ON BLUE
   Data to tail                 MAGENTA ON BLUE

 Comments
   Automatic                    BROWN ON BLUE
   Regular                      BRIGHT WHITE ON BLUE
   Repeatable                   BROWN ON BLUE
   Extra line                   YELLOW ON BLUE

 Other
   Punctuation                  WHITE ON BLUE
   Opcode bytes                 BRIGHT GREEN ON BLUE
   Manual operand               BRIGHT WHITE ON BLUE
   Errors                       RED ON BLACK
   Selected                     BLACK ON WHITE
   Default                      YELLOW ON BLUE

(Other,Default) color code is used if a token has no color attached to it.

See also Options submenu.


Dump/normal View

 Action    name: ToggleDump

This command switches the current disassembly window mode between the dump mode and the normal mode. At the start all disassembly windows are in the normal mode so you can see instructions and data. When you are in the dump mode no instructions or data are displayed. All bytes of the program will be dumped on the screen as plain bytes and in ASCII. This command may be useful when you want to find something in the program visually. Do not forget that many commands continue to work in the dump mode. For example, you can use binary search command.

See also Options submenu.


Setup data types

 Action    name: SetupData

This command allows you to select the data types used in the round-robin carousel in MakeData command.

Valid data types are:

        - byte
        - word          (2 bytes)
        - double word   (4 bytes)
        - float         (4 bytes)
        - quadro word   (8 bytes)
        - double        (8 bytes)
        - long double   (10 or 12 bytes)
        - packed real   (10 or 12 bytes)

Naturally, not all data types are usable for all processors. For example, Intel 8051 processor doesn't have the 'double word' type.

Also, this command allows you to select a data type for the current undefined item and convert it to data.

Please note that if the current processor doesn't support a data type, you can not assign it even if you have selected it. If you unselect all data types, IDA will use the 'byte' type.

See also Options submenu.


Processor Type

 Action    name: SetProcessor

Valid processor types are:

  type      description
  ----      -----------

  8086    - Intel 8086
  80286r  - Intel 80286 real mode
  80286p  - Intel 80286 protected mode
  80386r  - Intel 80386 real mode
  80386p  - Intel 80386 protected mode
  80486r  - Intel 80486 real mode
  80486p  - Intel 80486 protected mode
  80586r  - Intel Pentium & MMX real mode  (IBM PC line)
  80586p  - Intel Pentium & MMX prot mode
  80686p  - Intel Pentium Pro & MMX
  k62     - AMD K6-2 with 3DNow!
  p2      - Intel Pentium II
  p3      - Intel Pentium III
  athlon  - AMD K7
  p4      - Intel Pentium 4
  metapc  - Disassemble all IBMPC opcodes
  8085    - Intel 8085
  z80     - Zilog 80
  z180    - Zilog 180                      (Zilog 80 line)
  z380    - Zilog 380
  64180   - Hitachi HD64180
  gb      - Gameboy
  z8      - Zilog 8                        (Zilog 8 line)
  860xr   - Intel 860 XR                   (Intel 860 line)
  860xp   - Intel 860 XP
  8051    - Intel 8051                     (Intel 51 line)
  80196   - Intel 80196                    (Intel 80196 line)
  80196NP - Intel 80196NP, NU
  m6502   - 6502                           (65xx line)
  m65c02  - 65c02
  pdp11   - DEC PDP/11                     (PDP line)
  68000   - Motorola MC68000
  68010   - Motorola MC68010
  68020   - Motorola MC68020
  68030   - Motorola MC68030
  68040   - Motorola MC68040               (Motorola 680x0 line)
  68330   - Motorola CPU32 (68330)
  68882   - Motorola MC68020 with MC68882
  68851   - Motorola MC68020 with MC68851
  68020EX - Motorola MC68020 with both
  colfire - Motorola ColdFire
  68K     - Motorola MC680x0 all opcodes
  6800    - Motorola MC68HC00
  6801    - Motorola MC68HC01
  6803    - Motorola MC68HC03
  6301    - Hitachi HD 6301
  6303    - Hitachi HD 6303
  6805    - Motorola MC68HC05              (Motorola 8bit line)
  6808    - Motorola MC68HC08
  6809    - Motorola MC68HC09
  6811    - Motorola MC68HC11
  6812    - Motorola MC68HC12
  hcs12   - Motorola MC68HCS12
  6816    - Motorola MC68HC16
  java    - java                           (Java line)
  ppc     - PowerPC                        (PowerPC line)
  arm710a - ARM 7xx series
  arm     - the same as arm710a            (ARM line)
  armb    - ARM big endian
  xscalel - Intel xScale little endian
  xscaleb - Intel xScale big endian
  tms320c2- TMS320C2x series               (TMS 16bit addressing line)
  tms320c5- TMS320C5x series
  tms320c6- TMS320C6x series               (TMS VLIW line)
  tms320c3- TMS320C3x series
  sh3     - Hitachi SH3 (little endian)
  sh3b    - Hitachi SH3 (big endian)       (Hitachi SH line)
  sh4     - Hitachi SH4 (little endian)
  sh4b    - Hitachi SH4 (big endian)
  avr     - ATMEL AVR                      (ATMEL line)
  mipsl   - MIPS little endian             (MIPS line:R2000, R3000, R4000,
  mipsb   - MIPS big endian                R4200, R4300,  R4400, R4600,
  mipsr   - MIPS & RSP                     R8000, R10000)
  r5900   - MIPS R5900
  h8300   - H8/300x in normal mode
  h8300a  - H8/300x in advanced mode       (Hitachi H8 line)
  h8s300  - H8S in normal mode
  h8s300a - H8S in advanced mode
  h8500   - H8/500                         (Hitachi H8/500 line)
  pic12cxx- Michrochip PIC 12Cxx
  pic16cxx- Michrochip PIC 16Cxx           (PIC line)
  pic18cxx- Michrochip PIC 18Cxx
  sparcb  - SPARC big endian
  sparcl  - SPARC little endian            (SPARC line)
  alphab  - DEC Alpha big endian
  alphal  - DEC Alpha little endian        (ALPHA line)
  hppa    - HP PA-RISC big endian          (HP PA-RISC line)
  dsp56k  - Motorola DSP 5600x
  dsp561xx- Motorola DSP 561xx             (DSP 56K line)
  dsp563xx- Motorola DSP 563xx
  dsp566xx- Motorola DSP 566xx
  c166    - Siemens C166
  c166v1  - Siemens C166 v1 family
  c166v2  - Siemens C166 v2 family         (C166 line)
  st10    - SGS-Thomson ST10
  super10 - Super10
  st20    - SGS-Thomson ST20/C1            (ST20 line)
  st20c4  - SGS-Thomson ST20/C2-C4
  st7     - SGS-Thomson ST7                (ST7 line)
  ia64l   - Intel Itanium little endian
  ia64b   - Intel Itanium big endian       (IA64 line)
  cli     - Microsoft.Net platform
  net     - Microsoft.Net platform (alias)
  i960l   - Intel 960 little endian
  i960b   - Intel 960 big endian           (i960 line)
  f2mc16l - Fujitsu F2MC-16L
  f2mc16lx- Fujitsu F2MC-16LX              (Fujitsu F2MC line)
  tms32054- TMS320C54xx series
  tms32055- TMS320C55xx series
  trimedia- Trimedia
  78k0    - NEC 78k/0
  78k0s   - NEC 78k/0s
  m740    - Mitsubishi 8-bit
  m7700   - Mitsubishi 16-bit
  m7750   - Mitsubishi 16-bit              (Mitsubishi 16-bit line)
  m32r    - Mitsubishi 32-bit
  m32rx   - Mitsubishi 32-bit extended     (Mitsubishi 32-bit line)
  st9     - STMicroelectronics ST9+
  fr      - Fujitsu FR family
  m7900   - Mitsubishi M7900
  kr1878  - Angstrem KR1878
  ad218x  - Analog Devices ADSP

You can change processor type only within the current line. If you have selected IBM PC line, you can't select Zilog 80 line and vice versa.

For information about additional processor modules please visit our web page at www.datarescue.com/idabase/idaproc.htm

Please note that when you change the processor type, IDA may change the target assembler, so check it out.

You may get a message saying that IDA does not know the specified processor if IDA fails to load the corresponding processor module.

        Windows 32bit IDA uses .w32 file extension
        Windows 64bit IDA uses .w64 file extension
        Linux 32bit IDA uses .ilx file extension
        Linux 64bit IDA uses .ilx64 file extension

NOTE: Changing the processor type leads to reanalysis of the whole program. Sometimes this is useful.

NOTE: when you load a new processor module, all analysis options are reset to the values specified in the configuration file.

IDA determines the default processor using the input file extension and the contents of the input file. The table which describes the input file extensions and the corresponding processor types is located in IDA.CFG file and looks like:

 DEFAULT_PROCESSOR = {
 /* Extension   Processor */
  "com" :       "8086"                  // IDA will try the specified
  "exe" :       "80386r"                // extensions if no extension is
  "dll" :       "80386r"                // given.
  "drv" :       "80386r"
  "o"   :       "68000"
  "prc" :       "68000"                 // PalmPilot programs
  "axf" :       "arm710a"
  "h68" :       "68000"                 // MC68000 for *.H68 files
  "i51" :       "8051"                  // i8051   for *.I51 files
  "sav" :       "pdp11"                 // PDP-11  for *.SAV files
  "rom" :       "z80"                   // Z80     for *.ROM files
  "cla" :       "java"                  // Java classes
  "class":      "java"                  // Java classes
  "s19":        "6811"
  "*":          "80386p"                // Default processor
}

If you want to change the default processor type, you need to change this table. You may add/delete rows in this table.

See also Options submenu.


Specify Target Assembler

 Action    name: SetAssembler

This command allows you to change the target assembler, i.e. the assembler for which the output is generated. You select the target assembler from a menu. The menu items depend on the current processor type.

NOTE: For the moment IDA supports only a generic assembler for 80x86 processors. We recommend the use of Borland's TASM to compile the output assembler files.


Analysis options

 Action    name: SetAuto

This command allows you to disable and enable the autoanalysis and its indicator.

Usually, the auto analysis is enabled. Disable it if you are sure that it will help you.

Here you may setup various kernel analysis options 1 and options 2. If the current processor has options, there will be a button to change processor-specific options too.

Under OS/2 you can specify priority for IDA. It has effect only for the current session. You can change the default priority in the Configuration file. Please do not set the "time critical" priority unless you know what you are doing. Your system will not react to any external events.

The analysis indicator is located in the upper right corner of the screen. Possible values of this indicator are presented below:

 "          " empty indicator means that the indicator is turned off.
 AU:  idle    Autoanalysis is finished.
 AU:disabled  Autoanalysis is disabled.
 FL:<address> execution flow is being traced
 PR:<address> a function is being created
 TL:<address> a function tail is being created
 SP:<address> the stack pointer is being traced
 AC:<address> the address is being analyzed
 LL:<number>  a signature file is being loaded
 L1:<address> the first pass of FLIRT
 L2:<address> the second pass of FLIRT
 L3:<address> the third pass of FLIRT
 TP:<address> type information is being applied
 FI:<address> the final pass of autoanalysis
 ??:<address> the address becomes unexplored
  @:<number>  indication of various activity

See also Options submenu. auto analysis explanation.


Miscellanous Options

Unhide collapsed items automatically when jumping to them

        If this option is turned on, then IDA will automatically
        uncollapse hidden functions if the user decides to jump
        to them. As soon as the user quits the function by pressing
        Esc, the function is automatically collapsed again.

Lazy jumps

        If this option is turned on, then IDA will not redraw the
        disassembly window if the jump target is already on the screen.
        In this case it will just move the cursor to the specified
        address. This option leads to less screen redraws and
        less "jumpy" behaviour.

Editor

        A text editor is to be used when the user decides to edit an
        IDC script using the IDC tollbar.

Navigation band refresh interval (milliseconds)

        Specifies how often the navigation band will be refreshed.
        IDA tries to minimize the number of redrawings because they
        could be really time and processor consuming (imagine
        a big-big program, 50-100 megabytes of code. it would
        take a long time to refresh information on the navigation
        band because the whole program will be examined to
        determine how to draw the band). If this option is set to 0,
        the navigation band is refreshed only when the cursor is
        moved far enough to reflect its movement on the band.


Windows submenu

Thus submenu allows you to manipulate windows on the screen. Also you can:

    Set video mode... (text version)
    Invoke external help
    Consult keyboard layout (text version)

See also Menu Bar submenus.


Load desktop

This command loads the windows configuration from the selected desktop.

See also

         Desktops
         Save desktop... command
         Delete desktop... command
         Reset desktop command


Save desktop

This command saves the current windows configuration to a desktop.

If no name is specified in the text box, IDA saves the current windows configuration to the <Database> or <Database debugger> desktop (if the debugger is active) in the database.

If you enter a name, IDA saves the current configuration to a named desktop in the registry.

If you select 'Default', IDA saves the current configuration to the <Default> or <Default debugger> desktop (if the debugger is active) in the registry.

See also

         Desktops
         Load desktop... command
         Delete desktop... command
         Reset desktop command


Delete desktop

This command deletes a desktop containing a windows configuration.

See also

         Desktops
         Save desktop... command
         Load desktop... command
         Reset desktop command


Reset desktop

This command resets all windows (IDA main window and database windows) by loading the original IDA disassemby desktop or debugger desktop (if the debugger is active).

See also

         Desktops
         Save desktop... command
         Load desktop... command
         Delete desktop... command


Reset Hidden Messages

This command resets the state of all questions and messages the user hid by checking the "Don't show this message again" checkbox.


Set Video Mode

 Action    name: SetVideoMode

This command changes the current video mode. The list of allowed video modes is kept in the IDATUI.CFG file, SCREEN_MODES parameter.

Please note that there are two instances in this variable: one for MS-DOS and another for Windows.

If you use MS DOS version then you need to specify the screen mode numbers in SCREEN_MODES valid for you video card. Otherwise this command will not work.

See also Windows submenu.


Invoke external help

 Action    name: ExternalHelp

This command invokes an external help.

In the MS Windows version of IDA it starts WinHelp with the parameter taken from the cursor location.

The HELPFILE parameter in IDATUI.CFG/IDAGUI.CFG points to the help file name.

See also Windows submenu.


Keyboard layout

 Action    name: KeyboardHelp

This command displays the current keyboard layout.

You can change the layout in the configuration file

        IDATUI.CFG (for the text version)
        IDAGUI.CFG (for the GUI version)

This command is available in the text version only.

See also Windows submenu.


Xrefs

//      See sample file xrefs.idc to learn to use these functions.

//      Flow types (combine with XREF_USER!):
#define fl_CF   16              // Call Far
#define fl_CN   17              // Call Near
#define fl_JF   18              // Jump Far
#define fl_JN   19              // Jump Near
#define fl_F    21              // Ordinary flow

#define XREF_USER 32            // All user-specified xref types
                                // must be combined with this bit

                                        // Mark exec flow 'from' 'to'
void    AddCodeXref(long From,long To,long flowtype);
long    DelCodeXref(long From,long To,int undef);// Unmark exec flow 'from' 'to'
                                        // undef - make 'To' undefined if no
                                        //        more references to it
                                        // returns 1 - planned to be
                                        // made undefined

// The following functions include the ordinary flows: // (the ordinary flow references are returned first) long Rfirst (long From); // Get first code xref from 'From' long Rnext (long From,long current);// Get next code xref from long RfirstB (long To); // Get first code xref to 'To' long RnextB (long To,long current); // Get next code xref to 'To'

// The following functions don't take into account the ordinary flows: long Rfirst0 (long From); long Rnext0 (long From,long current); long RfirstB0(long To); long RnextB0 (long To,long current);

// Data reference types (combine with XREF_USER!): #define dr_O 1 // Offset #define dr_W 2 // Write #define dr_R 3 // Read #define dr_T 4 // Text (names in manual operands) #define dr_I 5 // Informational

void add_dref(long From,long To,long drefType); // Create Data Ref void del_dref(long From,long To); // Unmark Data Ref

long Dfirst (long From); // Get first data xref from 'From' long Dnext (long From,long current); long DfirstB (long To); // Get first data xref to 'To' long DnextB (long To,long current);

long XrefType(void); // returns type of the last xref // obtained by [RD]first/next[B0] // functions. Return values // are fl_... or dr_...

// set number of displayed xrefs #define XrefShow(x) SetCharPrm(INF_XREFNUM,x)


AddConstEx

***********************************************
** add a member of enum - a symbolic constant
        arguments:      enum_id - id of enum
                        name    - name of symbolic constant. Must be unique
                                  in the program.
                        value   - value of symbolic constant.
                        bmask   - bitmask of the constant
                                  ordinary enums accept only -1 as a bitmask
                                  all bits set in value should be set in bmask too
        returns:        0-ok, otherwise error code:
#define CONST_ERROR_NAME  1     // already have member with this name (bad name)
#define CONST_ERROR_VALUE 2     // already have member with this value
#define CONST_ERROR_ENUM  3     // bad enum id
#define CONST_ERROR_MASK  4     // bad bmask
#define CONST_ERROR_ILLV  5     // bad bmask and value combination (~bmask & value != 0)

long AddConstEx(long enum_id,string name,long value,long bmask);


AddEntryPoint

***********************************************
** add entry point
        arguments:      ordinal  - entry point number
                                   if entry point doesn't have an ordinal
                                   number, 'ordinal' should be equal to 'ea'
                        ea       - address of the entry point
                        name     - name of the entry point. If null string,
                                   the entry point won't be renamed.
                        makecode - if 1 then this entry point is a start
                                   of a function. Otherwise it denotes data
                                   bytes.
        returns:        0 - entry point with the specifed ordinal already
                                exists
                        1 - ok

success AddEntryPoint(long ordinal,long ea,string name,long makecode);


AddEnum

***********************************************
** add a new enum type
        arguments:      idx - serial number of the new enum.
                              If another enum with the same serial number
                              exists, then all enums with serial
                              numbers >= the specified idx get their
                              serial numbers incremented (in other words,
                              the new enum is put in the middle of the list
                              of enums).
                              If idx >= GetEnumQty() then the new enum is
                              created at the end of the list of enums.
                        name - name of the enum.
                        flag - flags for representation of numeric constants
                               in the definition of enum.
        returns:        id of new enum or -1.

long AddEnum(long idx,string name,long flag);


AddHotkey

// Add hotkey for IDC function
//      hotkey  - hotkey name ('a', "Alt-A", etc)
//      idcfunc - IDC function name
// returns:
#endif
#define IDCHK_OK        0       // ok
#define IDCHK_ARG       -1      // bad argument(s)
#define IDCHK_KEY       -2      // bad hotkey name
#define IDCHK_MAX       -3      // too many IDC hotkeys
#ifdef _notdefinedsymbol

long AddHotkey(string hotkey,string idcfunc);


AddSourceFile

  IDA can keep information about source files used to create the program.
  Each source file is represented by a range of addresses.
  A source file may contains several address ranges.

***********************************************
** Mark a range of address as belonging to a source file
   An address range may belong only to one source file.
   A source file may be represented by several address ranges.
        ea1     - linear address of start of the address range
        ea2     - linear address of end of the address range
        filename- name of source file.
   returns: 1-ok, 0-failed.

success AddSourceFile(long ea1,ulong ea2,string filename);


AddStrucEx

***********************************************
** define a new structure type
        arguments:      index         - index of new structure type
                        If another structure has the specified index,
                        then index of that structure and all other
                        structures will be increentedfreeing the specifed
                        index. If index is == -1, then the biggest index
                        number will be used.
                        See GetFirstStrucIdx() for the explanation of
                        structure indices and IDs.

                        name - name of the new structure type.

                        is_union - 0: structure
                                   1: union

        returns:        -1 if can't define structure type because of
                        bad structure name: the name is ill-formed or is
                        already used in the program.
                        otherwise returns ID of the new structure type

long AddStrucEx(long index,string name,long is_union);


AddStrucMember

***********************************************
** add structure member
        arguments:      id      - structure type ID
                        name    - name of the new member
                        offset  - offset of the new member
                        flag    - type of the new member. Should be one of
                                  FF_BYTE..FF_PACKREAL (see above)
                                  combined with FF_DATA
                        typeid  - structure id if 'flag' == FF_STRU
                                  Denotes type of the member if the member
                                  itself is a structure. Otherwise should be
                                  -1.
                                  if isOff0(flag) then typeid specifies
                                  the offset base.
                                  if isASCII(flag) then typeid specifies
                                  the string type (ASCSTR_...).
                        nbytes  - number of bytes in the new member
        returns:        0 - ok, otherwise error code:
#define STRUC_ERROR_MEMBER_NAME   1     // already have member with this name (bad name)
#define STRUC_ERROR_MEMBER_OFFSET 2     // already have member at this offset
#define STRUC_ERROR_MEMBER_SIZE   3     // bad number of bytes or bad sizeof(type)

long AddStrucMember(long id,string name,long offset,long flag,
                    long typeid,long nbytes);


AltOp

// Get manually entered operand string
//      ea - linear address
//      n  - number of operand:
//              0 - the first operand
//              1 - the second operand

string  AltOp           (long ea,long n);       // get manually entered operand


AnalyzeArea

// Perform full analysis of the area
//      sEA - starting linear address
//      eEA - ending linear address (excluded)
// returns: 1-ok, 0-Ctrl-Break was pressed.

long    AnalyzeArea     (long sEA,long eEA);    // analyze area and try to
                                                // convert to code all bytes
                                                // Returns 1-ok,0-CtrlBreak pressed


Convenience functions

See Set..() functions for bit definitions.

StringStp(x)            SetCharPrm(INF_ASCII_BREAK,x)
LowVoids(x)             SetLongPrm(INF_LOW_OFF,x)
HighVoids(x)            SetLongPrm(INF_HIGH_OFF,x)
TailDepth(x)            SetLongPrm(INF_MAXREF,x)
Analysis(x)             SetCharPrm(INF_AUTO,x)
Tabs(x)                 SetCharPrm(INF_ENTAB,x)
Comments(x)             SetCharPrm(INF_CMTFLAG,((x)
                                ? (SW_ALLCMT|GetCharPrm(INF_CMTFLAG))
                                : (~SW_ALLCMT&GetCharPrm(INF_CMTFLAG))))
Voids(x)                SetCharPrm(INF_VOIDS,x)
Indent(x)               SetCharPrm(INF_INDENT,x)
CmtIndent(x)            SetCharPrm(INF_COMMENT,x)
AutoShow(x)             SetCharPrm(INF_AUTOSHOW,x)
MinEA()                 GetLongPrm(INF_MIN_EA)
MaxEA()                 GetLongPrm(INF_MAX_EA)
BeginEA()               GetLongPrm(INF_BEGIN_EA)
set_start_cs(x)         SetLongPrm(INF_START_CS,x)
set_start_ip(x)         SetLongPrm(INF_START_IP,x)


Asks

// Ask the user to enter a string
//      defval - the default string value. This value
//               will appear in the dialog box.
//      prompt - the prompt to display in the dialog box
// Returns: the entered string or 0.

string  AskStr          (string defval,string prompt); // ask a string

// Ask the user to choose a file
//      forsave- 0: "Open" dialog box, 1: "Save" dialog box
//      mask   - the input file mask as "*.*" or the default file name.
//      prompt - the prompt to display in the dialog box
// Returns: the selected file or 0.

string  AskFile         (bool forsave,string mask,string prompt);   // ask a file name

// Ask the user to enter an address
//      defval - the default address value. This value
//               will appear in the dialog box.
//      prompt - the prompt to display in the dialog box
// Returns: the entered address or BADADDR.

long    AskAddr         (long defval,string prompt); // BADADDR - no or bad input

// Ask the user to enter a number
//      defval - the default value. This value
//               will appear in the dialog box.
//      prompt - the prompt to display in the dialog box
// Returns: the entered number or -1.

long    AskLong         (long defval,string prompt); // -1 - no or bad input

// Ask the user to enter a segment value
//      defval - the default value. This value
//               will appear in the dialog box.
//      prompt - the prompt to display in the dialog box
// Returns: the entered segment selector or BADSEL.

long    AskSeg          (long defval,string prompt); // BADSEL - no or bad input
                                                     // returns the segment selector

// Ask the user to enter an identifier
//      defval - the default identifier. This value
//               will appear in the dialog box.
//      prompt - the prompt to display in the dialog box
// Returns: the entered identifier or 0.

string  AskIdent        (string defval,string prompt);

// Ask the user a question and let him answer Yes/No/Cancel
//      defval - the default answer. This answer will be selected if the user
//               presses Enter. -1:cancel,0-no,1-ok
//      prompt - the prompt to display in the dialog box
// Returns: -1:cancel,0-no,1-ok

long    AskYN           (long defval,string prompt); // -1:cancel,0-no,1-ok

// Display a message in the messages window
//      format - printf() style format string
//      ...    - additional parameters if any
// This function can be used to debug IDC scripts

void    Message         (string format,...);      // show a message in messages window

// Display a message in a message box
//      format - printf() style format string
//      ...    - additional parameters if any
// This function can be used to debug IDC scripts
// The user will be able to hide messages if they appear twice in a row on the screen

void    Warning         (string format,...);      // show a warning a dialog box

// Display a fatal message in a message box and quit IDA
//      format - printf() style format string
//      ...    - additional parameters if any

void    Fatal           (string format,...);      // exit IDA immediately


AskSelector

***********************************************
** get a selector value
        arguments:      sel - the selector
        returns:        selector value if found
                        otherwise the input value (sel)
        note:           selector values are always in paragraphs

long    AskSelector     (long sel);     // returns paragraph


AutoMark

// Plan to perform an action in the future.
// This function will put your request to a special autoanalysis queue.
// Later IDA will retrieve the request from the queue and process
// it. There are several autoanalysis queue types. IDA will process all
// queries from the first queue and then switch to the second queue, etc.

void    AutoMark        (long ea,long queuetype); // plan address to analyze
void    AutoMark2       (long start,long end,long queuetype);
                                                  // plan range of addresses

#define AU_UNK  10      // make unknown
#define AU_CODE 20      // convert to instruction
#define AU_PROC 30      // make function
#define AU_USED 40      // reanalyze
#define AU_LIBF 60      // apply a flirt signature (the current signature!)
#define AU_FINAL 200    // coagulate unexplored items


Batch

// Enable/disable batch mode of operation
//      batch:  0 - ida will display dialog boxes and wait for the user input
//              1 - ida will not display dialog boxes, warnings, etc.
// returns: old balue of batch flag

long    Batch           (long batch);           // enable/disable batch mode
                                                // returns old value


Byte

// Get value of program byte
//      ea - linear address
// returns: value of byte. If byte has no value then returns 0xFF
// If the current byte size is different from 8 bits, then the returned value
// might have more 1's.
// To check if a byte has a value, use functions hasValue(GetFlags(ea))

long    Byte            (long ea);              // get a byte at ea


ChooseFunction

***********************************************
** ask the user to select a function
        arguments:      title - title of the dialog box
        returns:        -1 - user refused to select a function
                        otherwise returns the selected function start address

long ChooseFunction(string title);


Comment

// Get regular indented comment
//      ea - linear address

string  Comment         (long ea);              // get comment


Compile

// Compile an IDC file.
// The file being compiled should not contain functions that are
// currently executing - otherwise the behaviour of the replaced
// functions is undefined.
//      filename - name of file to compile
// returns: "" - ok, otherwise it returns an error message.

string  Compile         (string filename);      // Compile an IDC file.
                                                // returns error message.


CreateArray

The arrays are virtual. IDA allocates space for and keeps only the specified
elements of an array. Array index is 32-bit long. Actually, each array
may keep a set of strings and a set of long(32bit) values.

***********************************************
** create array
        arguments:      name - name of array. There are no restrictions
                               on the name (its length should be less than
                               120 characters, though)
        returns:        -1 - can't create array (it already exists)
                        otherwise returns id of the array

long CreateArray(string name);


DelArrayElement

***********************************************
** delete an array element
        arguments:      tag     - tag of array (AR_LONG or AR_STR)
                        id      - array id
                        idx     - index of an element
        returns:        1-ok, 0-failed

success DelArrayElement(long tag,long id,long idx);


DelConstEx

***********************************************
** delete a member of enum - a symbolic constant
        arguments:      enum_id - id of enum
                        value   - value of symbolic constant.
                        serial  - serial number of the constant in the
                                  enumeration. See OpEnumEx() for
                                  for details.
                        bmask   - bitmask of the constant
                                  ordinary enums accept only -1 as a bitmask
        returns:        1-ok,0-failed

success DelConstEx(long enum_id,long value,long serial,long bmask);


DelEnum

***********************************************
** delete enum type
        arguments:      enum_id - id of enum

void DelEnum(long enum_id);


DelExtLnA

// Delete an additional anterior line
//      ea   - linear address
//      n    - number of anterior additioal line (0..500)

void    DelExtLnA       (long ea,long n);       // delete an additional line before the generated ones


DelExtLnB

// Delete an additional posterior line
//      ea   - linear address
//      n    - number of posterior additioal line (0..500)

void    DelExtLnB       (long ea,long n);       // delete an additional line aftr  the generated ones


DelFixup

***********************************************
** delete fixup information
        arguments:      ea - address to delete fixup information about
        returns:        none

void DelFixup(long ea);


DelFunction

***********************************************
** delete a function
        arguments:      ea - any address belonging to the function
        returns:        !=0 - ok

success DelFunction(long ea);


DelXML

***********************************************
** delete one or more XML values.
        arguments: path  - XPath expression of elements
                           where to delete value(s)
        returns:   1-ok, 0-failed

success DelXML(string path);


Hashes

success SetHashLong(long id,string idx,long value);
success SetHashString(long id,string idx,string value);
long    GetHashLong(long id,string idx);
string    GetHashString(long id,string idx);
success DelHashElement(long id,string idx);
string    GetFirstHashKey(long id);
string    GetNextHashKey(long id,string idx);
string    GetLastHashKey(long id);
string    GetPrevHashKey(long id,string idx);


Hidden areas

ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ
                          H I D D E N  A R E A S
ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ

// Hidden areas - address ranges which can be replaced by their descriptions

***********************************************
** hide an area
   arguments:
        start,end   - area boundaries
        description - description to display if the area is collapsed
        header      - header lines to display if the area is expanded
        footer      - footer lines to display if the area is expanded
        color       - RGB color code (-1 means default color)
   returns: !=0 - ok

success HideArea(long start,long end, string description, string header, string footer, long color);

***********************************************
** set hidden area state
   arguments:
        ea      - any address belonging to the hidden area
        visible - new state of the area
   returns: !=0 - ok

success SetHiddenArea(long ea, long visible);

***********************************************
** delete a hidden area
   arguments:      ea - any address belonging to the hidden area
   returns:        !=0 - ok

success DelHiddenArea(long ea);


DelHotkey

// Delete IDC function hotkey

success DelHotkey(string hotkey);


DelLineNumber

***********************************************
** delete information about source line number
        arguments:      ea      - linear address
        returns:        nothing

void DelLineNumber(long ea);


DelSelector

***********************************************
** delete a selector
        arguments:      sel - the selector to delete
        returns:        nothing
        note:           if the selector is found, it will
                        be deleted

void    DelSelector     (long sel);


DelSourceFile

***********************************************
** Delete information about the source file
        ea - linear address belonging to the source file
   returns: NULL - source file information is not found
            otherwise returns pointer to file name

success DelSourceFile(long ea);


DelStruc

***********************************************
** delete a structure type
        arguments:      id            - structure type ID
        returns:        0 if bad structure type ID is passed
                        1 otherwise the structure type is deleted. All data
                        and other structure types referencing to the
                        deleted structure type will be displayed as array
                        of bytes.

success DelStruc(long id);


DelStrucMember

***********************************************
** delete structure member
        arguments:      id            - structure type ID
                        member_offset - offset of the member
        returns:        !=0 - ok.
                        NOTE: IDA allows 'holes' between members of a
                              structure. It treats these 'holes'
                              as unnamed arrays of bytes.

long DelStrucMember(long id,long member_offset);


DeleteAll

// Delete all segments, instructions, comments, i.e. everything
// except values of bytes.

void    DeleteAll       ();                     // delete ALL information
                                                // about the program


DeleteArray

***********************************************
** delete array
   This function deletes all elements of the array.
        arguments:      id      - array id

void DeleteArray(long id);


Demangle

// Demangle a name
//      name - name to demangle
//      disable_mask - a mask that tells how to demangle the name
//                     it is a good idea to get this mask using
//                     GetLongPrm(INF_SHORT_DN) or GetLongPrm(INF_LONG_DN)
// Returns: a demangled name
// If the input name cannot be demangled, returns 0

string    Demangle        (string name, long disable_mask);


Dword

// Get value of program double word (4 bytes)
//      ea - linear address
// returns: the value of the double word. If double word has no value
// then returns 0xFFFFFFFF.

long    Dword           (long ea);              // get a double-word (4 bytes) at ea


Exec

// Execute an OS command.
// IDA will wait for the started program to finish.
// In order to start the command in parallel, use OS methods.
// For example, you may start another program in parallel using "start" command.
//      command - command line to execute
// returns: error code from OS

long    Exec            (string command);               // Execute OS command


Exit

// Stop execution of IDC program, close the database and exit to OS
//      code - code to exit with.

void    Exit            (long code);            // Exit to OS


ExtLinA

// Specify an additional line to display before the generated ones.
//      ea   - linear address
//      n    - number of anterior additioal line (0..500)
//      line - the line to display
// IDA displays additional lines from number 0 up to the first unexisting
// additional line. So, if you specify additional line #150 and there is no
// additional line #149, your line will not be displayed.

void    ExtLinA         (long ea,long n,string line); // insert an additional line before the generated ones


ExtLinB

// Specify an additional line to display after the generated ones.
//      ea   - linear address
//      n    - number of posterior additioal line (0..500)
//      line - the line to display
// IDA displays additional lines from number 0 up to the first unexisting
// additional line. So, if you specify additional line #150 and there is no
// additional line #149, your line will not be displayed.

void    ExtLinB         (long ea,long n,string line); // insert an additional line after the generated ones


Find

//
//      The following functions search for the specified byte
//          ea - address to start from
//          flag is combination of the following bits:
#endif
#define SEARCH_DOWN     0x01            // search forward
#define SEARCH_NEXT     0x02            // search next occurence
#define SEARCH_CASE     0x04            // search case-sensitive
                                        // (only for bin&txt search)
#define SEARCH_REGEX    0x08            // enable regular expressions
#define SEARCH_NOBRK    0x10            // don't test ctrl-break
#define SEARCH_NOSHOW   0x20            // don't display the search progress
//      return BADADDR - not found
//
long    FindVoid        (long ea,long flag);
long    FindCode        (long ea,long flag);
long    FindData        (long ea,long flag);
long    FindProc        (long ea,long flag);
long    FindUnexplored  (long ea,long flag);
long    FindExplored    (long ea,long flag);
long    FindImmediate   (long ea,long flag,long value);
long    FindText        (long ea,long flag,long y,long x,string str);
                // y - number of text line at ea to start from (0..100)
                // x - x coordinate in this line
long    FindBinary      (long ea,long flag,string str);
                // str - a string as a user enters it for Search Text in Core
                //      example:  "41 42" - find 2 bytes 41h,42h
                // The default radix depends on the current IDP module
                // (radix for ibm pc is 16)


FindFuncEnd

***********************************************
** Determine a new function boundaries
**
        arguments:      ea  - starting address of a new function
        returns:        if a function already exists, then return
                        its end address.
                        if a function end cannot be determined,
                        the return BADADDR
                        otherwise return the end address of the new function

long FindFuncEnd(long ea);


FindSelector

***********************************************
** find a selector which has the specifed value
        arguments:      val - value to search for
        returns:        selector if found
                        otherwise the input value (val)
        note:           selector values are always in paragraphs

long    FindSelector    (long val);


FirstSeg

// Get first segment
// returns: linear address of the start of the first segment
// BADADDR - no segments are defined

long    FirstSeg        ();             // returns start of the first
                                        // segment, BADADDR - no segments


GenerateFile

// Generate an output file
//      type  - type of output file. One of GEN_... symbols. See below.
//      fp    - the output file handle
//      ea1   - start address. For some file types this argument is ignored
//      ea2   - end address. For some file types this argument is ignored
//      flags - bit combination of GENFLG_...
// returns: number of the generated lines.
//          -1 if an error occured
//          OFILE_EXE: 0-can't generate exe file, 1-ok

int GenerateFile(long type, long file_handle, long ea1, long ea2,
                                                         long flags);

// output file types:

#define OFILE_MAP  0
#define OFILE_EXE  1
#define OFILE_IDC  2
#define OFILE_LST  3
#define OFILE_ASM  4
#define OFILE_DIF  5

// output control flags:

#define GENFLG_MAPSEGS 0x0001          // map: generate map of segments
#define GENFLG_MAPNAME 0x0002          // map: include dummy names
#define GENFLG_MAPDMNG 0x0004          // map: demangle names
#define GENFLG_MAPLOC  0x0008          // map: include local names
#define GENFLG_IDCTYPE 0x0008          // idc: gen only information about types
#define GENFLG_ASMTYPE 0x0010          // asm&lst: gen information about types too
#define GENFLG_GENHTML 0x0020          // asm&lst: generate html (gui version only)
#define GENFLG_ASMINC  0x0040          // asm&lst: gen information only about types


GetArrayElement

***********************************************
** get value of array element
        arguments:      tag     - tag of array, specifies one of two
                                  array types:
#define AR_LONG 'A'     // array of longs
#define AR_STR  'S'     // array of strings
                        id      - array id
                        idx     - index of an element
        returns:        value of the specified array element.
                        note that this function may return char or long
                        result. Unexistent array elements give zero as
                        a result.

string or long GetArrayElement(long tag,long id,long idx);


GetArrayId

***********************************************
** get array id by its name
        arguments:      name - name of existing array.
        returns:        -1 - no such array
                        otherwise returns id of the array

long GetArrayId(string name);


GetBmaskCmt

***********************************************
** get bitmask comment (only for bitfields)
        arguments:      enum_id - id of enum
                        bmask   - bitmask of the constant
                        repeatable - type of comment, 0-regular, 1-repeatable
        returns:        comment attached to bitmask if it exists.
                        otherwise returns 0.

long GetBmaskCmt(long enum_id,long bmask,long repeatable);


GetBmaskName

***********************************************
** get bitmask name (only for bitfields)
        arguments:      enum_id - id of enum
                        bmask   - bitmask of the constant
        returns:        name of bitmask if it exists. otherwise returns 0.

long GetBmaskName(long enum_id,long bmask);


Prm

// The following functions allow you to set/get common parameters.

long    GetLongPrm (long offset);
long    GetShortPrm(long offset);
long    GetCharPrm (long offset);
success SetLongPrm (long offset,long value);
success SetShortPrm(long offset,long value);
success SetCharPrm (long offset,long value);

// 'offset' may be one of the following:

INF_VERSION     // short; Version of database
INF_PROCNAME    // char[8]; Name of current processor
INF_LFLAGS      // char;  IDP-dependent flags
  LFLG_PC_FPP   //          decode floating point processor
                //          instructions?
  LFLG_PC_FLAT  //          Flat model?
  LFLG_64BIT    //          64-bit program?
INF_DEMNAMES    // char;  display demangled names as:
  DEMNAM_CMNT   //          comments
  DEMNAM_NAME   //          regular names
  DEMNAM_NONE   //          don't display
INF_FILETYPE    // short; type of input file (see core.hpp)
  FT_EXE        //          MS DOS EXE File
  FT_COM        //          MS DOS COM File
  FT_BIN        //          Binary File
  FT_DRV        //          MS DOS Driver
  FT_WIN        //          New Executable (NE)
  FT_HEX        //          Intel Hex Object File
  FT_MEX        //          MOS Technology Hex Object File
  FT_LX         //          Linear Executable (LX)
  FT_LE         //          Linear Executable (LE)
  FT_NLM        //          Netware Loadable Module (NLM)
  FT_COFF       //          Common Object File Format (COFF)
  FT_PE         //          Portable Executable (PE)
  FT_USER       //          file is loaded using IDP loader function
  FT_OMF        //          Object Module Format
  FT_SREC       //          R-records
  FT_ZIP        //          ZIP file
  FT_OMFLIB     //          Library of OMF Modules
  FT_AR         //          ar library
  FT_LOADER     //          file is loaded using LOADER DLL
  FT_ELF        //          Executable and Linkable Format (ELF)
  FT_W32RUN     //          Watcom DOS32 Extender (W32RUN)
  FT_AOUT       //          Linux a.out (AOUT)
INF_OSTYPE      // short; OS type the program is for
  OSTYPE_MSDOS
  OSTYPE_WIN
  OSTYPE_OS2
  OSTYPE_NETW
INF_APPTYPE     // short; Application type
  APPT_CONSOLE  //          console
  APPT_GRAPHIC  //          graphics
  APPT_PROGRAM  //          EXE
  APPT_LIBRARY  //          DLL
  APPT_DRIVER   //          DRIVER
  APPT_1THREAD  //          Singlethread
  APPT_MTHREAD  //          Multithread
  APPT_16BIT    //          16 bit application
  APPT_32BIT    //          32 bit application
INF_START_SP    // long;  SP register value at the start of
                //        program execution
INF_START_AF    // short; Analysis flags:
  AF_FIXUP      //          Create offsets and segments using fixup info
  AF_MARKCODE   //          Mark typical code sequences as code
  AF_UNK        //          Delete instructions with no xrefs
  AF_CODE       //          Trace execution flow
  AF_PROC       //          Create functions if call is present
  AF_USED       //          Analyze and create all xrefs
  AF_FLIRT      //          Use flirt signatures
  AF_PROCPTR    //          Create function if data xref data->code32 exists
  AF_JFUNC      //          Rename jump functions as j_...
  AF_NULLSUB    //          Rename empty functions as nullsub_...
  AF_LVAR       //          Create stack variables
  AF_TRACE      //          Trace stack pointer
  AF_ASCII      //          Create ascii string if data xref exists
  AF_IMMOFF     //          Convert 32bit instruction operand to offset
  AF_DREFOFF    //          Create offset if data xref to seg32 exists
  AF_FINAL      //          Final pass of analysis
INF_START_IP    // long;  IP register value at the start of
                //        program execution
INF_BEGIN_EA    // long;  Linear address of program entry point
INF_MIN_EA      // long;  The lowest address used
                //        in the program
INF_MAX_EA      // long;  The highest address used
                //        in the program - 1
INF_LOW_OFF     // long;  low limit of voids
INF_HIGH_OFF    // long;  high limit of voids
INF_MAXREF      // long;  max xref depth
INF_ASCII_BREAK // char;  ASCII line break symbol
INF_INDENT      // char;  Indention for instructions
INF_COMMENT     // char;  Indention for comments
INF_XREFNUM     // char;  Number of references to generate
                //        0 - xrefs won't be generated at all
INF_ENTAB       // char;  Use '\t' chars in the output file?
INF_VOIDS       // char;  Display void marks?
INF_SHOWAUTO    // char;  Display autoanalysis indicator?
INF_AUTO        // char;  Autoanalysis is enabled?
INF_BORDER      // char;  Generate borders?
INF_NULL        // char;  Generate empty lines?
INF_GENFLAGS    // char;  General flags:
  INFFL_LZERO   //          generate leading zeroes in numbers
INF_SHOWPREF    // char;  Show line prefixes?
INF_PREFSEG     // char;  line prefixes with segment name?
INF_ASMTYPE     // char;  target assembler number (0..n)
INF_BASEADDR    // long;  base paragraph of the program
INF_XREFS       // char;  xrefs representation:
  SW_SEGXRF     //          show segments in xrefs?
  SW_XRFMRK     //          show xref type marks?
  SW_XRFFNC     //          show function offsets?
  SW_XRFVAL     //          show xref values? (otherwise-"...")
INF_BINPREF     // short; # of instruction bytes to show
                //          in line prefix
INF_CMTFLAG     // char;  comments:
  SW_RPTCMT     //          show repeatable comments?
  SW_ALLCMT     //          comment all lines?
  SW_NOCMT      //          no comments at all
  SW_LINNUM     //          show source line numbers
INF_NAMETYPE    // char;  dummy names represenation type
  NM_REL_OFF
  NM_PTR_OFF
  NM_NAM_OFF
  NM_REL_EA
  NM_PTR_EA
  NM_NAM_EA
  NM_EA
  NM_EA4
  NM_EA8
  NM_SHORT
  NM_SERIAL
INF_SHOWBADS    // char;  show bad instructions?
                //        an instruction is bad if it appears
                //        in the ash.badworks array

INF_PREFFLAG    // char;  line prefix type:
  PREF_SEGADR   //          show segment addresses?
  PREF_FNCOFF   //          function offsets?

INF_PACKBASE    // char;  pack database?

INF_ASCIIFLAGS  // uchar; ascii flags
  ASCF_GEN      //          generate ASCII names?
  ASCF_AUTO     //          ASCII names have 'autogenerated' bit?
  ASCF_SERIAL   //          generate serial names?

INF_LISTNAMES   // uchar; What names should be included in the list?
  LN_NORMAL     //          normal names
  LN_PUBLIC     //          public names
  LN_AUTO       //          autogenerated names
  LN_WEAK       //          weak names

INF_ASCIIPREF   // char[16];ASCII names prefix
INF_ASCIISERNUM // ulong;   serial number
INF_ASCIIZEROES // char;    leading zeroes
INF_COMPILER    // uchar;   compiler
INF_MODEL       // uchar;   memory model & calling convention
INF_MF          // uchar;   Byte order: 1==MSB first
INF_ORG         // char;    Generate 'org' directives?
INF_ASSUME      // char;    Generate 'assume' directives?
INF_CHECKARG    // char;    Check manual operands?
INF_START_SS    // long;
INF_START_CS    // long;
INF_STRTYPE     // long;    current ascii string type
                //          is considered as several bytes:
                //      low byte:
  ASCSTR_TERMCHR//              Character-terminated ASCII string
  ASCSTR_PASCAL //              Pascal-style ASCII string (length byte)
  ASCSTR_LEN2   //              Pascal-style, length is 2 bytes
  ASCSTR_UNICODE//              Unicode string
  ASCSTR_LEN4   //              Delphi string, length is 4 bytes
  ASCSTR_ULEN2  //              Pascal-style Unicode, length is 2 bytes
  ASCSTR_ULEN4  //              Pascal-style Unicode, length is 4 bytes
  STRTERM1(strtype)       ((strtype>>8)&0xFF)
  STRTERM2(strtype)       ((strtype>>16)&0xFF)
                //              The termination characters are kept in
                //              the 2nd and 3d bytes of string type
                //              if the second termination character is
                //              '\0', then it is ignored.
INF_AF2         // ushort;  Analysis flags 2
  AF2_JUMPTBL   //              Locate and create jump tables
  AF2_DODATA    //              Coagulate data segs in final pass
  AF2_HFLIRT    //              Automatically hide library functions
  AF2_STKARG    //              Propagate stack argument information
  AF2_CHKUNI    //              Check for unicode strings
INF_NAMELEN     // ushort;  max name length (without zero byte)
INF_MARGIN      // ushort;  max length of data lines
INF_LENXREF     // ushort;  max length of line with xrefs
INF_LPREFIX     // char[16];prefix of local names
                //          if a new name has this prefix,
                //          it will be automatically converted to a local name
INF_LPREFIXLEN  // uchar;   length of the lprefix
-------------------------------------------------


GetColor

// ***********************************************
// ** get item color
//    arguments:
//         ea - address of the item
//         what - type of the item (one of CIC_... constants)
//    returns: color code in RGB (hex 0xBBGGRR)

long GetColor(long ea, long what);

#define CIC_ITEM 1          // one instruction or data
#define CIC_FUNC 2          // function
#define CIC_SEGM 3          // segment

#define DEFCOLOR 0xFFFFFFFF     // Default color


GetConstBmask

***********************************************
** get bit mask of symbolic constant
        arguments:      const_id - id of symbolic constant
        returns:        bitmask of constant or 0
                        ordinary enums have bitmask = -1

long GetConstBmask(long const_id);


GetConstByName

***********************************************
** get member of enum - a symbolic constant ID
        arguments:      name - name of symbolic constant
        returns:        ID of constant or -1

long GetConstByName(string name);


GetConstCmt

***********************************************
** get comment of a constant
        arguments:      const_id - id of const
                        repeatable - 0:get regular comment
                                     1:get repeatable comment
        returns:        comment string

string GetConstCmt(long const_id,long repeatable);


GetConstEnum

***********************************************
** get id of enum by id of constant
        arguments:      const_id - id of symbolic constant
        returns:        id of enum the constant belongs to.
                        -1 if const_id is bad.

long GetConstEnum(long const_id);


GetConstEx

***********************************************
** get id of constant
        arguments:      enum_id - id of enum
                        value   - value of constant
                        serial  - serial number of the constant in the
                                  enumeration. See OpEnumEx() for
                                  for details.
                        bmask   - bitmask of the constant
                                  ordinary enums accept only -1 as a bitmask
        returns:        id of constant or -1 if error

long GetConstEx(long enum_id,long value,long serial,long bmask);


GetConstName

***********************************************
** get name of a constant
        arguments:      const_id - id of const
        returns:        name of constant

string GetConstName(long const_id);


GetConstValue

***********************************************
** get value of symbolic constant
        arguments:      const_id - id of symbolic constant
        returns:        value of constant or 0

long GetConstValue(long const_id);


GetCurrentLine

// Get the disassembly line at the cursor

string    GetCurrentLine  ();


GetDisasm

// Get disassembly line
//      ea - linear address of instruction
// returns: "" - no instruction at the specified location
// note: this function may not return exactly the same mnemonics
// as you see on the screen.

string    GetDisasm       (long ea);              // get disassembly line


GetEntryOrdinal

***********************************************
** retrieve entry point ordinal number
        arguments:      index - 0..GetEntryPointQty()-1
        returns:        0 if entry point doesn't exist
                        otherwise entry point ordinal

long GetEntryOrdinal(long index);


GetEntryPoint

***********************************************
** retrieve entry point address
        arguments:      ordinal - entry point number
                                  it is returned by GetEntryPointOrdinal()
        returns:        -1 if entry point doesn't exist
                        otherwise entry point address.
                        If entry point address is equal to its ordinal
                        number, then the entry point has no ordinal.

long GetEntryPoint(long ordinal);


GetEntryPointQty

***********************************************
** retrieve number of entry points
        arguments:      none
        returns:        number of entry points

long GetEntryPointQty(void);


GetEnum

***********************************************
** get enum ID by the name of enum
        arguments:      name - name of enum
        returns:        ID of enum or -1 if no such enum exists

long GetEnum(string name);


GetEnumCmt

***********************************************
** get comment of enum
        arguments:      enum_id - ID of enum
                        repeatable - 0:get regular comment
                                     1:get repeatable comment
        returns:        comment of enum

string GetEnumCmt(long enum_id,long repeatable);


GetEnumFlag

***********************************************
** get flag of enum
        arguments:      enum_id - ID of enum
        returns:        flags of enum. These flags determine representation
                        of numeric constants (binary,octal,decimal,hex)
                        in the enum definition. See start of this file for
                        more information about flags.
                        Returns 0 if enum_id is bad.

long GetEnumFlag(long enum_id);


GetEnumIdx

***********************************************
** get serial number of enum by its ID
        arguments:      enum_id - ID of enum
        returns:        (0..GetEnumQty()-1) or -1 if error

long GetEnumIdx(long enum_id);


GetEnumName

***********************************************
** get name of enum
        arguments:      enum_id - ID of enum
        returns:        name of enum or empty string

string GetEnumName(long enum_id);


GetEnumQty

***********************************************
** get number of enum types
        arguments:      none
        returns:        number of enumerations

long GetEnumQty(void);


GetEnumSize

***********************************************
** get size of enum
        arguments:      enum_id - ID of enum
        returns:        number of constants in the enum
                        Returns 0 if enum_id is bad.

long GetEnumSize(long enum_id);


GetFirstBmask

long GetFirstBmask(long enum_id);


GetFirstConst

***********************************************
** get first constant in the enum
        arguments:      enum_id - id of enum
                        bmask   - bitmask of the constant
                                  ordinary enums accept only -1 as a bitmask
        returns:        value of constant or -1 no constants are defined
                        All constants are sorted by their values
                        as unsigned longs.

long GetFirstConst(long enum_id,long bmask);


GetFirstIndex

***********************************************
** get index of the first existing array element
        arguments:      tag     - tag of array (AR_LONG or AR_STR)
                        id      - array id
        returns:        -1 - array is empty
                        otherwise returns index of the first array element

long GetFirstIndex(long tag,long id);


GetFirstMember

***********************************************
** get offset of the first member of a structure
        arguments:      id            - structure type ID
        returns:        -1 if bad structure type ID is passed
                           or structure has no members
                        otherwise returns offset of the first member.
                        NOTE: IDA allows 'holes' between members of a
                              structure. It treats these 'holes'
                              as unnamed arrays of bytes.

long GetFirstMember(long id);


GetFirstStrucIdx

***********************************************
** get index of first structure type
        arguments:      none
        returns:        -1 if no structure type is defined
                        index of first structure type.
                        Each structure type has an index and ID.
                        INDEX determines position of structure definition
                         in the list of structure definitions. Index 1
                         is listed first, after index 2 and so on.
                         The index of a structure type can be changed any
                         time, leading to movement of the structure definition
                         in the list of structure definitions.
                        ID uniquely denotes a structure type. A structure
                         gets a unique ID at the creation time and this ID
                         can't be changed. Even when the structure type gets
                         deleted, its ID won't be resued in the future.

long GetFirstStrucIdx(void);


GetFixupTgtDispl

***********************************************
** get fixup target displacement
        arguments:      ea - address to get information about
        returns:        -1 - no fixup at the specified address
                        otherwise returns fixup target displacement

long GetFixupTgtDispl(long ea);


GetFixupTgtOff

***********************************************
** get fixup target offset
        arguments:      ea - address to get information about
        returns:        -1 - no fixup at the specified address
                        otherwise returns fixup target offset

long GetFixupTgtOff(long ea);


GetFixupTgtSel

***********************************************
** get fixup target selector
        arguments:      ea - address to get information about
        returns:        -1 - no fixup at the specified address
                        otherwise returns fixup target selector

long GetFixupTgtSel(long ea);


GetFixupTgtType

***********************************************
** get fixup target type
        arguments:      ea - address to get information about
        returns:        -1 - no fixup at the specified address
                        otherwise returns fixup target type:
#define FIXUP_MASK      0x7     // mask for fixup types:
#define FIXUP_BYTE      0       //   Low-order byte (8-bit displacement or
                                //   low byte of 16-bit offset).
#define FIXUP_OFF16     1       //   16-bit offset.
#define FIXUP_SEG16     2       //   16-bit base--logical segment base
                                //   (selector).
#define FIXUP_PTR32     3       //   32-bit long pointer (16-bit base:16-bit
                                //   offset).
#define FIXUP_OFF32     4       //   32-bit offset.
#define FIXUP_PTR48     5       //   48-bit pointer (16-bit base:32-bit offset)
#define FIXUP_HI8       6       //   high 8 bits of 16bit offset
#define FIXUP_REL       0x08    // fixup is relative to linear address
                                // specified in...?
#define FIXUP_SELFREL   0x10    // self-relative?
#define FIXUP_EXTDEF    0x20    // target is a location (otherwise - segment)
#define FIXUP_UNUSED    0x40    // fixup is ignored by IDA

long GetFixupTgtType(long ea);


GetFlags

// Get internal flags
//      ea - linear address
// returns: 32-bit value of internal flags. See start of IDC.IDC file
// for explanations.

long    GetFlags        (long ea);              // get internal flags for ea


GetFrame

***********************************************
** Get ID of function frame structure
**
        arguments:      ea - any address belonging to the function
        returns:        ID of function frame or -1
                        In order to access stack variables you need to use
                        structure member manipulaion functions with the
                        obtained ID.
                        If the function does't exist, return -1

long GetFrame(long ea);


GetFrameArgsSize

***********************************************
** Get size of arguments in function frame
**
        arguments:      ea - any address belonging to the function
        returns:        Size of function arguments in bytes.
                        If the function doesn't have a frame, return 0
                        If the function does't exist, return -1

long GetFrameArgsSize(long ea);


GetFrameLvarSize

***********************************************
** Get size of local variables in function frame
**
        arguments:      ea - any address belonging to the function
        returns:        Size of local variables in bytes.
                        If the function doesn't have a frame, return 0
                        If the function does't exist, return -1

long GetFrameLvarSize(long ea);


GetFrameRegsSize

***********************************************
** Get size of saved registers in function frame
**
        arguments:      ea - any address belonging to the function
        returns:        Size of saved registers in bytes.
                        If the function doesn't have a frame, return 0
                        This value is used as offset for BP
                        (if FUNC_FRAME is set)
                        If the function does't exist, return -1

long GetFrameRegsSize(long ea);


GetFrameSize

***********************************************
** Get full size of function frame
**
        arguments:      ea - any address belonging to the function
        returns:        Size of function frame in bytes.
                        This function takes into account size of local
                        variables + size of saved registers + size of
                        return address + size of function arguments
                        If the function doesn't have a frame, return size of
                        function return address in the stack.
                        If the function does't exist, return 0

long GetFrameSize(long ea);


GetFuncOffset

***********************************************
** convert address to 'funcname+offset' string
        arguments:      ea - address to convert
        returns:        if the address belongs to a function then
                          return a string formed as 'name+offset'
                          where 'name' is a function name
                          'offset' is offset within the function
                        else
                          return null string

string GetFuncOffset(long ea);


GetFunctionAttr

// ***********************************************
// ** get a function attribute
//         arguments:      ea - any address belonging to the function
//                         attr - one of FUNCATTR_... constants
//         returns:        -1 - error
//                         otherwise returns the attribute value

long GetFunctionAttr(long ea, long attr);

 FUNCATTR_START   -- function start address
 FUNCATTR_END     -- function end address
 FUNCATTR_FLAGS   -- function flags
 FUNCATTR_FRAME   -- function frame id
 FUNCATTR_FRSIZE  -- size of local variables
 FUNCATTR_FRREGS  -- size of saved registers area
 FUNCATTR_ARGSIZE -- number of bytes purged from the stack
 FUNCATTR_FPD     -- frame pointer delta
 FUNCATTR_COLOR   -- function color code


GetFunctionCmt

***********************************************
** retrieve function comment
        arguments:      ea - any address belonging to the function
                        repeatable - 1: get repeatable comment
                                     0: get regular comment
        returns:        function comment string

string GetFunctionCmt(long ea, long repeatable);


GetFunctionFlags

***********************************************
** retrieve function flags
        arguments:      ea - any address belonging to the function
        returns:        -1 - function doesn't exist
                        otherwise returns the flags:
 FUNC_NORET    // function doesn't return
 FUNC_FAR      // far function
 FUNC_LIB      // library function
 FUNC_STATIC   // static function
 FUNC_FRAME    // function uses frame pointer (BP)
 FUNC_USERFAR  // user has specified far-ness
               // of the function
 FUNC_HIDDEN   // a hidden function
 FUNC_THUNK    // thunk (jump) function
 FUNC_BOTTOMBP // BP points to the bottom of the stack frame

long GetFunctionFlags(long ea);


GetFunctionName

***********************************************
** retrieve function name
        arguments:      ea - any address belonging to the function
        returns:        null string - function doesn't exist
                        otherwise returns function name

string GetFunctionName(long ea);


GetIdaDirectory

// Get IDA directory
// This function returns the directory where IDA.EXE resides

string  GetIdaDirectory ();


GetInputFile

// Get IDB full path
// This function returns full path of the current IDB database

string    GetIdbPath();


GetInputFile

// Get input file name
// This function returns name of the file being disassembled.

string    GetInputFile    ();             // only the file name
string    GetInputFilePath();             // full path


GetLastBmask

long GetLastBmask(long enum_id);


GetLastConst

***********************************************
** get last constant in the enum
        arguments:      enum_id - id of enum
                        bmask   - bitmask of the constant
                                  ordinary enums accept only -1 as a bitmask
        returns:        value of constant or -1 no constants are defined
                        All constants are sorted by their values
                        as unsigned longs.

long GetLastConst(long enum_id,long bmask);


GetLastIndex

***********************************************
** get index of the last existing array element
        arguments:      tag     - tag of array (AR_LONG or AR_STR)
                        id      - array id
        returns:        -1 - array is empty
                        otherwise returns index of the last array element

long GetLastIndex(long tag,long id);


GetLastMember

***********************************************
** get offset of the last member of a structure
        arguments:      id            - structure type ID
        returns:        -1 if bad structure type ID is passed
                           or structure has no members
                        otherwise returns offset of the last member.
                        NOTE: IDA allows 'holes' between members of a
                              structure. It treats these 'holes'
                              as unnamed arrays of bytes.

long GetLastMember(long id);


GetLastStrucIdx

***********************************************
** get index of last structure type
        arguments:      none
        returns:        -1 if no structure type is defined
                        index of last structure type.
                        See GetFirstStrucIdx() for the explanation of
                        structure indices and IDs.

long GetLastStrucIdx(void);


GetLineNumber

***********************************************
** get source line number
        arguments:      ea      - linear address
        returns:        number of line in the source file or -1

long GetLineNumber(long ea);


GetManualInsn

// Get manual representation of instruction
//      ea   - linear address
// This function returns value set by SetManualInsn earlier.

string   GetManualInsn   (long ea);


GetMarkComment

***********************************************
** get marked position comment
        arguments:      slot    - slot number: 1..32
        returns:        null string if the slot doesn't contain
                                        a marked address
                        otherwise returns the marked address comment

string GetMarkComment(long slot);


GetMarkedPos

***********************************************
** get marked position
        arguments:      slot    - slot number: 1..32
                                  if the specifed value is <= 0
                                  range, IDA will ask the user to select slot.
        returns:        -1 - the slot doesn't contain a marked address
                        otherwise returns the marked address

long GetMarkedPos(long slot);


GetMemberComment

***********************************************
** get comment of a member
        arguments:      id            - structure type ID
                        member_offset - member offset. The offset can be
                                        any offset in the member. For example,
                                        is a member is 4 bytes long and starts
                                        at offset 2, then 2,3,4,5 denote
                                        the same structure member.
                        repeatable - 1: get repeatable comment
                                     0: get regular comment
        returns:        null string if bad structure type ID is passed
                           or no such member in the structure
                        otherwise returns comment of the specified member.

string GetMemberComment(long id,long member_offset,long repeatable);


GetMemberFlag

***********************************************
** get type of a member
        arguments:      id            - structure type ID
                        member_offset - member offset. The offset can be
                                        any offset in the member. For example,
                                        is a member is 4 bytes long and starts
                                        at offset 2, then 2,3,4,5 denote
                                        the same structure member.
        returns:        -1 if bad structure type ID is passed
                           or no such member in the structure
                        otherwise returns type of the member, see bit
                        definitions above. If the member type is a structure
                        then function GetMemberStrid() should be used to
                        get the structure type id.

long GetMemberFlag(long id,long member_offset);


GetMemberName

***********************************************
** get name of a member of a structure
        arguments:      id            - structure type ID
                        member_offset - member offset. The offset can be
                                        any offset in the member. For example,
                                        is a member is 4 bytes long and starts
                                        at offset 2, then 2,3,4,5 denote
                                        the same structure member.
        returns:        -1 if bad structure type ID is passed
                           or no such member in the structure
                        otherwise returns name of the specified member.

string GetMemberName(long id,long member_offset);


GetMemberOffset

***********************************************
** get offset of a member of a structure by the member name
        arguments:      id            - structure type ID
                        member_name   - name of structure member
        returns:        -1 if bad structure type ID is passed
                           or no such member in the structure
                        otherwise returns offset of the specified member.

long GetMemberOffset(long id,string member_name);


GetMemberQty

***********************************************
** get number of members of a structure
        arguments:      id         - structure type ID
        returns:        -1 if bad structure type ID is passed
                        otherwise returns number of members.

long GetMemberQty(long id);


GetMemberSize

***********************************************
** get size of a member
        arguments:      id            - structure type ID
                        member_offset - member offset. The offset can be
                                        any offset in the member. For example,
                                        is a member is 4 bytes long and starts
                                        at offset 2, then 2,3,4,5 denote
                                        the same structure member.
        returns:        -1 if bad structure type ID is passed
                           or no such member in the structure
                        otherwise returns size of the specified
                                          member in bytes.

long GetMemberSize(long id,long member_offset);


GetMemberStrId

***********************************************
** get structure id of a member
        arguments:      id            - structure type ID
                        member_offset - member offset. The offset can be
                                        any offset in the member. For example,
                                        is a member is 4 bytes long and starts
                                        at offset 2, then 2,3,4,5 denote
                                        the same structure member.
        returns:        -1 if bad structure type ID is passed
                           or no such member in the structure
                        otherwise returns structure id of the member.
                        If the current member is not a structure, returns -1.

long GetMemberStrId(long id,long member_offset);


GetMnem

// Get mnemonics of instruction
//      ea - linear address of instruction
// returns: "" - no instruction at the specified location
// note: this function may not return exactly the same mnemonics
// as you see on the screen.

string  GetMnem         (long ea);              // get instruction name


GetNextBmask

long GetNextBmask(long enum_id,long value);


GetNextConst

***********************************************
** get next constant in the enum
        arguments:      enum_id - id of enum
                        bmask   - bitmask of the constant
                                  ordinary enums accept only -1 as a bitmask
                        value   - value of the current constant
        returns:        value of a constant with value higher than the specified
                        value. -1 no such constants exist.
                        All constants are sorted by their values
                        as unsigned longs.

long GetNextConst(long enum_id,long value,long bmask);


GetNextFixupEA

***********************************************
** find next address with fixup information
        arguments:      ea - current address
        returns:        -1 - no more fixups
                        otherwise returns the next address with
                                                fixup information

long GetNextFixupEA(long ea);


GetNextIndex

***********************************************
** get index of the next existing array element
        arguments:      tag     - tag of array (AR_LONG or AR_STR)
                        id      - array id
                        idx     - index of the current element
        returns:        -1 - no more array elements
                        otherwise returns index of the next array element

long GetNextIndex(long tag,long id,long idx);


GetNextStrucIdx

***********************************************
** get index of next structure type
        arguments:      current structure index
        returns:        -1 if no (more) structure type is defined
                        index of the next structure type.
                        See GetFirstStrucIdx() for the explanation of
                        structure indices and IDs.

long GetNextStrucIdx(long index);


GetOpType

// Get type of instruction operand
//      ea - linear address of instruction
//      n  - number of operand:
//              0 - the first operand
//              1 - the second operand
// returns:
//      -1      bad operand number passed
//      0       None
//      1       General Register (al,ax,es,ds...)
//      2       Memory Reference
//      3       Base + Index
//      4       Base + Index + Displacement
//      5       Immediate
//      6       Immediate Far Address
//      7       Immediate Near Address
//      8       FPP register
//      9       386 control register
//      10      386 debug register
//      11      386 trace register
//      12      Condition (for Z80)
//      13      bit (8051)
//      14      bitnot (8051)

long    GetOpType       (long ea,long n);       // get operand type


GetOperandValue

// Get number used in the operand
// This function returns an immediate number used in the operand
//      ea - linear address of instruction
//      n  - the operand number
// The return values are:
//      operand is an immediate value  => immediate value
//      operand has a displacement     => displacement
//      operand is a direct memory ref => memory address
//      operand is a register          => register number
//      operand is a register phrase   => phrase number
//      otherwise                      => -1

long    GetOperandValue (long ea,long n);       // get instruction operand value


GetOpnd

// Get operand of an instruction
//      ea - linear address of instruction
//      n  - number of operand:
//              0 - the first operand
//              1 - the second operand
// returns: the current text representation of operand

string  GetOpnd         (long ea,long n);       // get instruction operand
                                                // n=0 - first operand


GetOriginalByte

// Get original value of program byte
//      ea - linear address
// returns: the original value of byte before any patch applied to it

long    GetOriginalByte(long ea);


GetPrevBmask

long GetPrevBmask(long enum_id,long value);


GetPrevConst

***********************************************
** get prev constant in the enum
        arguments:      enum_id - id of enum
                        bmask   - bitmask of the constant
                                  ordinary enums accept only -1 as a bitmask
                        value   - value of the current constant
        returns:        value of a constant with value lower than the specified
                        value. -1 no such constants exist.
                        All constants are sorted by their values
                        as unsigned longs.

long GetPrevConst(long enum_id,long value,long bmask);


GetPrevFixupEA

***********************************************
** find previous address with fixup information
        arguments:      ea - current address
        returns:        -1 - no more fixups
                        otherwise returns the previous address with
                                                fixup information

long GetPrevFixupEA(long ea);


GetPrevIndex

***********************************************
** get index of the previous existing array element
        arguments:      tag     - tag of array (AR_LONG or AR_STR)
                        id      - array id
                        idx     - index of the current element
        returns:        -1 - no more array elements
                        otherwise returns index of the previous array element

long GetPrevIndex(long tag,long id,long idx);


GetPrevStrucIdx

***********************************************
** get index of previous structure type
        arguments:      current structure index
        returns:        -1 if no (more) structure type is defined
                        index of the presiouvs structure type.
                        See GetFirstStrucIdx() for the explanation of
                        structure indices and IDs.

long GetPrevStrucIdx(long index);


GetReg

// Get value of segment register at the specified address
//      ea - linear address
//      reg - name of segment register
// returns: value of segment register. The segment registers in 32bit program
// usually contain selectors, so to get paragraph pointed by the segment
// register you need to call AskSelector() function.

long    GetReg          (long ea,string reg);   // get segment register value
                                                // BADADDR - undefined or error
                                                // (selector, use AskSelector() to
                                                //  get its mapping)


GetRegValue

// ***********************************************
// ** get register value
//    arguments:
//         name - the register name
//    the debugger should be running. otherwise the function fails
//    the register name should be valid.
//    It is not necessary to use this function to get register values.
//    A register name in the script will do too.
//    returns: register value (integer or floating point)

number GetRegValue(string name);


GetSegmentAttr

***********************************************
** get segment attribute
        arguments:      segea - any address within segment
                        attr  - one of SEGATTR_... constants

long    GetSegmentAttr  (long segea,long attr);

  SEGATTR_START          starting address
  SEGATTR_END            ending address
  SEGATTR_ALIGN          alignment
  SEGATTR_COMB           combination
  SEGATTR_PERM           permissions
  SEGATTR_BITNESS        bitness (0: 16, 1: 32, 2: 64 bit segment)
  SEGATTR_FLAGS          segment flags
  SEGATTR_SEL            segment selector
  SEGATTR_ES             default ES value
  SEGATTR_CS             default CS value
  SEGATTR_SS             default SS value
  SEGATTR_DS             default DS value
  SEGATTR_FS             default FS value
  SEGATTR_GS             default GS value
  SEGATTR_TYPE           segment type
  SEGATTR_COLOR          segment color


GetSourceFile

***********************************************
** Get name of source file occupying the given address
        ea - linear address
   returns: NULL - source file information is not found
            otherwise returns pointer to file name

string GetSourceFile(long ea);


GetSpDiff

***********************************************
** Get modification of SP made by the instruction
**
        arguments:      ea      - end address of the instruction
                                  i.e.the last address of the instruction+1
        returns:        Get modification of SP made at the specified location
                        If the specified location doesn't contain a SP
                        change point, return 0
                        Otherwise return delta of SP modification

long GetSpDiff(long ea);


GetSpd

***********************************************
** Get current delta for the stack pointer
**
        arguments:      ea      - end address of the instruction
                                  i.e.the last address of the instruction+1
        returns:        The difference between the original SP upon
                        entering the function and SP for
                        the specified address

long GetSpd(long ea);


GetStringType

// Get string type
//      ea - linear address
// Returns one of ASCSTR_... constants

long GetStringType(long ea);

#define ASCSTR_C        0       // C-style ASCII string
#define ASCSTR_PASCAL   1       // Pascal-style ASCII string (length byte)
#define ASCSTR_LEN2     2       // Pascal-style, length is 2 bytes
#define ASCSTR_UNICODE  3       // Unicode string
#define ASCSTR_LEN4     4       // Pascal-style, length is 4 bytes
#define ASCSTR_ULEN2    5       // Pascal-style Unicode, length is 2 bytes
#define ASCSTR_ULEN4    6       // Pascal-style Unicode, length is 4 bytes
#define ASCSTR_LAST     6       // Last string type


GetStrucComment

***********************************************
** get structure type comment
        arguments:      id         - structure type ID
                        repeatable - 1: get repeatable comment
                                     0: get regular comment
        returns:        null string if bad structure type ID is passed
                        otherwise returns comment.

string GetStrucComment(long id,long repeatable);


GetStrucId

***********************************************
** get structure ID by structure index
        arguments:      structure index
        returns:        -1 if bad structure index is passed
                        otherwise returns structure ID.
                        See GetFirstStrucIdx() for the explanation of
                        structure indices and IDs.

long GetStrucId(long index);


GetStrucIdByName

***********************************************
** get structure ID by structure name
        arguments:      structure type name
        returns:        -1 if bad structure type name is passed
                        otherwise returns structure ID.

long GetStrucIdByName(string name);


GetStrucIdx

***********************************************
** get structure index by structure ID
        arguments:      structure ID
        returns:        -1 if bad structure ID is passed
                        otherwise returns structure index.
                        See GetFirstStrucIdx() for the explanation of
                        structure indices and IDs.

long GetStrucIdx(long id);


GetStrucName

***********************************************
** get structure type name
        arguments:      structure type ID
        returns:        -1 if bad structure type ID is passed
                        otherwise returns structure type name.

string GetStrucName(long id);


GetStrucNextOff

***********************************************
** get next offset in a structure
        arguments:      id     - structure type ID
                        offset - current offset
        returns:        -1 if bad structure type ID is passed
                           or no (more) offsets in the structure
                        otherwise returns next offset in a structure.
                        NOTE: IDA allows 'holes' between members of a
                              structure. It treats these 'holes'
                              as unnamed arrays of bytes.
                        This function returns a member offset or a hole offset.
                        It will return size of the structure if input
                        'offset' belongs to the last member of the structure.

long GetStrucNextOff(long id,long offset);


GetStrucPrevOff

***********************************************
** get previous offset in a structure
        arguments:      id     - structure type ID
                        offset - current offset
        returns:        -1 if bad structure type ID is passed
                           or no (more) offsets in the structure
                        otherwise returns previous offset in a structure.
                        NOTE: IDA allows 'holes' between members of a
                              structure. It treats these 'holes'
                              as unnamed arrays of bytes.
                        This function returns a member offset or a hole offset.
                        It will return size of the structure if input
                        'offset' is bigger than the structure size.

long GetStrucPrevOff(long id,long offset);


GetStrucQty

***********************************************
** get number of defined structure types
        arguments:      none
        returns:        number of structure types

long GetStrucQty(void);


GetStrucSize

***********************************************
** get size of a structure
        arguments:      id         - structure type ID
        returns:        -1 if bad structure type ID is passed
                        otherwise returns size of structure in bytes.

long GetStrucSize(long id);


GetTrueName

// Get true name of program byte
// This function returns name of byte as is without any replacements.
//      from - the referring address.
//             Allows to retrieve local label addresses in functions.
//             If a local name is not found, then a global name is returned.
//      ea   - linear address
// returns: "" - byte has no name

string    GetTrueName     (long ea);
string    GetTrueNameEx   (long from, long ea);


GetType

** Get type of function/variable
        ea - the address of the object
   returns: C declaration type string, or 0 - failed

string GetType(long ea);


GetnEnum

***********************************************
** get ID of the specified enum by its serial number
        arguments:      idx - number of enum (0..GetEnumQty()-1)
        returns:        ID of enum or -1 if error

long GetnEnum(long idx);


GetXML

***********************************************
** get one XML value.
        arguments: path - XPath expression to an element
                          or attribute whose value is
                          requested
        returns:   the value, "" if failed

string or long GetXML(string path);


GuessType

// ***********************************************
// ** Guess type of function/variable
//         ea - the address of the object.
//              can be the structure member id too
//    returns: type string, 0 - failed

string GuessType(long ea);


IsBitfield

success IsBitfield(long enum_id);


IsUnion

***********************************************
** is a structure a union?
        arguments:      id            - structure type ID
        returns:        1: yes, this is a union id
                        0: no

                        Unions are a special kind of structures

long IsUnion(long id);


ItemEnd

// Get address of the end of the item (instruction or data)
//      ea - linear address
// returns: address past end of the item at 'ea'

long    ItemEnd         (long ea);              // returns address past end of
                                                // the item


ItemSize

// Get size of instruction or data item in bytes
//      ea - linear address
// returns: 1..n

long    ItemSize        (long ea);              // returns item size, min answer=1


Jump

// Move cursor to the specifed linear address
//      ea - linear address

success Jump            (long ea);              // move cursor to ea
                                                // screen is refreshed at
                                                // the end of IDC execution


LineA

// Get anterior line
//      ea - linear address
//      num - number of anterior line (0..100)

string  LineA           (long ea,long num);     // get additional line before generated ones


LineB

// Get posterior line
//      ea - linear address
//      num - number of posterior line (0..100)

string  LineB           (long ea,long num);     // get additional line after generated ones


LoadTil

** Load a type library
        name - name of type library.
   returns: 1-ok, 0-failed.

success LoadTil(string name);


LocByName

// Get linear address of a name
//      from - the referring address.
//             Allows to retrieve local label addresses in functions.
//             If a local name is not found, then address of a global name is returned.
//      name - name of program byte
// returns: address of the name
//          BADADDR - no such name

long    LocByName       (string name);
long    LocByNameEx     (long from, string name);


MK_FP

// Return value of expression: ((seg<<4) + off)

long    MK_FP           (long seg,long off);    // the same as [ seg, off ]
                                                // i.e: ((seg<<4)+off)


MakeAlign

// Convert the current item to an alignment directive
//      ea      - linear address
//      count   - number of bytes to convert
//      align   - 0 or 1..32
//                if it is 0, the correct alignment will be calculated
//                by the kernel
// returns: 1-ok, 0-failure

success MakeAlign       (long ea,long count,long align);


MakeArray

// Create an array.
//      ea      - linear address
//      nitems  - size of array in items
// This function will create an array of the items with the same type as the
// type of the item at 'ea'. If the byte at 'ea' is undefined, then this
// function will create an array of bytes.

success MakeArray       (long ea,long nitems);  // convert to an array


MakeByte

// Convert the current item to a byte
//      ea - linear address
// returns: 1-ok, 0-failure

success MakeByte        (long ea);              // convert to byte


MakeCode

// Create an instruction at the specified address
//      ea - linear address
// returns: 0 - can't create an instruction (no such opcode, the instruction would
//              overlap with existing items, etc)
//          otherwise returns length of the instruction in bytes

long    MakeCode        (long ea);              // convert to instruction
                                                // returns number of bytes
                                                // occupied by the instruction


MakeComm

// Set an indented regular comment of an item
//      ea      - linear address
//      comment - comment string

success MakeComm        (long ea,string comment);       // give a comment


MakeDouble

// Convert the current item to a double floating point (8 bytes)
//      ea - linear address
// returns: 1-ok, 0-failure

success MakeDouble      (long ea);              // convert to double


MakeDword

// Convert the current item to a double word (4 bytes)
//      ea - linear address
// returns: 1-ok, 0-failure

success MakeDword       (long ea);              // convert to double-word


MakeFloat

// Convert the current item to a floating point (4 bytes)
//      ea - linear address
// returns: 1-ok, 0-failure

success MakeFloat       (long ea);              // convert to float


MakeFrame

***********************************************
** Make function frame
**
        arguments:      ea      - any address belonging to the function
                        lvsize  - size of function local variables
                        frregs  - size of saved registers
                        argsize - size of function arguments
        returns:        ID of function frame or -1
                        If the function did not have a frame, the frame
                        will be created. Otherwise the frame will be
                        modified

long MakeFrame(long ea,long lvsize,long frregs,long argsize);


MakeFunction

***********************************************
** create a function
        arguments:      start,end - function bounds
                        If the function end address is BADADDR, then
                        IDA will try to determine the function bounds
                        automatically. IDA will define all necessary
                        instructions to determine the function bounds.
        returns:        !=0 - ok
        note:           an instruction should be present at the start address

success MakeFunction(long start,long end);


MakeLocal

// Create a local variable
//      start,end - range of addresses for the local variable.
//                  For the stack variables the end address is ignored.
//                  If there is no function at 'start' then this function.
//                  will fail.
//      location  - the variable location in the "[bp+xx]" form where xx is
//                  a number. The location can also be specified as a register name.
//      name      - name of the local variable
// returns: 1-ok, 0-failure

success MakeLocal(long start,long end,string location,string name);


MakeNameEx

// Rename an address
//      ea - linear address
//      name - new name of address. If name == "", then delete old name
//      flags - combination of SN_... constants
// returns: 1-ok, 0-failure

success MakeNameEx      (long ea,string name,long flags);

#define SN_CHECK        0x01    // Fail if the name contains invalid characters
                                // If this bit is clear, all invalid chars
                                // (those !is_ident_char()) will be replaced
                                // by SubstChar (usually '_')
                                // List of valid characters is defined in ida.cfg
#define SN_NOCHECK      0x00    // Replace invalid chars with SubstChar
#define SN_PUBLIC       0x02    // if set, make name public
#define SN_NON_PUBLIC   0x04    // if set, make name non-public
#define SN_WEAK         0x08    // if set, make name weak
#define SN_NON_WEAK     0x10    // if set, make name non-weak
#define SN_AUTO         0x20    // if set, make name autogenerated
#define SN_NON_AUTO     0x40    // if set, make name non-autogenerated
#define SN_NOLIST       0x80    // if set, exclude name from the list
                                // if not set, then include the name into
                                // the list (however, if other bits are set,
                                // the name might be immediately excluded
                                // from the list)
#define SN_NOWARN       0x100   // don't display a warning if failed
#define SN_LOCAL        0x200   // create local name. a function should exist.
                                // local names can't be public or weak.
                                // also they are not included into the list of names
                                // they can't have dummy prefixes


MakeOword

// Convert the current item to a octa word (16 bytes)
//      ea - linear address
// returns: 1-ok, 0-failure

success MakeOword       (long ea);              // convert to octa-word


MakePackReal

// Convert the current item to a packed real (10 or 12 bytes)
//      ea - linear address
// returns: 1-ok, 0-failure

success MakePackReal    (long ea);              // convert to packed real


MakeQword

// Convert the current item to a quadro word (8 bytes)
//      ea - linear address
// returns: 1-ok, 0-failure

success MakeQword       (long ea);              // convert to quadro-word


MakeRptCmt

// Set an indented repeatable comment of an item
//      ea      - linear address
//      comment - comment string

success MakeRptCmt      (long ea,string comment);       // give a repeatable comment


MakeStr

// Create a string.
// This function creates a string (the string type is determined by the value
// of GetLongPrm(INF_STRTYPE))
//      ea - linear address
//      endea - ending address of the string (excluded)
//              if endea == BADADDR, then length of string will be calculated
//              by the kernel
// returns: 1-ok, 0-failure
// note: the type of an existing string is returned by GetStringType()

success MakeStr         (long ea,long endea);   // convert to ASCII string


MakeStructEx

// Convert the current item to a structure instance
//      ea      - linear address
//      size    - structure size in bytes. -1 means that the size
//                will be calculated automatically
//      strname - name of a structure type
// returns: 1-ok, 0-failure

success MakeStructEx    (long ea,long size, string strname);


MakeTbyte

// Convert the current item to a tbyte (10 or 12 bytes)
//      ea - linear address
// returns: 1-ok, 0-failure

success MakeTbyte       (long ea);              // convert to 10 bytes (tbyte)


MakeUnkn

// Convert the current item to an explored item
//      ea     - linear address
//      expand - 0: just undefine the current item
//               1: undefine other instructions if the removal of the
//                  current instruction removes all references to them.
//                  (note: functions will not be undefined even if they
//                         have no references to them)

void    MakeUnkn        (long ea,long expand);  // convert to 'unknown'
                                                // expand!=0 => undefine consequent
                                                // instructions too


MakeVar

// Mark the location as "variable"
// Note: All that IDA does is to mark the location as "variable". Nothing else,
// no additional analysis is performed.
// This function may disappear in the future.

void    MakeVar         (long ea);              // the location is 'variable'


MakeWord

// Convert the current item to a word (2 bytes)
//      ea - linear address
// returns: 1-ok, 0-failure

success MakeWord        (long ea);              // convert to word


MarkPosition

***********************************************
** mark position
        arguments:      ea      - address to mark
                        lnnum   - number of generated line for the 'ea'
                        x       - x coordinate of cursor
                        y       - y coordinate of cursor
                        slot    - slot number: 1..32
                                  if the specifed value is not within the
                                  range, IDA will ask the user to select slot.
                        comment - description of the mark.
                                  Should be not empty.
        returns:        none

void MarkPosition(long ea,long lnnum,long x,long y,long slot,string comment);


Name

// Get visible name of program byte
// This function returns name of byte as it is displayed on the screen.
// If a name contains illegal characters, IDA replaces them by the substitution
// character during displaying. See IDA.CFG for the definition of the
// substitution character.
//      from - the referring address.
//             Allows to retrieve local label addresses in functions.
//             If a local name is not found, then a global name is returned.
//      ea   - linear address
// returns: "" - byte has no name

string    Name            (long ea);
string    NameEx          (long from, long ea);


NextAddr

// Get next addresss in the program
//      ea - linear address
// returns: BADADDR - the specified address in the last used address

long    NextAddr        (long ea);              // returns next defined address
                                                // BADADDR if no such address exists


NextFunction

***********************************************
** find next function
        arguments:      ea - any address belonging to the function
        returns:        -1 - no more functions
                        otherwise returns the next function start address

long NextFunction(long ea);


NextHead

// Get next defined item (instruction or data) in the program
//      ea    - linear address to start search from
//      maxea - the search will stop at the address
//              maxea is not included in the search range
// returns: BADADDR - no (more) defined items

long    NextHead        (long ea, long maxea);  // returns next defined item address
                                                // BADADDR if no such address exists


NextNotTail

// Get next not-tail address in the program
// This function searches for the next displayable address in the program.
// The tail bytes of instructions and data are not displayable.
//      ea - linear address
// returns: BADADDR - no (more) not-tail addresses

long    NextNotTail     (long ea);              // returns next not tail address
                                                // BADADDR if no such address exists


NextSeg

// Get next segment
//      ea - linear address
// returns: start of the next segment
//          BADADDR - no next segment

long    NextSeg         (long ea);      // returns start of the next
                                        // segment, BADADDR - no more segs


OpAlt

// Specify operand represenation manually.
// (for the explanations of 'ea' and 'n' please see OpBinary())
//      str - a string represenation of the operand
// IDA will not check the specified operand, it will simply display
// it instead of the orginal representation of the operand.

success OpAlt           (long ea,long n,string str);// manually enter n-th operand


OpBinary

// Convert an operand of the item (instruction or data) to a binary number
//      ea - linear address
/       n  - number of operand
//              0 - the first operand
//              1 - the second, third and all other operands
//              -1 - all operands
// Note: the data items use only the type of the first operand
// Returns: 1-ok, 0-failure

success OpBinary        (long ea,int n);        // make operand binary
                                                // n=0 - first operand
                                                // n=1 - second, third etc. operands
                                                // n=-1 - all operands

// Convert an operand of the item (instruction or data) to an octal number
// (see explanation of OpBinary functions)

success OpOctal         (long ea,int n);

// Convert operand to decimal,hex,char (see OpBinary() for explanations)

success OpDecimal       (long ea,int n);
success OpHex           (long ea,int n);
success OpChr           (long ea,int n);


OpEnumEx

// Convert operand to a symbolic constant
// (for the explanations of 'ea' and 'n' please see OpBinary())
//      enumid - id of enumeration type
//      serial - serial number of the constant in the enumeration
//               The serial numbers are used if there are more than
//               one symbolic constant with the same value in the
//               enumeration. In this case the first defined constant
//               get the serial number 0, then second 1, etc.
//               There could be 256 symbolic constants with the same
//               value in the enumeration.

success OpEnumEx(long ea,int n,long enumid,long serial);


OpHigh

// Convert operand to a high offset
// High offset is the upper 16bits of an offset.
// This type is used by TMS320C6 processors (and probably by other
// RISC processors too)
// (for the explanations of 'ea' and 'n' please see OpBinary())
//      target - the full value (all 32bits) of the offset

success OpHigh          (long ea,int n,long target);


OpNot

// Toggle the bitwise not operator for the operand
// (for the explanations of 'ea' and 'n' please see OpBinary())

success OpNot           (long ea,int n);


OpNumber

// Convert operand to a number (with default number base, radix)
// (for the explanations of 'ea' and 'n' please see OpBinary())

success OpNumber        (long ea,int n);


OpOff

// Convert operand to an offset
// (for the explanations of 'ea' and 'n' please see OpBinary())
//      base - base of the offset as a linear address
//             If base == BADADDR then the current operand becomes non-offset
// Example:
//  seg000:2000 dw      1234h
// and there is a segment at paragraph 0x1000 and there is a data item
// within the segment at 0x1234:
//  seg000:1234 MyString        db 'Hello, world!',0
// Then you need to specify a linear address of the segment base to
// create a proper offset:
//      OpOffset(["seg000",0x2000],0,0x10000);
// and you will have:
//  seg000:2000 dw      offset MyString
// Motorola 680x0 processor have a concept of "outer offsets".
// If you want to create an outer offset, you need to combine number
// of the operand with the following bit:
#define OPND_OUTER      0x80                    // outer offset base
// Please note that the outer offsets are meaningful only for
// Motorla 680x0.

success OpOff           (long ea,int n,long base);


OpOffEx

// Convert operand to a complex offset expression
// This is a more powerful version of OpOff() function.
// It allows to explicitly specify the reference type (off8,off16, etc)
// and the expression target with a possible target delta.
// The complex expressions are represented by IDA in the following form:
//
//         target + tdelta - base
//
// If the target is not present, then it will be calculated using
//         target = operand_value - tdelta + base
// The target must be present for LOW.. and HIGH.. reference types
//      ea      - linear address of the instruction/data
//      n       - number of operand to convert (the same as in OpOff)
//      reftype - one of REF_... constants
//      target  - an explicitly specified expression target. if you don't
//                want to specify it, use -1. Please note that LOW... and
//                HIGH... reference type requre the target.
//      base    - the offset base (a linear address)
//      tdelta  - a displacement from the target which will be displayed
//                in the expression.

success OpOffEx(long ea,int n,long reftype,long target,long base,long tdelta);

#define REF_OFF8    0 // 8bit full offset
#define REF_OFF16   1 // 16bit full offset
#define REF_OFF32   2 // 32bit full offset
#define REF_LOW8    3 // low 8bits of 16bit offset
#define REF_LOW16   4 // low 16bits of 32bit offset
#define REF_HIGH8   5 // high 8bits of 16bit offset
#define REF_HIGH16  6 // high 16bits of 32bit offset


OpSeg

// Convert operand to a segment expression
// (for the explanations of 'ea' and 'n' please see OpBinary())

success OpSeg           (long ea,int n);


OpSign

// Change sign of the operand.
// (for the explanations of 'ea' and 'n' please see OpBinary())

success OpSign          (long ea,int n);        // change operand sign


OpStkvar

// Convert operand to a stack variable
// (for the explanations of 'ea' and 'n' please see OpBinary())

success OpStkvar        (long ea,int n);        // make operand a stack variable


OpStroff

// Convert operand to an offset in a structure
// (for the explanations of 'ea' and 'n' please see OpBinary())
//      strid - id of a structure type
//      delta - struct offset delta. usually 0. denotes the difference
//              between the structure base and the pointer into the structure.

success OpStroffEx      (long ea,int n,long strid, long delta); // make operand a struct offset


PatchByte

// Change value of a program byte
//      ea    - linear address
//      value - new value of the byte

void    PatchByte       (long ea,long value);   // change a byte


PatchDword

// Change value of a double word
//      ea    - linear address
//      value - new value of the double word

void    PatchDword      (long ea,long value);   // change a dword (4 bytes)


PatchWord

// Change value of a program word (2 bytes)
//      ea    - linear address
//      value - new value of the word

void    PatchWord       (long ea,long value);   // change a word (2 bytes)


PopXML

***********************************************
** pop the uppermost XML element.
        arguments: none.
        returns:   1-ok, 0-failed

success PopXML();


PrevAddr

// Get previous addresss in the program
//      ea - linear address
// returns: BADADDR - the specified address in the first address

long    PrevAddr        (long ea);              // returns prev defined address
                                                // BADADDR if no such address exists


PrevFunction

***********************************************
** find previous function
        arguments:      ea - any address belonging to the function
        returns:        -1 - no more functions
                        otherwise returns the previous function start address

long PrevFunction(long ea)


PrevHead

// Get previous defined item (instruction or data) in the program
//      ea    - linear address to start search from
//      minea - the search will stop at the address
//              minea is included in the search range
// returns: BADADDR - no (more) defined items

long    PrevHead        (long ea, long minea);  // returns prev defined item address
                                                // BADADDR if no such address exists


PrevNotTail

// Get previous not-tail address in the program
// This function searches for the previous displayable address in the program.
// The tail bytes of instructions and data are not displayable.
//      ea - linear address
// returns: BADADDR - no (more) not-tail addresses

long    PrevNotTail     (long ea);              // returns prev not tail address
                                                // BADADDR if no such address exists


PushXML

***********************************************
** push an XML element.
        arguments: path - element to push on the XPath stack.
        returns:   1-ok, 0-failed

success PushXML(string path);


RenameArray

***********************************************
** rename array
        arguments:      id      - array id returned by CreateArray() or
                                  GetArrayId()
                        newname - new name of array. There are no
                                  restrictions on the name (its length should
                                  be less than 120 characters, though)
        returns:        1-ok, 0-failed

success RenameArray(long id,string newname);


RenameEntryPoint

***********************************************
** rename entry point
        arguments:      ordinal - entry point number
                        name    - new name
        returns:        !=0 - ok

success RenameEntryPoint(long ordinal,string name);


RptCmt

// Get repeatable indented comment
//      ea - linear address

string  RptCmt          (long ea);              // get repeatable comment


RunPlugin

// Load and run a plugin
// The plugin name is a short plugin name without an extension
// returns: 0 if could not load the plugin, 1 if ok

success RunPlugin(string name, long arg);


ScreenEA

// Get linear address of cursor

long    ScreenEA        ();                     // the current screen ea


SegAddrng

// Change segment addressing
//   ea      - any address in the segment
//   use32   - 0: 16bit, 1: 32bit, 2: 64bit

success SegAddrng       (long ea,long use32);


SegAlign

// Change alignment of the segment
//   ea      - any address in the segment
//   align   - new alignment of the segment

success SegAlign        (long ea,long alignment);

#define saAbs      0    // Absolute segment.
#define saRelByte  1    // Relocatable, byte aligned.
#define saRelWord  2    // Relocatable, word (2-byte, 16-bit) aligned.
#define saRelPara  3    // Relocatable, paragraph (16-byte) aligned.
#define saRelPage  4    // Relocatable, aligned on 256-byte boundary (a "page"
                        // in the original Intel specification).
#define saRelDble  5    // Relocatable, aligned on a double word (4-byte)
                        // boundary. This value is used by the PharLap OMF for
                        // the same alignment.
#define saRel4K    6    // This value is used by the PharLap OMF for page (4K)
                        // alignment. It is not supported by LINK.
#define saGroup    7    // Segment group
#define saRel32Bytes 8  // 32 bytes
#define saRel64Bytes 9  // 64 bytes
#define saRelQword 10   // 8 bytes


SegBounds

// Change segment boundaries
//   ea      - any address in the segment
//   startea - new start address of the segment
//   endea   - new end address of the segment
//   disable - discard bytes that go out of the segment

success SegBounds       (long ea,long startea,long endea,long disable);


SegByBase

// Get segment by segment base
//      base - segment base paragraph or selector
// returns: linear address of the start of the segment
//          BADADDR - no such segment

long    SegByBase       (long base);            // BADADDR - no such segment


SegByName

// Get segment by name
//      segname - name of segment
// returns: segment selector or BADSEL

long    SegByName       (string segname);


SegClass

// Change class of the segment
//   ea      - any address in the segment
//   class   - new class of the segment

success SegClass        (long ea,string class);


SegComb

// Change combination of the segment
//   ea      - any address in the segment
//   comb    - new combination of the segment

success SegComb         (long segea,long comb);

#define scPriv     0    // Private. Do not combine with any other program
                        // segment.
#define scPub      2    // Public. Combine by appending at an offset that meets
                        // the alignment requirement.
#define scPub2     4    // As defined by Microsoft, same as C=2 (public).
#define scStack    5    // Stack. Combine as for C=2. This combine type forces
                        // byte alignment.
#define scCommon   6    // Common. Combine by overlay using maximum size.
#define scPub3     7    // As defined by Microsoft, same as C=2 (public).


SegCreate

// Create a new segment
//      startea  - linear address of the start of the segment
//      endea    - linear address of the end of the segment
//                 this address will not belong to the segment
//                 'endea' should be higher than 'startea'
//      base     - base paragraph or selector of the segment.
//                 a paragraph is 16byte memory chunk.
//                 If a selector value is specified, the selector should be
//                 already defined.
//      use32    - 0: 16bit segment, 1: 32bit segment, 2: 64bit segment
//      align    - segment alignment. see below for alignment values
//      comb     - segment combination. see below for combination values.
// returns: 0-failed, 1-ok

success SegCreate(long startea,long endea,long base,
                                           long use32,long align,long comb);


SegDefReg

// Set default segment register value for a segment
//   ea      - any address in the segment
//             if no segment is present at the specified address
//             then all segments will be affected
//   reg     - name of segment register
//   value   - default value of segment register. -1-undefined.

success SegDefReg       (long ea,string reg,long value);


SegDelete

// Delete a segment
//   ea      - any address in the segment
//   disable - 1: discard all bytes of the segment from the disassembled text
//             0: retain byte values

success SegDelete       (long ea,long disable);


SegEnd

// Get end address of a segment
//      ea - any address in the segment
// returns: end of segment (an address past end of the segment)
//          BADADDR - the specified address doesn't belong to any segment

long    SegEnd          (long ea);      // return end of the segment
                                        // this address doesn't belong
                                        // to the segment
                                        // BADADDR if bad address passed


SegName

// Get name of a segment
//      ea - any address in the segment
// returns: "" - no segment at the specified address

string  SegName         (long ea);              // returns name of the segment
                                                // "" if bad address passed


SegRename

// Change name of the segment
//   ea      - any address in the segment
//   name    - new name of the segment

success SegRename       (long ea,string name);


SegStart

// Get start address of a segment
//      ea - any address in the segment
// returns: start of segment
//          BADADDR - the specified address doesn't belong to any segment

long    SegStart        (long ea);      // returns start of the segment
                                        // BADADDR if bad address passed


SelEnd

// Get end address of the selected area
// returns BADADDR - the user has not selected an area

long    SelEnd          ();                     // the selected area end ea
                                                // BADADDR - no selected area


SelStart

// Get start address of the selected area
// returns BADADDR - the user has not selected an area

long    SelStart        ();                     // the selected area start ea
                                                // BADADDR - no selected area


SetArrayLong

***********************************************
** set 32bit value of array element
        arguments:      id      - array id
                        idx     - index of an element
                        value   - 32bit value to store in the array
        returns:        1-ok, 0-failed

success SetArrayLong(long id,long idx,long value);


SetArrayString

***********************************************
** set string value of array element
        arguments:      id      - array id
                        idx     - index of an element
                        str     - string to store in array element
        returns:        1-ok, 0-failed

success SetArrayString(long id,long idx,string str);


SetBmaskCmt

***********************************************
** set bitmask comment (only for bitfields)
        arguments:      enum_id - id of enum
                        bmask   - bitmask of the constant
                        cmt     - comment
                        repeatable - type of comment, 0-regular, 1-repeatable
        returns:        1-ok, 0-failed

long SetBmaskCmt(long enum_id,long bmask,string cmt,long repeatable);


SetBmaskName

***********************************************
** set bitmask name (only for bitfields)
        arguments:      enum_id - id of enum
                        bmask   - bitmask of the constant
                        name    - name of bitmask
        returns:        1-ok, 0-failed

success SetBmaskName(long enum_id,long bmask,string name);


SetColor

// ***********************************************
// ** set item color
//    arguments:
//         ea - address of the item
//         what - type of the item (one of CIC_... constants)
//         color - new color code in RGB (hex 0xBBGGRR)
//    returns: 1-ok, 0-failure

success SetColor(long ea, long what, long color);

#define CIC_ITEM 1          // one instruction or data
#define CIC_FUNC 2          // function
#define CIC_SEGM 3          // segment

#define DEFCOLOR 0xFFFFFFFF     // Default color


SetConstCmt

***********************************************
** set a comment of a symbolic constant
        arguments:      const_id - id of const
                        cmt     - new comment for the constant
                        repeatable - 0:set regular comment
                                     1:set repeatable comment
        returns:        1-ok,0-failed

success SetConstCmt(long const_id,string cmt,long repeatable);


SetConstName

***********************************************
** rename a member of enum - a symbolic constant
        arguments:      const_id - id of const
                        name     - new name of constant
        returns:        1-ok,0-failed

success SetConstName(long const_id,string name);


SetEnumBf

success SetEnumBf(long enum_id,long flag);


SetEnumCmt

***********************************************
** set comment of enum
        arguments:      enum_id - id of enum
                        cmt     - new comment for the enum
                        repeatable - 0:set regular comment
                                     1:set repeatable comment
        returns:        1-ok,0-failed

success SetEnumCmt(long enum_id,string cmt,long repeatable);


SetEnumFlag

***********************************************
** set flag of enum
        arguments:      enum_id - id of enum
                        flag - flags for representation of numeric constants
                               in the definition of enum.
        returns:        1-ok,0-failed

success SetEnumFlag(long enum_id,long flag);


SetEnumIdx

***********************************************
** give another serial number to a enum
        arguments:      enum_id - id of enum
                        idx     - new serial number.
                              If another enum with the same serial number
                              exists, then all enums with serial
                              numbers >= the specified idx get their
                              serial numbers incremented (in other words,
                              the new enum is put in the middle of the list
                              of enums).
                              If idx >= GetEnumQty() then the enum is
                              moved to the end of the list of enums.
        returns:        comment string

success SetEnumIdx(long enum_id,long idx);


SetEnumName

***********************************************
** rename enum
        arguments:      enum_id - id of enum
                        name    - new name of enum
        returns:        1-ok,0-failed

success SetEnumName(long enum_id,string name);


SetFixup

***********************************************
** set fixup information
        arguments:      ea        - address to set fixup information about
                        type      - fixup type. see GetFixupTgtType()
                                    for possible fixup types.
                        targetsel - target selector
                        targetoff - target offset
                        displ     - displacement
        returns:        none

void SetFixup(long ea,long type,long targetsel,long targetoff,long displ);


SetFlags

// Set new value of flags
// This function should not used be used directly if possible.
// It changes properties of a program byte and if misused, may lead to
// very-very strange results.

void    SetFlags        (long ea,long flags);   // change internal flags for ea


SetFunctionAttr

// ***********************************************
// ** set a function attribute
//         arguments:      ea - any address belonging to the function
//                         attr - one of FUNCATTR_... constants
//                         value - new value of the attribute
//         returns:        1-ok, 0-failed

success SetFunctionAttr(long ea, long attr, long value);

 FUNCATTR_FLAGS   -- function flags
 FUNCATTR_COLOR   -- function color code


SetFunctionCmt

***********************************************
** set function comment
        arguments:      ea - any address belonging to the function
                        cmt - a function comment line
                        repeatable - 1: get repeatable comment
                                     0: get regular comment

void SetFunctionCmt(long ea, string cmt, long repeatable);


SetFunctionEnd

***********************************************
** change function end address
        arguments:      ea - any address belonging to the function
                        end - new function end address
        returns:        !=0 - ok

success SetFunctionEnd(long ea,long end);


SetFunctionFlags

***********************************************
** change function flags
        arguments:      ea - any address belonging to the function
                        flags - see GetFunctionFlags() for explanations
        returns:        !=0 - ok

success SetFunctionFlags(long ea,long flags);


SetManualInsn

// Specify instruction represenation manually.
//      ea   - linear address
//      insn - a string represenation of the operand
// IDA will not check the specified instruction, it will simply display
// it instead of the orginal representation.

void   SetManualInsn   (long ea, string insn);


SetLineNumber

***********************************************
** set source line number
        arguments:      ea      - linear address
                        lnnum   - number of line in the source file
        returns:        nothing

void SetLineNumber(long ea,long lnnum);


SetMemberComment

***********************************************
** change structure member comment
        arguments:      id      - structure type ID
                        member_offset - offset of the member
                        comment - new comment of the structure member
                        repeatable - 1: change repeatable comment
                                     0: change regular comment
        returns:        !=0 - ok

long SetMemberComment(long id,long member_offset,string comment,long repeatable);


SetMemberName

***********************************************
** change structure member name
        arguments:      id            - structure type ID
                        member_offset - offset of the member
                        name          - new name of the member
        returns:        !=0 - ok.

long SetMemberName(long id,long member_offset,string name);


SetMemberType

***********************************************
** change structure member type
        arguments:      id            - structure type ID
                        member_offset - offset of the member
                        flag    - new type of the member. Should be one of
                                  FF_BYTE..FF_PACKREAL (see above)
                                  combined with FF_DATA
                        typeid  - structure id if 'flag' == FF_STRU
                                  Denotes type of the member is the member
                                  itself is a structure. Otherwise should be
                                  -1.
                                  if isOff0(flag) then typeid specifies
                                  the offset base.
                                  if isASCII(flag) then typeid specifies
                                  the string type (ASCSTR_...).
                        nitems  - number of items in the member
        returns:        !=0 - ok.

long SetMemberType(long id,long member_offset,long flag,long typeid,long nitems);


SetProcessorType

// Change current processor
//      processor - name of processor in short form.
//                  run 'ida ?' to get list of allowed processor types
//      level     - the power of request:
//        SETPROC_COMPAT - search for the processor type in the current module
//        SETPROC_ALL    - search for the processor type in all modules
//                         only if there were not calls with SETPROC_USER
//        SETPROC_USER   - search for the processor type in all modules
//                         and prohibit level SETPROC_USER
//        SETPROC_FATAL  - can be combined with previous bits.
//                         means that if the processor type can't be
//                         set, IDA should display an error message and exit.

success SetProcessorType(string processor, long level); // set processor type


SetReg

// Set value of a segment register.
//      ea - linear address
//      reg - name of a register, like "cs", "ds", "es", etc.
//      value - new value of the segment register.
// IDA keeps tracks of all the points where segment register change their
// values. This function allows you to specify the correct value of a segment
// register if IDA is not able to find the corrent value.

success SetReg          (long ea,string reg,long value); // set value of segment register


SetRegValue

// ***********************************************
// ** set register value
//    arguments:
//         name - the register name
//         value - new register value
//    the debugger should be running
//    It is not necessary to use this function to set register values.
//    A register name in the left side of an assignment will do too.

success SetRegValue(number value, string name);


SetSegmentAttr

***********************************************
** set segment attribute
        arguments:      segea - any address within segment
                        attr  - one of SEGATTR_... constants
                        value - the new value of the attribute

success GetSegmentAttr(long segea, long attr, long value);

  SEGATTR_ALIGN          alignment
  SEGATTR_COMB           combination
  SEGATTR_PERM           permissions
  SEGATTR_FLAGS          segment flags
  SEGATTR_SEL            segment selector
  SEGATTR_ES             default ES value
  SEGATTR_CS             default CS value
  SEGATTR_SS             default SS value
  SEGATTR_DS             default DS value
  SEGATTR_FS             default FS value
  SEGATTR_GS             default GS value
  SEGATTR_TYPE           segment type
  SEGATTR_COLOR          segment color


SetSegmentType

***********************************************
** set segment type
        arguments:      segea - any address within segment
                        type  - new segment type:
#define SEG_NORM        0
#define SEG_XTRN        1       // * segment with 'extern' definitions
                                //   no instructions are allowed
#define SEG_CODE        2       // pure code segment
#define SEG_DATA        3       // pure data segment
#define SEG_IMP         4       // implementation segment
#define SEG_GRP         6       // * group of segments
                                //   no instructions are allowed
#define SEG_NULL        7       // zero-length segment
#define SEG_UNDF        8       // undefined segment type
#define SEG_BSS         9       // uninitialized segment
#define SEG_ABSSYM     10       // * segment with definitions of absolute symbols
                                //   no instructions are allowed
#define SEG_COMM       11       // * segment with communal definitions
                                //   no instructions are allowed

        returns:        !=0 - ok

success SetSegmentType (long segea,long type);


SetSelector

***********************************************
** set a selector value
        arguments:      sel - the selector, should be
                        less than 0xFFFF
                        val - new value of selector
        returns:        nothing
        note:           ida supports up to 4096 selectors.
                        if 'sel' == 'val' then the
                        selector is destroyed because
                        it has no importance

void    SetSelector     (long sel,long value);


SetSpDiff

***********************************************
** Setup modification of SP made by the instruction
**
        arguments:      ea      - end address of the instruction
                                  i.e.the last address of the instruction+1
                        delta   - the difference made by the current
                                  instruction.
        returns:        1-ok, 0-failed

success SetSpDiff(long ea,long delta);


SetStatus

// Change IDA indicator.
// Returns the previous status.

long    SetStatus       (long status);

#define IDA_STATUS_READY    0 // READY     IDA is idle
#define IDA_STATUS_THINKING 1 // THINKING  Analyzing but the user may press keys
#define IDA_STATUS_WAITING  2 // WAITING   Waiting for the user input
#define IDA_STATUS_WORK     3 // BUSY      IDA is busy


SetStrucComment

***********************************************
** change structure comment
        arguments:      id      - structure type ID
                        comment - new comment of the structure
                        repeatable - 1: change repeatable comment
                                     0: change regular comment
        returns:        !=0 - ok

long SetStrucComment(long id,string comment,long repeatable);


SetStrucIdx

***********************************************
** change structure index
        arguments:      id      - structure type ID
                        index   - new index of the structure
                        See GetFirstStrucIdx() for the explanation of
                        structure indices and IDs.
        returns:        !=0 - ok

long SetStrucIdx(long id,long index);


SetStrucName

***********************************************
** change structure name
        arguments:      id      - structure type ID
                        name    - new name of the structure
        returns:        !=0 - ok

long SetStrucName(long id,string name);


SetType

** Set type of function/variable
        ea   - the address of the object
        type - the type string in C declaration form.
               must contain the closing ';'
   returns: 1-ok, 0-failed.

success SetType(long ea, string type);


SetXML

***********************************************
** set or update one or more XML values.
        arguments: path  - XPath expression of elements
                           where to create value(s)
                   name  - name of the element/attribute
                           (use @XXX for an attribute) to create.
                           If 'name' is empty, the elements or
                           attributes returned by XPath are directly
                           updated to contain the new 'value'.
                   value - value of the element/attribute
        returns:   1-ok, 0-failed

success SetXML(string path, string name, string value);


Til2Idb

** Copy information from type library to database
   Copy structure, union, or enum definition from the type library
   to the IDA database.
        idx       - the position of the new type in the list of
                    types (structures or enums)
                    -1 means at the end of the list
        type_name - name of type to copy
   returns: BADNODE-failed, otherwise the type id
                (structure id or enum id)

long Til2Idb(long idx, string type_name);


Wait

// Wait for the end of autoanalysis
// This function will suspend execution of IDC program
// till the autoanalysis queue is empty.

void    Wait            ();                     // Process all entries in the
                                                // autoanalysis queue


Word

// Get value of program word (2 bytes)
//      ea - linear address
// returns: the value of the word. If word has no value then returns 0xFFFF
// If the current byte size is different from 8 bits, then the returned value
// might have more 1's.

long    Word            (long ea);              // get a word (2 bytes) at ea


atoa

// Convert address value to a string

string  atoa            (long ea);              // returns address in
                                                // the form 'seg000:1234'
                                                // (the same as in line prefixes)


atol

// Convert ascii string to a number
//      str - a decimal representation of a number
// returns: a binary number

long    atol            (string str);           // convert ascii decimal to long

See also ord() function


byteValue

// Get byte value from flags
// Get value of byte provided that the byte is initialized.
// This macro works ok only for 8-bit byte machines.

#define byteValue(F)    (F & MS_VAL)    // quick replacement for Byte()


fclose

***********************************************
** close a file
        arguments:      file handle
        returns:        nothing

void    fclose          (long handle);


fgetc

***********************************************
** read one byte from file
        arguments:      handle  - file handle
        returns:        -1 - error
                        otherwise a byte read.

long    fgetc           (long handle);


filelength

***********************************************
** get file length
        arguments:      file handle
        returns:        -1 - error
                        otherwise file length in bytes

long    filelength      (long handle);


fopen

***********************************************
** open a file
        arguments: similiar to C fopen()
        returns:        0 -error
                        otherwise a file handle

long    fopen           (string file,string mode);


form

// Return a formatted string.
//      format - printf-style format string.
//               %a - means address expression.
//               floating point values are output only in one format
//                regardless of the character specified (f,e,g,E,G)
//               %p is not supported.
// The resulting string must be less than 255 characters

string form     (string format,...);            // works as sprintf
                                                // The resulting string should
                                                // be less than 255 characters.


fprintf

***********************************************
** fprintf
        arguments:      handle  - file handle
                        format  - format string
        returns:        0 - ok
                        -1 - error

long    fprintf         (long handle,string format,...);


fputc

***********************************************
** write one byte to file
        arguments:      handle  - file handle
                        byte    - byte to write
        returns:        0 - ok
                        -1 - error

long    fputc           (long byte,long handle);


fseek

***********************************************
** set cursor position in the file
        arguments:      handle  - file handle
                        offset  - offset from origin
                        origin  - 0 = from start of file
                                  1 = from current cursor position
                                  2 = from end of file
        returns:        0 - ok
                        otherwise error

long    fseek           (long handle,long offset,long origin);


ftell

***********************************************
** get cursor position in the file
        arguments:      file handle
        returns:        -1 - error
                        otherwise current cursor position

long    ftell           (long handle);


CommonBits

//
//      Common bits
//

#define MS_COMM 0x000FF800L             // Mask of common bits
#define FF_COMM 0x00000800L             // Has comment?
#define FF_REF  0x00001000L             // has references?
#define FF_LINE 0x00002000L             // Has next or prev cmt lines ?
#define FF_NAME 0x00004000L             // Has user-defined name ?
#define FF_LABL 0x00008000L             // Has dummy name?
#define FF_FLOW 0x00010000L             // Exec flow from prev instruction?
#define FF_VAR  0x00080000L             // Is byte variable ?

#define isFlow  (F)     ((F & FF_FLOW) != 0)
#define isVar   (F)     ((F & FF_VAR ) != 0)
#define isExtra (F)     ((F & FF_LINE) != 0)
#define isRef   (F)     ((F & FF_REF)  != 0)
#define hasName (F)     ((F & FF_NAME) != 0)


hasValue

// Do flags contain byte value? (i.e. has the byte a value?)
// if not, the byte is uninitialized.

#define hasValue(F)     ((F & FF_IVL) != 0)     // any defined value?


OpTypes

#define MS_0TYPE 0x00F00000L            // Mask for 1st arg typing
#define FF_0VOID 0x00000000L            // Void (unknown)?
#define FF_0NUMH 0x00100000L            // Hexadecimal number?
#define FF_0NUMD 0x00200000L            // Decimal number?
#define FF_0CHAR 0x00300000L            // Char ('x')?
#define FF_0SEG  0x00400000L            // Segment?
#define FF_0OFF  0x00500000L            // Offset?
#define FF_0NUMB 0x00600000L            // Binary number?
#define FF_0NUMO 0x00700000L            // Octal number?
#define FF_0ENUM 0x00800000L            // Enumeration?
#define FF_0FOP  0x00900000L            // Forced operand?
#define FF_0STRO 0x00A00000L            // Struct offset?
#define FF_0STK  0x00B00000L            // Stack variable?

#define MS_1TYPE 0x0F000000L            // Mask for 2nd arg typing
#define FF_1VOID 0x00000000L            // Void (unknown)?
#define FF_1NUMH 0x01000000L            // Hexadecimal number?
#define FF_1NUMD 0x02000000L            // Decimal number?
#define FF_1CHAR 0x03000000L            // Char ('x')?
#define FF_1SEG  0x04000000L            // Segment?
#define FF_1OFF  0x05000000L            // Offset?
#define FF_1NUMB 0x06000000L            // Binary number?
#define FF_1NUMO 0x07000000L            // Octal number?
#define FF_1ENUM 0x08000000L            // Enumeration?
#define FF_1FOP  0x09000000L            // Forced operand?
#define FF_1STRO 0x0A000000L            // Struct offset?
#define FF_1STK  0x0B000000L            // Stack variable?

// The following macros answer questions like
//   'is the 1st (or 2nd) operand of instruction or data of the given type'?
// Please note that data items use only the 1st operand type (is...0)

#define isDefArg0(F)    ((F & MS_0TYPE) != FF_0VOID)
#define isDefArg1(F)    ((F & MS_1TYPE) != FF_1VOID)
#define isDec0(F)       ((F & MS_0TYPE) == FF_0NUMD)
#define isDec1(F)       ((F & MS_1TYPE) == FF_1NUMD)
#define isHex0(F)       ((F & MS_0TYPE) == FF_0NUMH)
#define isHex1(F)       ((F & MS_1TYPE) == FF_1NUMH)
#define isOct0(F)       ((F & MS_0TYPE) == FF_0NUMO)
#define isOct1(F)       ((F & MS_1TYPE) == FF_1NUMO)
#define isBin0(F)       ((F & MS_0TYPE) == FF_0NUMB)
#define isBin1(F)       ((F & MS_1TYPE) == FF_1NUMB)
#define isOff0(F)       ((F & MS_0TYPE) == FF_0OFF)
#define isOff1(F)       ((F & MS_1TYPE) == FF_1OFF)
#define isChar0(F)      ((F & MS_0TYPE) == FF_0CHAR)
#define isChar1(F)      ((F & MS_1TYPE) == FF_1CHAR)
#define isSeg0(F)       ((F & MS_0TYPE) == FF_0SEG)
#define isSeg1(F)       ((F & MS_1TYPE) == FF_1SEG)
#define isEnum0(F)      ((F & MS_0TYPE) == FF_0ENUM)
#define isEnum1(F)      ((F & MS_1TYPE) == FF_1ENUM)
#define isFop0(F)       ((F & MS_0TYPE) == FF_0FOP)
#define isFop1(F)       ((F & MS_1TYPE) == FF_1FOP)
#define isStroff0(F)    ((F & MS_0TYPE) == FF_0STRO)
#define isStroff1(F)    ((F & MS_1TYPE) == FF_1STRO)
#define isStkvar0(F)    ((F & MS_0TYPE) == FF_0STK)
#define isStkvar1(F)    ((F & MS_1TYPE) == FF_1STK)

//
//      Bits for DATA bytes
//

#define DT_TYPE 0xF0000000L             // Mask for DATA typing

#define FF_BYTE 0x00000000L             // byte
#define FF_WORD 0x10000000L             // word
#define FF_DWRD 0x20000000L             // dword
#define FF_QWRD 0x30000000L             // qword
#define FF_TBYT 0x40000000L             // tbyte
#define FF_ASCI 0x50000000L             // ASCII ?
#define FF_STRU 0x60000000L             // Struct ?
#define FF_OWRD 0x70000000L             // octaword (16 bytes)
#define FF_FLOAT 0x80000000L            // float
#define FF_DOUBLE 0x90000000L           // double
#define FF_PACKREAL 0xA0000000L         // packed decimal real
#define FF_ALIGN    0xB0000000L         // alignment directive

//
//      Bits for CODE bytes
//

#define MS_CODE 0xF0000000L
#define FF_FUNC 0x10000000L             // function start?
#define FF_IMMD 0x40000000L             // Has Immediate value ?
#define FF_JUMP 0x80000000L             // Has jump table


isCode

#define MS_CLS  0x00000600L             // Mask for typing
#define FF_CODE 0x00000600L             // Code ?
#define FF_DATA 0x00000400L             // Data ?
#define FF_TAIL 0x00000200L             // Tail ?
#define FF_UNK  0x00000000L             // Unknown ?

#define isCode(F)       ((F & MS_CLS) == FF_CODE) // is code byte?
#define isData(F)       ((F & MS_CLS) == FF_DATA) // is data byte?
#define isTail(F)       ((F & MS_CLS) == FF_TAIL) // is tail byte?
#define isUnknown(F)    ((F & MS_CLS) == FF_UNK)  // is unexplored byte?
#define isHead(F)       ((F & FF_DATA) != 0)      // is start of code/data?


isLoaded

// Is the byte initialized?

#define isLoaded(ea)    hasValue(GetFlags(ea))  // any defined value?


loadfile

***********************************************
** load file into IDA database
        arguments:      handle  - file handle
                        pos     - position in the file
                        ea      - linear address to load
                        size    - number of bytes to load
        returns:        0 - error
                        1 - ok

success loadfile        (long handle,long pos,long ea,long size);


ltoa

// Convert a number to a string.
//      n - number
//      radix - number base (2,8,10,16)

string  ltoa            (long n,long radix);    // convert to ascii string


ord

// Get code of an ascii character
//      str - string with one character
// returns: a binary number, character code

long    ord             (string str);

See also atol() function


readlong

***********************************************
** read 4 bytes from file
        arguments:      handle  - file hanlde
                        mostfirst 0 - least significant byte is first (intel)
                                  1 - most  significant byte is first
        returns:        a 32-bit value

long    readlong        (long handle,long mostfirst);


readshort

***********************************************
** read 2 bytes from file
        arguments:      handle  - file hanlde
                        mostfirst 0 - least significant byte is first (intel)
                                  1 - most  significant byte is first
        returns:        -1 - error
                        otherwise: a 16-bit value

long    readshort       (long handle,long mostfirst);


readstr

***********************************************
** read a string from file
        arguments:      handle  - file hanlde
        returns:        a string
                        on EOF, returns -1

string  readstr         (long handle);


rotate_left

// ***********************************************
// ** rotate a value to the left (or right)
//    arguments:
//         x      - value to rotate
//         count  - number of times to rotate. negative counter means
//                  rotate to the right
//         nbits  - number of bits to rotate
//         offset - offset of the first bit to rotate
// returns: the value with the specified field rotated
//          all other bits are not modified

long rotate_left(long value, long count, long nbits, long offset)

#define rotate_dword(x, count) rotate_left(x, count, 32, 0)
#define rotate_word(x, count) rotate_left(x, count, 16, 0)
#define rotate_byte(x, count) rotate_left(x, count, 8, 0)


savefile

***********************************************
** save from IDA database to file
        arguments:      handle  - file handle
                        pos     - position in the file
                        ea      - linear address to save from
                        size    - number of bytes to save
        returns:        0 - error
                        1 - ok

success savefile        (long handle,long pos,long ea,long size);


strlen

// Return length of a string in bytes
//      str - input string
// Returns: length (0..n)

long    strlen          (string str);           // calculate length


strstr

// Search a substring in a string
//      str    - input string
//      substr - substring to search
// returns: 0..n - index in the 'str' where the substring starts
//          -1   - if the substring is not found

long    strstr          (string str,string substr);     // find a substring, -1 - not found


substr

// Return substring of a string
//      str - input string
//      x1  - starting index (0..n)
//      x2  - ending index. If x2 == -1, then return substring
//            from x1 to the end of string.

string  substr          (string str,long x1,long x2); // substring [x1..x2-1]
                                                // if x2 == -1, then till end of line


writelong

***********************************************
** write 4 bytes to file
        arguments:      handle  - file hanlde
                        dword   - a 32-bit value to write
                        mostfirst 0 - least significant byte is first (intel)
                                  1 - most  significant byte is first
        returns:        0 - ok

long    writelong       (long handle,long dword,long mostfirst);


writeshort

***********************************************
** write 2 bytes to file
        arguments:      handle  - file hanlde
                        word    - a 16-bit value to write
                        mostfirst 0 - least significant byte is first (intel)
                                  1 - most  significant byte is first
        returns:        0 - ok

long    writeshort      (long handle,long word,long mostfirst);


writestr

***********************************************
** write a string to file
        arguments:      handle  - file hanlde
                        str     - string to write
        returns:        0 - ok

long    writestr        (long handle,string str);


xtol

// Convert ascii string to a binary number.
// (this function is the same as hexadecimal 'strtol' from C library)

long    xtol            (string str);           // ascii hex -> number
                                                // (use long() for atol)


Plugin Options

The -O command line switch allows the user to pass options to the plugins. A plugin which uses options should call the get_plugin_options() function to get them.

Since there may be many plugins written by independent programmers, each options will have a prefix - the plugin name.

For example, a plugin named "decomp" should expect its parameters to be in the following format:

        -Odecomp:option1:option2:option3

In this case get_plugin_options("decomp") will return the "option1:option2:option3" part of the options string.

If there are several -O options in the command line, they will be concatenated with ':' between them.


-r command line switch

The -r command line switch is used to run the built-in debugger without creating a database in advance. The format is this switch is:

  -rdebname:pass@hostname:port+pid

The explanation of the fields:

  debname       Debugger name. Should contain the debugger
                module name. Examples: win32, linux. This prefix
                can be shortened or even completely
                omitted if there is no ambiguity.
  pass          Password for the remote debugger server
  hostname      Host name or address of the remote debugger server
  port          Port number to use to connect to the debugger server
  pid           PID of the process to attach

All fields except the first are optional. See examples below for typical command lines:

  idag -r file args
        Run 'file' with command line 'args' in the local debugger
        As the debugger name is not specified, IDA will select the
        only available debugger for MS Windows, win32_user.plw.
  idag -rw+450
        Attach to process 450 on the local machine
  idag -rl:hippy@mycom:4567+
        Connect to the remote computer 'mycom' at port 4567 using the
        password 'hippy' and display the list of processes running on it.
        Allow the user to select a process and attach to it.
  idag -rl@mycom /bin/ls e*
        Run '/bin/ls' command on the 'mycom' computer using the remote
        debugger server on Linux. Use an empty password and the
        default port number. Pass "e*" as the parameter to /bin/ls.
  idag -rl@mycom whobase.idb
        Run '/usr/bin/who' command on the 'mycom' computer using the
        remote linux debugger server. Use an empty password and the
        default port number. IDA will extract the name of the
        executable from the whobase.idb file in the local current
        directory. If the database does not exist, then this command
        will fail.

When the -r switch is used, IDA works with the databases in the following way:

        - if a database corresponding to the input file exists and
        the -c switch has not been specified, then IDA will use the
        database during the debugging session

        - otherwise then a temporary database will be created

Temporary databases contain only meta-information about the debugged process and not the memory contents. The user can make a memory snapshot any time before the process ceases to exist. If IDA sees that a command which will cause the process to exit or detach IDA, it will propose to make a snapshot.

The rest of the command line is passed to the launched process.

In the case if there is no input file (if attaching to an existing process, for example), then the temporary database is created in the standard temporary directory. For windows this directory is usually "Local Setting\Temp" in the user profile directory.


Problem: Can't find offset base

 Description:
        The current item has an operand marked as an offset,
        but IDA can't find the offset base in the database.

 Possible reason(s):
        Probably IDA's base is corrupt.
        This may occur if the database was corrupted and repaired.

 What to do:
        Mark the operand again as an offset. Use one of the following
        commands:
         Convert to offset (DS)
         Convert to offset (CS)
         Convert to offset by any segment
         Convert to offset by any user-specified base


Problem: Can't find name

 Description:
        Two reasons can cause this problem:
          1.Reference to an illegal address is made in the program being
            disassembled;
          2.IDA couldn't find a name for the address but
            it must exist.
 What to do:
        1. If this problem is caused by a reference to an illegal address
            - try to enter the operand manually
            - or make the illegal address legal creating a new segment.
        2. Otherwise, the database is corrupt.


Problem: Can't find alternative string for an operand

 Description:
        The current item has an operand marked as entered manually,
        but IDA can't find the manually entered string in the database.

 Possible reason(s):
        The database is corrupt.

 What to do:
        Enter the operand manually again. Use one of the following
        commands:
         User-defined operand


Problem: Can't find comment

        Should not happen!
        Please inform the author if you encounter this problem.


Problem: Can't find references

 Description:
        The current item is marked as referenced from other place(s) in the
        program, but IDA can't find any reference to it.

 Possible reason(s):
        The database is corrupt.

 What to do:
        Database is corrupt, the best thing to do is
           to reload the database.


Problem: Indirect execution flow

 Description:
        Actually, this is not a problem. IDA warns you
        that here it encountered an indirect jump and
        couldn't follow the execution.

 What to do:
        Nothing, this entry is just for your information


Problem: Can't disassemble

 Description:
        IDA can't represent the specified bytes as an instruction.

 Possible reason(s):
        1. The specified bytes do not form an instruction.
        2. The current processor type is incorrect.

 What to do:
        If you are sure that the specified bytes contain an instruction,
        you can try to change processor type and
        mark these bytes as an instruction using the following command:
         Convert to instruction


Problem: Already data or code

 Description:
        IDA can't convert this byte(s) to an instruction
        or data because it would overlap another instruction.

 What to do:
        Make the following overlapping instruction or data 'unexplored'
        using undefine command.


Problem: Execution flows beyond limits

 Description:
        IDA encountered a jump or call instruction to an illegal address.
        Namely:
          - jump/call beyond program segments
          - near jump/call beyond the current segment
 What to do:
        1. Enter the operand manually
        2. or Create a new segment making the illegal address legal
        3. or Change the current segment bounds using one of the following:
              How to change segment attributes
              How to move a segment


Problem: Too many lines

 Description:
        The current item (instruction or data) occupies more lines
        on the screen than it is allowed by the current configuration.

 What to do:
        1. If the current item is an array or ASCII string, try to divide it.
     or 2. Delete Additional comment lines
     or 3. Disable cross-references display
     or 4. Increase the limit in IDA.CFG, the paramter name is MAX_ITEM_LINES.


Problem: Failed to trace the value of the stack pointer

 Description:
        The value of the stack pointer at the end of the function is different
        from its value at the start of the function. IDA checks for the
        difference only if the function is ended by "return" instruction.
        The most probable cause is that stack tracing has failed.

 What to do:
        1. Examine the value of stack pointer at various
           locations of the function and try to find out why the stack tracing
           has failed. Usually it fails because some called function changed the
           stack pointer (by purging the input parameters, for example)
        2. If you have found the offending function, change its
           attributes (namely, number of bytes purged upon return).
        3. Another way is to specify manually how the stack pointer is
           modified. See Change stack pointer command


Problem: Attention  Probably erroneous situation
Problem: Attention! Probably erroneous situation

 Description:
        This is a generic problem message. IDA uses it when no more detailed
        information is available or the problem is processor-specific.


Problem: Decision to convert to instruction/data is made by IDA

 Description:
        Really this is not a problem. IDA collects all the locations
        where it has made decision to convert undefined bytes to
        instructions or data even if they don't have
        any references to them. We consider this decision as dangerous
        and therefore we provide you with a way to examine all such places.

 What to do:
        Examine the result of conversion and modify the instructions
        or data if IDA had made a wrong conversion.


Problem: The decision made by IDA was wrong and rolled back

 Description:
        This problem occurs when IDA had converted unexplored bytes to
        instruction(s) and later found that the decision was wrong.
        For example:

                mov     ax, bx
                db 0FFh, 0FFh

        0FFh, 0FFh can not be converted to an instruction, therefore
        the "mov" instruction can't be here.

        In this case IDA automatically destroys the instruction(s)
        and enlists the address as problematic.

 What to do:
        Examine the end result and modify it to the taste.


FLAIR collision: the function with the given name already exists

 Description:
        It means that IDA recognized the function as coming
        from a standard library but there already was another function
        with the same name in the program.

 What to do:
        Examine the function and rename it as you wish.


Highlighting identifiers

In the graphical version, IDA Pro highlights the identifier under the cursor. For example, if the cursor is on the "EAX" register, then all occurences of "EAX" will be displayed with the yellow background. This feature is meant to make the program analysis easier by highlighting the interesting parts of the disassembly. For example, if the user wants to see all references to "EAX", he just clicks on any "EAX" on the screen and all of them will be highlighted.

The selection is made by pressing the Up, Down, Left, Right keys or by simply clicking on the identifier.

The selection is not changed by pressing the PageUp, PageDown, Home, End keys, using the scrollbar, or pressing the Alt-Up, Alt-Down, Ctrl-Up, Ctrl-Down keys.

The Alt-Up and Alt-Down keys perform a search of the currently selected identifier backward or forward respectively.

The Ctrl-Up and Ctrl-Down keys scroll the disassembly text.

IDA Pro doesn't highlight the segment names at the line prefix because it is not very useful.

It is possible to turn off the highlighting. The appropriate checkbox is in the Options, General, Misc dialog box.


Choose segment

IDA can display a list of the program segments. Each segment is represented by a line in the list. Please note that the end address of the segment never belongs to the segment in IDA.

The following segment attributes are visible:

  Name          Segment name
  Start         Virtual start address
  End           Virtual end address (address past the end of the segment)
  R             'R': readable,      '.': not readable,   '?':unknown
  W             'W': writable,      '.': not writable,   '?':unknown
  X             'X': executable,    '.': not executable, '?':unknown
  D             'D': debugger only, '.': regular
  L             'L': created by loader, '.': no
  Align         Segment alignment
  Base          Segment base selector or address
  Type          Segment type
  Class         Segment class
  AD            Segment addressing width

The rest of columns display the default values of the segment registers for the segment.

By default the cursor is located on the current segment.

You can use normal cursor movement keys and the mouse. You can also search for the segment by pressing Alt-T. Or directly jump to the desired line by typing in its number.

Press <Enter> to select line, <Esc> to cancel the selection.

See also other segment related commands


Bitfields

There is a special kind of enums: bitfields. A bitfield an enum where the 32bits are divided into groups. When you define a new symbolic constant in a bitfield, you need to specify the group to which the constant will belong to. By default IDA proposes groups containing one bit each. If a group is not defined yet, it is automatically created when the first constant in the group is defined. For example:

        name    CONST1
        value   0x1
        mask    0x1

will define a constant named CONST1 with value 1 and will create a group containing only one bit. Another example. Let's consider the following definitions:

 #define OOF_SIGNMASK    0x0003
 #define   OOFS_IFSIGN   0x0000
 #define   OOFS_NOSIGN   0x0001
 #define   OOFS_NEEDSIGN 0x0002
 #define OOF_SIGNED      0x0004
 #define OOF_NUMBER      0x0008
 #define OOF_WIDTHMASK   0x0030
 #define   OOFW_IMM      0x0000
 #define   OOFW_16       0x0010
 #define   OOFW_32       0x0020
 #define   OOFW_8        0x0030
 #define OOF_ADDR        0x0040
 #define OOF_OUTER       0x0080
 #define OOF_ZSTROFF     0x0100

How do we describe this?

   name           value    mask   maskname

   OOFS_IFSIGN   0x0000   0x0003 OOF_SIGNMASK
   OOFS_NOSIGN   0x0001   0x0003 OOF_SIGNMASK
   OOFS_NEEDSIGN 0x0002   0x0003 OOF_SIGNMASK
 OOF_SIGNED      0x0004   0x0004
 OOF_NUMBER      0x0008   0x0008
   OOFW_IMM      0x0000   0x0030 OOF_WIDTHMASK
   OOFW_16       0x0010   0x0030 OOF_WIDTHMASK
   OOFW_32       0x0020   0x0030 OOF_WIDTHMASK
   OOFW_8        0x0030   0x0030 OOF_WIDTHMASK
 OOF_ADDR        0x0040   0x0040
 OOF_OUTER       0x0080   0x0080
 OOF_ZSTROFF     0x0100   0x0100

If a mask consists of more than one bit, it can have a name and a comment. A mask name can be set when a constant with the mask is being defined. IDA will display the mask names in a different color.

In order to use a bitfield in the program, just convert an instruction operand to enum. IDA will display the operand like this:

        mov     ax, 70h

will be replaced by

        mov     ax, OOFS_IFSIGN or OOFW_8 or OOF_ADDR

See also Enum window


Packed Files

Sometimes, executable files are shipped in a packed form. It means that to disassemble these files you need to unpack them.

IDA says that the file is packed when Relocation Table of exe-file is empty.


Bad Relocation Table

Relocation table has references beyond program limits.


Additional information at the end of file

The file being loaded is not completely loaded to memory by the operating system. This may be because: - the file is overlayed; IDA does not know this type of overlays - the file has debugging information attached to its end - the file has other type of information at the end

Anyway, IDA will not load the additional information.


Overlayed files

Some EXE files are built with overlays. This means that not the whole file is loaded into the memory at the start of the program, but only a part of the file is. Other parts are loaded by the program itself into the dynamic memory or over some subroutines of the program. This fact leads to many difficulties when you disassemble such a program.

For the moment IDA knows about overlays created by Borland and Microsoft C and Pascal compilers.


Error loading overlays

One of the following occured:

        - overlay stub is not found
        - overlay relocation data is incorrect

i.e. the input file structure is bad.


Maximal number of segments is reached

When IDA tried to delete bytes outside of any segment, the maximal number of contigious chunks is reached. This is NOT a fatal error.

Some bytes outside of any segment will be present => the output text will be incorrect because of these bytes. But you can delete them in the output text using a text editor.


Can't generate executable file

IDA produces executable files only for: - MS DOS .exe - MS DOS .com - MS DOS .drv - MS DOS .sys - general binary - Intel Hex Object Format - MOS Technology Hex Object Format

Also, external loaders may or may not support the creation of user-defined input file formats.


Bad input file format

 The input file does not conform to the following definitions:

Intel Hex Object Format ßßßßßßßßßßßßßßßßßßßßßß This is the default format. This format is line oriented and uses only printable ASCII characters except for the carriage return/line feed at the end of each line. Each line in the file assumes the following format:

 :NNAAAARRHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCTT

Where:

All fields marked 'hex' consist of two or four ASCII hexadecimal digits (0-9, A-F). A maximum of 24 data bytes will be represented on each line.

 :      = Record Start Character
 NN     = Byte Count (hex)
 AAAA   = Address of first byte (hex)
 RR     = Record Type (hex, 00 except for last record which is 01)
 HH     = Data Bytes (hex)
 CC     = Check Sum (hex)
 TT     = Line Terminator (carriage return, line feed)

The last line of the file will be a record conforming to the above format with a byte count of zero (':00000001FF').

The checksum is defined as:

        sum      =  byte_count + address_hi + address_lo +
                        record_type + (sum of all data bytes)
        checksum =  ((-sum) & ffh)

MOS Technology Hex Object Format ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß This format is line oriented and uses only printable ASCII characters except for the carriage return/line feed at the end of each line. Each line in the file assumes the following format:

 ;NNAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCCCTT

Where:

All fields marked 'hex' consist of two or four ASCII hexadecimal digits (0-9, A-F). A maximum of 24 data bytes will be represented on each line.

 ;      = Record Start Character
 NN     = Byte Count (hex)
 AAAA   = Address of first byte (hex)
 HH     = Data Bytes (hex)
 CCCC   = Check Sum (hex)
 TT     = Line Terminator (carriage return, line feed)

The last line of the file will be a record with a byte count of zero (';00').

The checksum is defined as:

        sum      =  byte_count + address_hi + address_lo +
                        (sum of all data bytes)
        checksum =  (sum & ffffh)


Bad Syntax for Comments Retrieval

The correct syntax is:

  Reg=Number ....

where reg is register name (e.g. AX,BX,CX) or Op1 - for first operand or Op2 - for second operand number is its value (in C-notation)

For example:

  Op1=0x21 AX=0x4C01


Choose mark number

This command allows you to mark a location so that afterwards you can jump to the marked location immediately. Select any line from the list. The selected line will be used for mark description. Afterwards you will be able to jump to the marked location using <Alt-J> key.

You can use <Up>, <Down>, <PgUp>, <PgDn>, <Home>, <End> keys. If you select the first line of the list, nothing will be selected.

Press <Enter> to select line, <Esc> to cancel.

See also: How to jump to the marked location


Enter mark description

Mark description is any text line. The description is solely for your information.


Choose marked location

This command allows you to jump to the previously marked location. Select any line. You will jump to the selected location.

You can use <Up>, <Down>, <PgUp>, <PgDn>, <Home>, <End> keys. If you select the first line of the list, nothing will be selected.

Press <Enter> to select line, <Esc> to cancel.

See also: How to mark a location


Can't rename a location

It might be because of one of the following reasons:

1. The name is ill-formed:

        - it is a reserved word
          NOTE: IDA does not allow the use of register names as byte names.
        - it contains bad characters.
          The list of allowed characters is specified in IDA.CFG
        - it starts with a reserved prefix. Some prefixes are used
          by IDA to generate names. See Names Representation
          dialog for the list of prefixes.

2. The name is already used in the program. Try to use another name. To learn where the name is used you can try to jump to it using Jump to the Named Location

3. The address can't have a name:

     - IDA refuses to rename tail bytes (i.e. the second, third...
       bytes of instruction/data).
     - the address does not belong to the program


Can't find file segmentation

The database is empty or corrupt. All information is lost.

If you have a backup version of your database (IDB file), now is the time to restore it.

If you have previously saved your database into a text file, you can load it. See the Dump database command for explanations.


Negative Offsets

A segment can't have bytes with negative offset from the segment base. Example: if segment base is 0x3000, this segment can have start address above or equal to 0x30000, but it can't have start address 0x2FFFF.


Can't move segment start address

IDA can't change the segment start address if some instructions/data would occur outside of the segment. Undefine this instructions/data first.


Can't move segment start address

IDA can't change the segment start address because this segment with the new start address would overlap another adjacent segment. For example, the following situation:

  seg_a  starts at 0x0000 ends at 0x1000
  seg_b  starts at 0x1000 ends at 0x2000
  seg_c  starts at 0x2000 ends at 0x3000

If you ask to change seg_c so that it starts at 0x500, you'll see this error message, because the new seg_c would overlap seg_b.

Please note that the end address never belongs to the segment in IDA.


Can't Create Database

Most probably your disk is full or some disk I/O error occured.


Database is not closed

The database was not closed after the last IDA session. Most probably this happened due to a power fault, unexpected reboot of the computer, or another abnormal session termination.

You may try to repair the database but the best solution would be to use the intact packed database or use a backup.

The repairing may fail to recover the database.

See also the Dump database command.


Obsolete Database Format

Please use old version of IDA. This version of IDA does not support this format.


The Name List is Empty

This command allows you to select a name from the user defined names. No such names are defined now or all user-defined names are hidden. To give a name to the location, use Rename or Rename any commands.


Upgrading IDA database

If IDA finds out that your database has an old format, it will try to upgrade the database to a new format. The upgrade process is fully automatic, no user intervention is needed. However, after upgrading your database you will not be able to work with it using old versions of IDA. That is why IDA asks your confirmation before upgrading the database.

This feature works only for databases starting from IDA version 2.05.


Unexpected Database Format

Database format is newer than expected. That is because you are using an old version of IDA. The only thing you can do is to get a new version of IDA.


Imported module is not found

  IDA did not find the specified module in:
    - the current directory
    - the operating system directory (see switch -W
      and configuration file parameters WINDIR,OS2DIR)

  OR
    - the module can't be accepted because:
        - the module name (recorded in the file) doesn't match
          the expected name
        - the module contains no exported names (all exported functions
          are exported by ordinal numbers)

Entries imported by ordinal will not be commented. If IDA finds a module, all imported by ordinal entries are commented like this:

  KERNEL_91:
                retf            ; INITTASK
                                  ^^^^^^^^^
                                  comment

This comment will be propagated (repeated) to all locations which call this entry:

                call    far ptr KERNEL_91 ; INITTASK

IDA searches all files named "modulename.*" for the module. If you know that the imported module resides in another directory, copy it to your current directory. And if the module file name is different from "modulename.*", rename it. After the database is loaded, you can delete the copied module.

Also IDA looks for file "modulename.ids" in the current directory in the IDS subdirectory of the directory where IDA.EXE resides in the PATHed directories

You can yourself create such a file. For an example look at DOSCALLS.IDS in the IDS subdirectory.


Renaming old database files

IDA has found its old database in the current directory. It asks your permission to rename them so that IDA can use the old database.

Starting from version 3.01 IDA can disassemble several files in one directory. In order to allow this the names of the IDA database files are changed.


Load file dialog

Below is the description of dialog box fields:

 Load address - the paragraph where the file will be loaded.
                Meaningful only for EXE and binary files. For new exe
                files please use 'manual load' feature.
 Load offset  - meaningful only for binary files.
                specifies offset of the first byte from the start of
                the first segment. For example, if load offset=0x2700 and
                load address=0x1000, the first byte of the file will
                be at 1000:2700.
 DLL directory - path where IDA will look up referenced DLL files.
                Note that if IDA finds .IDS file, it does not look for
                .DLL file.
 Create segments        - meaningful for binary files.
                          If not checked, IDA does not create segments.
 Load resources         - If not checked, IDA does not load resources from
                          NE files.
 Rename DLL entries     - If not checked, IDA makes repeatable comments
                          for entries imported by ordinal. Otherwise
                          IDA renames the entries to meaningful names.
 Manual load            - meaningful only for NE,LE,LX files.
                          If checked, IDA will ask loading addresses
                          and selectors for each object of the file.
                          For experienced users only!
 Fill segment gaps      - meaningful only for NE files.
                          If checked, IDA will fill gaps between
                          segments, creating one big chunk.
                          Use it if loading a new file you
                          get a message "Maximum number of chunks reached"
                          Also you could define the environment variable
                          called IDA_PAGESIZE to a bigger value (default
                          is 4096).
 Make imports section   - meaningful only for PE files.
                          If checked, IDA will convert .idata section
                          definitions to "extrn" directives and truncate it.
                          Unfortunately sometimes there is some additional
                          data in .idata section so you'll need to disable
                          this feature if some information is not loaded
                          into the database.
 Don't align segments   - meaningful only for OMF files.
                          If checked, IDA will ignore the segment alignment
                          and will create segments one after another
                          without any gaps.
                          This option might be useful if there are too
                          many segments in the input file.
 Create FLAT group      - meaningful only for IBM PC PE files.
                          If checked, IDA will automatically create FLAT
                          group and use its selector as the default value
                          for the segment registers.
 Code segment           - If checked, IDA creates a code but not a data
                          segment. Meaningful for processors with different
                          code/data segment addressing schemes (for
                          example, Atmel AVR).


PE .idata section has additional data

If "create imports section" in the file loading dialog is checked, IDA will convert .idata section definitions to "extrn" directives and truncate it so it will not contain empty lines.

Unfortunately sometimes there is some additional data in .idata section so you'll need to disable this feature if some information is not loaded into the database.

IDA tries to detect additional data in .idata section automatically.

If you disable conversion of .idata section to a segment with "extrn" directives, you will see

somename dd ?

instead of

        extrn   somename

directives.

Another impact is that the .idata segment will not be truncated in any way.


Repeat search for instruction/data with the specified operand

 Action    name: JumpImmediate

This command repeats search for immediate command.

See also Search submenu


Repeat search for substring in the disassembly

 Action    name: JumpText

This command repeats search for text command.

See also Search submenu


Repeat search for substring in the file

 Action    name: JumpBinaryText

This command repeats search for text in core command.

See also Search submenu


Moving The Segment Start

When you edit the segment boundaries, you can check the "move the adjacent segments" checkbox.

IDA will try to shrink/expand the previous segment in order to move the beginning of the selected segment. Of course you cannot move the start of the segment 'too far':

  - the segment must have at least 1 byte
  - the start address of the segment must be less than the end of the segment
  - no segments can be killed during moving
  - the segment can't have bytes with negative offsets

You cannot shrink a segment to zero bytes. A segment must have at least one byte.

Mainly this command is used when IDA does not detect boundary between segments correctly.

Sometimes IDA creates 2 segments where only one segment must exist. In this case you should not use this command. Use the following sequence instead:

        - delete one segment.
          Choose the one with the bad segment base value.
          Do not disable addresses occupied by the segment being deleted.
        - change boundaries of the other segment.

Caution: moving the first segment of the program will delete all information about the bytes between the old start of the segment and the new start of the segment!

See also another command that changes segment bounds:

 Edit Segment
 Edit|Segments submenu.


Deleting a Segment

If you want to delete the segment, please mark 'CONFIRM DELETION' checkbox

Disable addresses checkbox

        CAUTION: ALL INFORMATION ABOUT THE SEGMENT WILL BE LOST!

If you disable the addresses occupied by the segment, all information about these addresses will be lost. You will not see them on the screen anymore.

Otherwise, the segment will be deleted, but its data will rest unchanged. You shall create another segment(s) for these addresses using Create a New Segment command.


Auto analysis is not completed

Till auto analysis is not completed, the IDA database is not consistent:

  - not all cross-references are found
  - not all instructions are disassembled
  - not all data items are explored

See also: auto analysis setup auto analysis


Silent mode of IDA

In this mode IDA will not display dialog boxes on the screen. Instead, it will assume the default answer and proceed. For example, if you press @<Quit>, IDA will promptly exit to OS without asking for any confirmation.

To return to the normal mode you will need to execute an IDC function:

        Batch(0);

i.e. disable the batch "silent" mode. To execute an IDC function, select File|IDC command... menu item or press @<ExecuteLine> hotkey.


Rename a structure/member

IDA maintains separate namespaces for each structure. For example, you can define something like this:

 xxx    struc
 xxx    db ?
 xxx    struc

Beware, usually assemblers have one common namespace and do not allow the mentioned above example.

You can't specify an empty name.

This command is available when you open a structures window.

If the cursor is on the structure name at the structure definition start then IDA proposes to rename the structure. Otherwise IDA proposes to rename a structure field.

If a structure is being renamed then "Don't include in the list" means that the structure will not be included in the list of the structures which appears when the user applies the structure definition, for example, when he creates a variable of this structure type. We recommend to mark this checkbox when you have defined all variables of this structure type and want to reduce the number of choices in the list.

See also Edit|Structs submenu. How to Enter an Identifier


Delete a structure member

 Please remember that deleting a member deletes also all information
about this member, including comments, member name etc.

See also Edit|Structs submenu.


Unpacked database is dangerous

First of all, you can lose all information because you won't have a backup copy of the database. IDA makes modifications to the unpacked database and if some unexpected condition occurs during work, the unpacked database is usually damaged. IDA is able to repair such a database, but some information could be irreversibly lost leading to disastrous consequences.

The only advantage of the unpacked database is that it is loaded very fast. Naturally, exiting to DOS is fast too.

If packing is disabled, in the next session you can't abort IDA.

                        YOU ARE WARNED.

If you want to disable this question in the future, you can do it by modifying ASK_EXIT_UNPACKED parameter in IDATUI.CFG file.


Database Is Empty

Although the database exists, it is empty. Delete it and start over.

If you have previously saved your database into a text file, you can load it. See Dump database command for explanations.

See also IDA usage help


Illegal Usage of the Switch

Not all switches can be used when you start IDA for the second or more time. Below are valid switches:

 -a     disable auto analysis
 -d     debug

See also IDA usage help


Can't Find Input File

IDA have tried to find file with the following extensions:

        .com    .bin    .ov4
        .exe    .ovr    .ov5
        .dll    .ov0    .ov6
        .ovl    .ov1    .ov7
        .drv    .ov2    .ov8
        .sys    .ov3    .nlm

No such files were found.

See also IDA usage help


Patched Bytes Are Skipped

Some bytes in program memory have no corresponding byte in the executable file. For example, uninitialized data is not kept in the file. OS/2 Warp and Window support compressed pages.

In this case IDA can't create a full difference file. It shows the skipped byte addresses along with their values in the messages window.


List of Functions

You can use list viewer commands in this window. Here is the format of this window.


No Segment for the current byte

Some commands can't be applied to the addresses without a segment.

Create a segment first. You can do this using the CreateSegment command.


Window is in Dumping Mode

Some commands do not work in the windows in the dumping mode. If you want to apply this command, please turn the dumping mode off. Another way is to open another disassembly window.


Empty input file

The input file doesn't contain any instructions or data, i.e. there is nothing to disassemble.

Some file formats allow the situation when the file is not empty but it doesn't contain anything to disassemble. For example, COFF/OMF/EXE formats could contain a file header which just declares that there are no executable sections in the file.

There could be type information, compiler options and other auxiliary information in the file. This is the reason why the file doesn't look empty but IDA doesn't find anything to disassemble.


Load Additional Binary File

Below is the description of dialog box fields:

 Load segment    - The paragraph where the file will be loaded.
 Load offset     - Specifies offset of the first byte from the start of
                   the first segment. For example, if load offset=0x2700
                   and load segment=0x1000, the first byte of the file will
                   be at 1000:2700, or in linear addressing, 0x12700.
 File offset     - Offset in the input file to load bytes from.
 Number of bytes - Number of bytes to load from the file.
                   0 means load as many as possible.
 Create segments        - If not checked, IDA does not create segments.
 Code segment           - If checked, IDA creates a code segment.
                          Meaningful for processors which have different
                          code/data segment addressing schemes (for
                          example, Atmel AVR).


Patched bytes have relocation information

If a byte has relocation information attached to it, then the value of this byte is changed when the file is loaded into the memory by the system loader or linker. Therefore it doesn't make much sense (and sometimes it is simply illegal) to modify the byte.

The recommendation: return the original value of the byte(s).

You can see the relocation information attached to an item by using the show internal flags command.


Not a virtual array file

The most probable error is that you tried to use an incompatible version of IDA. Starting from IDA 2.0 beta2 the format of virtual files was changed.


Virtual Array: Accessing illegal address

Most likely this is an internal error of IDA.


Virtual Array: Maximum number of chunks is reached

A virtual array can have up to ~400 chunks. You have reached this limit.

Please read this help page to learn how to avoid this error message.

To increase number of allowed chunks you can increase the page size for virtual arrays. For this, set the configuration file variable VPAGESIZE. For example:

  VPAGESIZE=0x8000

You may set the configuration variable from the command line like this:

        ida -dVPAGESIZE=0x8000 input_file

The page size must be a power of 2. The default page size is 8192. This setting will affect new database only. Old databases will continue to use the old value of VPAGESIZE.

The maximum value of VPAGESIZE is 0x8000 which corresponds to 512MB of address space.

 IMPORTANT NOTES
 ===============

If you were loading New Executable (NE) Format file, you may use 'Fill segment gaps' feature (it is activated in the "Load File" dialog appearing at the very start) to avoid this error message.

If you were loading OMF file, you may use the "Don't align segments" feature to avoid this error message.


Desktops

IDA saves different settings in desktops: the main window configuration, the toolbars configuration, and the configuration of all database windows.

Different desktops are available:

 <Database>          - this windows configuration is stored in the database itself,
                       and is automatically loaded each time you open this database.
                       IDA also automatically saves the current windows configuration
                       to this desktop if you close and save the database.

 <Database debugger> - this windows configuration is also stored in the database,
                       and is loaded each time you start the debugger.
                       As for the <Database> desktop, IDA automatically saves the current
                       windows configuration to this desktop once the debugger stops.

 <Default>           - this windows configuration is stored in the registry,
                       and is loaded each time you start IDA without opening a database,
                       or the first time you create a new database.

 <Default debugger>  - this windows configuration is stored in the registry,
                       and is loaded the first time you start the debugger.

  named desktops     - these windows configurations are stored in the registry,
                       and can be loaded manually by the user during the disassembly
                       or the debugging.

Notice IDA will use a default configuration for main windows and toolbars if the screen resolution changed.

See also

         Load desktop... command
         Save desktop... command
         Delete desktop... command
         Reset desktop command


file://z|/idasrc/current/bin/html/693.htm

Can't create segment registers area

Happened due to the database. The database is corrupt. Try to finish your work as soon as possible and get the text source file.

If you have previously saved your database into a text file, you can load it. See Unload command for explanations.


file://z|/idasrc/current/bin/html/694.htm

Can't assign to Segment Register

The database is corrupt. Result of disassembling may be surprising, nothing can be guaranteed.

If you have previously saved your database into a text file, you can load it. See Unload command for explanations.


Invoke OS Shell

 Action    name: Shell

Using this command you can temporarily quit to the operating system.

This command is not available in the MS DOS version.

The database is left open when you use this command, so be careful.

See also other File... submenu commands.


Demonstration Version Constraints

The demo version works only with new databases and doesn't save the disassembly results in an IDB file.

The demo version is not able to produce .ASM and .LST files. The full features version produces .ASM and .LST files.

The demo version will accept only Windows PE files as the input.

Also it stops working after a while. This is a demo, not a full version, isn't it? :)

For information about the full version please visit www.datarescue.com/idabase/ida.htm


Perform en masse operation

If you have selected an area before applying an operand conversion command, IDA will display you a dialog box.

You can choose a range of operands to perform an en masse operation:

 ALL OPERANDS
 -----------

The operation will be performed on all operands as a toggle. For example, if you ask to convert to a character, then all non-character operands will become characters, and all character operands will become non-chars.

 OPERAND VALUE RANGE
 -------------------

The operation will be performed on the operands which contain the immediate numbers in the specified range.

 ... OPERANDS
 ------------

This selection will convert all operands with the specified type to undefined operands. Example: all characters become non-characters.

 NOT ... OPERANDS
 ---------------

This selection allows to convert all operands that don't have the specified type to the specified type. Example: all non-characters to characters.

 NOT TYPED OPERANDS
 -----------------

This selection allows to convert all operands without a type to the specified type. Example: all operands with no type to characters.

 APPLY ONLY IF POSSIBLE
 ---------------------

IDA will check whether an operand can be represented with the specified type (as a character constant, for example), and perform type conversion only if the check is positive.


Complex Offset Expression

A complex offset expression looks like

        offset target + delta - offset base

It is specified by:

        - type (OFF16, OFF32, LOW16, etc.)
        - base
        - optional target
        - optional delta from target

The relationship between these parameters is (the formula is given for full offsets):

        operand_value == target + tdelta - base

  or (the same relationship in a different form):

        target = operand_value - delta + base

You always have to specify the offset type and base. Usually the delta is equal to zero. For the full offset type you may omit (and it is recommended to omit) the offset target. In this case IDA will calculate it automatically. However, if you specify the offset target, make sure that the relationship between the parameters still holds. For the half offset types you have to specify the target because there is no way to calculate it.

The offset types:

  8-bit full offset            :
  16-bit full offset           :
  32-bit full offset           :

    The full offsets are regular offset expressions like

        offset label

    They can occupy 8, 16, or 32 bits.
    You have to specify the offset base for these offsets.

  low 8 bits of 16-bit offset  :

    Only the low 8 bits of the offset. IDA will represent them as

        (offset label) & 0xFF

  low 16 bits of 32-bit offset :

    Only the low 16 bits of the offset. IDA will represent them as

        (offset label) & 0xFFFF

  high 8 bits of 16-bit offset :

    Only the high 8 bits of the offset. IDA will represent them as

        offset label >> 8

  high 16 bits of 32-bit offset:

    Only the high 17 bits of the offset. IDA will represent them as

        offset label >> 16

See also offset by any user-specified base


IDA address space concepts

Internally IDA has 32bit linear address space. The internal addresses are called "linear addresses". The input program is loaded into this linear address space.

Please note that usually the linear addresses are not used in the program directly. During disassembling we use so-called "virtual addresses", which are calculated by the following formula:

        VirtualAddress = LinearAddress - (SegmentBase << 4);

We see that the SegmentBase determines what addresses will be displayed on the screen. More than that, IDA allows to create several segments with the same virtual address in them. For this you just need to create segments with correct segment base values.

A SegmentBase is kept as 16bit quantity (this is IBM PC heritage). To create a segment with base >= 0x10000, you need to use selectors. However, if you try to create a segment with a segment base >= 0x10000, IDA Pro will automatically choose a free selector and setup appropriately for the new segment.

There are some address restrictions in IDA Pro.

We do not recommend to use addresses just above 0xFF000000 (MAXADDR) in the 32-bit version. The limitation for the 64-bit version is 0xFF0000000000. These addresses are used for internal houekeeping.

Also there is one address which must never be used in the disassembly. It is the 'all ones' address, or -1. Internally it is used as a BADADDR (bad address). No address or address range can include BADADDR.

 Click here to see an example of segment creation
 (simple case - IBM PC)

 Click here to see an example of segment creation
 (simple case - Z80)

 Click here to see another example of segment creation
 (automatically chosen selector)

 Click here to see another example of segment creation
 (user-defined selector)

See also How to change segment translation


Change Segment Name

Enter new name for the segment. Segment name is up to 8 characters long. IDA does check it for good shape. Try to give mnemonic names for the segments.

See also other SegEdit form fields.


Segment Class Name

The segment class name identifies the segment with a class name (such as CODE, FAR_DATA, or STACK). The linker places segments with the same class name into a contiguous area of memory in the runtime memory map.

Changing the segment class changes only the segment definition on the screen. There are the following predefined segment class names:

        CODE    -       Pure code
        DATA    -       Pure data
        CONST   -       Pure data
        BSS     -       Uninitialized data
        STACK   -       Uninitialized data
        XTRN    -       Extern definitions segment

If you change segment class and the segment type is "Regular", then the segment type will be changed accordingly.

In order to set the segment type "Regular" you should change the segment class to "UNK".

NOTE: Segment class names are never deleted. Once you define a segment class name, you can not reuse it as a name of another object.

See also other SegEdit form fields.


Change Segment Addressing

You can choose between 16-bit and 32-bit segment addressing.

IDA will delete all instructions and data in the segment if the segment address is changed.

Never do it if you are not sure. It may have irreversible consequences, all instructions/data will be converted to undefined bytes.

See also other SegEdit form fields.


Change Segment Alignment

Alignment: select between abs,byte,word,dword,para,page

You can specify the segment alignment for the selected segment. By default, IDA assumes 'byte' alignment.

Changing the alignment changes only the segment definition on the screen. Nothing else will happen.

See also other SegEdit form fields.


Change Segment Combination

Combination

A field that describes how the linker can combine the segment with other segments. Under MS-DOS, segments with the same name and class can be combined in two ways: they can be concatenated to form one logical segment, or they can be overlapped. In the latter case, they have either the same start address or the same end address, and they describe a common area in memory. Values for the field are:

  Private. Do not combine with any
           other program segment.
  Public.  Combine by appending at
           an offset that meets the
           alignment requirement.

  Stack.   Combine as for Public.
           This combine type forces
           byte alignment.

  Common.  Combine by overlay using
           maximum size.

Changing segment combination changes only the segment definition on the screen. Nothing else will happen.

See also other SegEdit form fields.


Binary string format

You can:

  - enter a sequence of numbers in the selected radix
    (hexdecimal, decimal or octal)
  - enter C string constants like this: "string"
  - enter a question mark ? to ignore variable bytes
  - enter Unicode string constants: L"unicode string"

Sequence must be space or comma separated.

If you enter a number, it will occupy the minimal number of bytes it fits in with the restriction that the number of bytes is a power of 2 (1, 2, or 4 bytes).

Example:

  CD 21          - bytes 0xCD, 0x21
  21CD           - bytes 0xCD, 0x21 (the order depends on the endiannes)
  "Hello", 0     - the null terminated string "Hello"
  L"Hello"       - 'H', 0, 'e', 0, 'l', 0, 'l', 0, 'o', 0
  B8 ? ? ? ? 90  - byte 0xB8, 4 bytes with any value, byte 0x90


Jumps Stack

Each IDA Window has its own jumps stack. This stack keeps the cursor locations. Many IDA commands use the jumps stack, i.e. they save the old cursor position to the stack. For example, when you are at the address 3000:0100 and press the Ctrl-C key (find instruction), the 3000:0100 is saved into the jumps stack and the search is started. Afterwards, you can return to the old position using Jump back command.

You can make the jumps stack empty using the Empty stack menu command.


Low & High Suspicious Operand Limits

If IDA suspects that an operand can be represented as something different from a plain number, it will mark the operand as "suspicious" and display it in red/orange.

Two values control the definition of suspiciousness. An operand is 'suspicious' if it has an immediate value between low and high 'suspicious' limits. The comparison is always unsigned, i.e. in the instruction

        mov ax,[bp-2]

  the immediate operand is 0xFFFE, not -2.

IDA uses a simple heuristic to determine initial suspiciousness limits. You may change these limits any time you want.

See also

         Comments Dialog
         How to Enter a Number.


POSIX 1003.2 Regular Expressions

A RE (regular expression) is one or more non-empty branches, separated by `|'. It matches anything that matches one of the branches.

A branch is one or more pieces, concatenated. It matches a match for the first, followed by a match for the second, etc.

A piece is an atom possibly followed by a single `*', `+', `?', or bound. An atom followed by:

        `*' matches a sequence of 0 or more matches of the atom.
        `+' matches a sequence of 1 or more matches of the atom.
        `?' matches a sequence of 0 or 1 matches of the atom.

A bound is `{' followed by an unsigned decimal integer, pos- sibly followed by `,' possibly followed by another unsigned decimal integer, always followed by `}'. The integers must lie between 0 and 255 inclusive, and if there are two of them, the first may not exceed the second. An atom followed by a bound containing one integer i and no comma matches a sequence of exactly i matches of the atom. An atom followed by a bound containing one integer i and a comma matches a sequence of i or more matches of the atom. An atom followed by a bound containing two integers i and j matches a sequence of i through j (inclusive) matches of the atom.

An atom is a regular expression enclosed in `()' (matching a match for the regular expression), an empty set of `()' (matching the null string) - , a bracket expression (see below), `.' (matching any single character), `^' (matching the null string at the beginning of a line), `$' (matching the null string at the end of a line), a `\' followed by one of the characters `^.[$()|*+?{\' (matching that character taken as an ordinary character), a `\' followed by any other character (matching that character taken as an ordinary character, as if the `\' had not been present), or a single character with no other significance (matching that character). A `{' followed by a character other than a digit is an ordinary character, not the beginning of a bound. It is illegal to end an RE with `\'.

A bracket expression is a list of characters enclosed in `[]'. It normally matches any single character from the list (but see below). If the list begins with `^', it matches any single character (but see below) not from the rest of the list. If two characters in the list are separated by ` -', this is shorthand for the full range of characters between those two (inclusive) in the collating sequence, e.g. `[0-9]' in ASCII matches any decimal digit. It is illegal for two ranges to share an endpoint, e.g. `a-c-e'.

To include a literal `]' in the list, make it the first character (following a possible `^'). To include a literal `-', make it the first or last character, or the second end-point of a range. To use a literal `-' as the first end-point of a range, enclose it in `[.' and `.]' to make it a collating element (see below). With the exception of these and some combinations using `[' (see next paragraphs), all other special characters, including `\', lose their special significance within a bracket expression.

Within a bracket expression, a collating element (a character, a multi-character sequence that collates as if it were a single character, or a collating-sequence name for either) enclosed in `[.' and `.]' stands for the sequence of charac- ters of that collating element. The sequence is a single element of the bracket expression's list. A bracket expres- sion containing a multi-character collating element can thus match more than one character, e.g. if the collating sequence includes a `ch' collating element, then the RE `[[.ch.]]*c' matches the first five characters of `chchcc'.

Within a bracket expression, a collating element enclosed in `[=' and `=]' is an equivalence class, standing for the sequences of characters of all collating elements equivalent to that one, including itself. (If there are no other equivalent collating elements, the treatment is as if the enclosing delimiters were `[.' and `.]'.) For example, if o and ^ are the members of an equivalence class, then `[[=o=]]', `[[=^=]]', and `[o^]' are all synonymous. An equivalence class may not be an endpoint of a range.

Within a bracket expression, the name of a character class enclosed in `[:' and `:]' stands for the list of all characters belonging to that class. Standard character class names are:

          alnum       digit       punct
          alpha       graph       space
          blank       lower       upper
          cntrl       print       xdigit

A character class may not be used as an endpoint of a range.

There are two special cases of bracket expressions: the bracket expressions `[[:<:]]' and `[[:>:]]' match the null string at the beginning and end of a word respectively. A word is defined as a sequence of word characters which is neither preceded nor followed by word characters. A word character is an alnum character or an underscore. This is an extension, compatible with but not specified by POSIX 1003.2.

In the event that an RE could match more than one substring of a given string, the RE matches the one starting earliest in the string. If the RE could match more than one substring starting at that point, it matches the longest. Subexpressions also match the longest possible substrings, subject to the constraint that the whole match be as long as possible, with subexpressions starting earlier in the RE taking priority over ones starting later. Note that higher-level subexpressions thus take priority over their lower-level component subexpressions.

Match lengths are measured in characters, not collating elements. A null string is considered longer than no match at all. For example, `bb*' matches the three middle characters of `abbbc', `(wee|week)(knights|nights)' matches all ten characters of `weeknights', when `(.*).*' is matched against `abc' the parenthesized subexpression matches all three characters, and when `(a*)*' is matched against `bc' both the whole RE and the parenthesized subexpression match the null string.

The regular expression engine used in IDA: Copyright 1992, 1993, 1994 Henry Spencer. All rights reserved.


Edit breakpoint

 Action    name: BreakpointEdit

This command opens a dialog box to edit an existing breakpoint.

It is possible to disable a breakpoint.

In the case of a hardware breakpoint, we can specify different settings:

Size

        This setting specifies the size of bytes to watch (1, 2 or 4 bytes).

Mode

        This setting specifies the condition to which the breakpoint will react.

In the case of Intel hardware breakpoints, some limitations are enforced. It is impossible to create more than 4 hardware breakpoints. The address of the breakpoint must be aligned appropriately:

       - If you're creating a 2 bytes breakpoint, the address must be word-aligned.

       - If you're creating a 4 bytes breakpoint, the address must be dword-aligned.

Usually, it is easier to use instruction breakpoints, except if:

       - we want to be sure the memory isn't modified by the debugger
       (instruction breakpoints modify the debugger process's memory).

       - we want to catch access to data bytes.

       - the specified address is write protected (really rare!).

Condition

        This IDC expression will be evaluated each time the breakpoint is reached.
        If the expression returns true, the debugger will execute the selected actions.
        Please note that you can use the register names in the IDC scripts when
        the debugger is active. Tests like this would be ok, for example:
        EAX == EBX+5
        Dword(ESP+0x10) == 34

 See also Breakpoints list
          Add breakpoint
          Delete breakpoint
          Breakpoints submenu
          Index of IDC functions


Exceptions

This dialog box allows to setup how the debugger will react to specific exceptions. For each exception, two settings can be specified, simply by selecting the desired exception, and clicking the 'Edit' button in the popup menu.

Handled by

        Specify whether the exception will be handled by the debugger or by the program itself.
        If the debugged program contains exception handling code, it is better to select 'Application'.

Stop at

        Specify whether the debugger will stop when the exception occurs.
        If the handled_by == application and the application handles
        the exception successfully, then the execution will not stop
        regardless of the stop_at value.

 See also Debugger submenu.


Customize Demangled Names

All your changes will be saved in the current database. If you want to change the form of demangled names for all new databases, then you need to edit the configuration file, variables 'ShortNameForm' and 'LongNameForm'. Below is the list of all checkboxes with examples (spaces are inserted only for the ease of understanding):

No underscores in __ccall, __pascal, etc

        on:     void   pascal func(void);
        off:    void __pascal func(void);

No calling conventions for parameteres and __based()

        on:  void         func(int (*          f2)(void));
        off: void __cdecl func(int (* __pascal f2)(void));

No return type of functions

        on:         func(void);
        off:    int func(void);

No "based()" specifier

        on:   int                            a;
        off:  int __based(__segname("DATA")) a;
        on:   void __based(void) *b;
        off:  void               *b;
        on:   int __based(__self) (*p)(void);
        off:  int                 (*p)(void);

No calling conventions

        on:     void          func(void);
        off:    void __pascal func(void);

No postfix const in member function declarations

        on:     void aclass::func(void);
        off:    void aclass::func(void) const;

No near/far/huge modifiers

        on:     char     * func(void);
        off:    char far * func(void);
        on:     char     *      * a[5][6];
        off:    char far * near * a[5][6];

  note: at the bottom of the dialog box you can specify the default
        memory model.

No public/private/protected keywords

        on:             void func(void);
        off:    private void func(void);

No throw descriptions

        on:     void func(void);
        off:    void func(void) throw(Class::Member);

No static and virtual keywords

        on:                    void aclass::func(void);
        off:    static virtual void aclass::func(void);

No class/struct/union/enum keywords

        on:            A & func(      A *,      B *);
        off:     class A & func(class A *, enum B *);

Inhibit everything except the main name

        on:     func;
        off:    static void __pascal func(void) const;

No const and volatile keywords

        on:     char       * func(void);
        off:    char const * func(void);

Default memory model: Near 'near' keywords will never be displayed Far 'far' keywords will never be displayed Huge 'huge' keywords will never be displayed None all keywords will be displayed unless "No near/far/huge modifiers" is checked

Quash j_

        This option allows IDA to demangle a name even if it was formed
        by adding j_ prefix to a mangled name. The prefix j_ will simply
        be thrown away.

Transfer j_

        This option also allows IDA to demangle names with prefix j_.
        Unlike the previous option this option will show the prefix
        in the demangled name.

Ignore postfix _nn

        This option allows IDA to demangle names formed by adding
        postfix _nn to a mangled name (n is any digit).


ARM processor specifics

The ARM processor has two modes: ARM and THUMB. Since these 2 modes have different instruction encoding and may be mixed in a segment, we need some means to specify how to disassemble instructions. A virtual segment register named 'T' is used for that purpose. If its value is 0, then ARM mode is used. Otherwise, THUMB mode is used. The default is to use the ARM mode. Please note that if you change the value of T register for an area, IDA will destroy all instructions in that area because their disassembly is no longer correct.

See

      Change segment register value
      Set default segment register value

commands to learn how to specify the segment register value.


Kernel analysis options 1

Create offsets and segments using fixup info

        IDA will use relocation information to make the disassembly
        nicer. In particular, it will convert all data items with
        relocation information to words or dwords like this:

                dd offset label
                dw seg seg000

        If an instruction has a relocation information attached to it,
        IDA will convert its immediate operand to an offset or segment:

                mov     eax, offset label

        You can display the relocation information attached to the current
        item by using show internal flags command.

Mark typical code sequences as code

        IDA knows some typical code sequences for each processor.
        For example, it knows about typical sequence

                push    bp
                mov     bp, sp

        If this option is enabled, IDA will search for all typical sequences
        and convert them to instructions even if there are no references
        to them. The search is performed at the loading time.

Delete instructions with no xrefs

        This option allows IDA to undefine instructions without any references to them.
        For example, if you undefine an instruction at the start of a
        function, IDA will trace execution flow and delete all instructions
        that lose references to them.

Trace execution flow

        This option allows IDA to trace execution flow and convert all
        references bytes to instructions.

Create functions if call is present

        This option allows IDA to create function (proc) if a call
        instruction is present. For example, the presence of:

                call loc_1234

        leads to creation of a function at label loc_1234

Analyze and create all xrefs

        Without this option IDA will not thoroughly analyze the program.
        If this option is disabled, IDA will simply trace execution flow,
        nothing more (no xrefs, no additional checks, etc)

Use flirt signatures

        Allows usage of FLIRT technology

Create function if data xref data->code32 exists

        If IDA encounters a data reference from DATA segment to 32bit
        CODE segment, it will check for the presence of meaningful
        (disassemblable) instruction at the target. If there is an
        instruction, it will mark it as an instruction and will create
        a function there.

Rename jump functions as j_...

        This option allows IDA to rename simple functions containing only

                jmp somewhere

        instruction to "j_somewhere".

Rename empty functions as nullsub_...

        This option allows IDA to rename empty functions containing only
        a "return" instruction as "nullsub_..."
        (... is replaced by a serial number: 0,1,2,3...)

Create stack variables

        This option allows IDA to automatically create stack variables and
        function parameters.

Trace stack pointer

        This option allows IDA to trace the value of SP register.

Create ascii string if data xref exists

        If IDA encounters a data reference to an undefined item, it
        checks for the presence of the ASCII string at the target. If the length
        of the ASCII string is big enough (more than 4 chars in 16bit or data
        segments; more than 16 chars otherwise), IDA will automatically create
        an ASCII string.

Convert 32bit instruction operand to offset

        This option works only in 32bit segments.
        If an instruction has an immediate operand and the operand
        can be represented as a meaningful offset expression, IDA will
        convert it to an offset. However, the value of immediate operand
        must be higher than 0x10000.

Create offset if data xref to seg32 exists

        If IDA encounters a data reference to 32bit segment and the target
        contains 32bit value which can be represented as an offset expression,
        IDA will convert it to an offset.

Make final analysis pass

        This option allows IDA to coagulate all unexplored bytes
        by converting them to data or instructions.

See also analysis options 2


Kernel analysis options 2

Locate and create jump tables

        This option allows IDA to try to guess the address and size of jump
        tables. Please note that disabling this option will not disable
        the recognition of C-style typical switch constructs.

Coagulate data in the final pass

        This option is meaningful only if "Make final analysis pass"
        is enabled. It allows IDA to convert unexplored bytes
        to data arrays in the data segments. If this option is disabled,
        IDA will coagulate only code segments.

Automatically hide libary functions

        This option hides the functions recognized by FLIRT.
        It will have effect only from the time it is set.

Propagate stack argument information

        This option propagates the stack argument information
        (the type and the name) to the caller's stack. If the caller is
        called then the information will be propagated further through
        the whole program. Currently the type propagation is really
        simple and non-intelligent: the first encountered type for
        a stack variable will be used.

Propagate register argument information

        This option propagates the register argument information
        (the type and the name) to the caller. If the caller is
        also called then the information will be propagated further through
        the whole program.

Check for unicode strings

        This option allows IDA to check for the presence of the unicode
        strings in the program and creates them if necessary.
        IDA will check for the unicode strings only if the string style
        is set to "C-style (0 terminated)" or "Unicode".

Comment anonymous library functions

        This option appends a comment to anonymous library functions.
        The comment consists of the description of the FLIRT signature
        which has recognized the function and marked it as coming
        from a library.

Multiple copy library function recognition

        This option allows FLIRT to recognize several copies of the same
        function in the program.

Create function tails

        This option allows IDA to find and append separately located
        function tails to function definitions.

Automatically convert data to offsets

        This option allows IDA to convert all newly created data items
        to offsets if the following conditions are satisfied:
          - the offset target is a valid address in the program
          - the target address is higher than 0x20
          - the target does not point into the middle of an item
          - if the target is code, the execution does not flow to it
            from the previous instruction
          - the data is dword (4 bytes) in a 32-bit segment
            or qword(8 bytes) in a 64-bit segment
          - the segment type is not special (extern, communal, abs...)

See also analysis options 1


Rename to the Any Address

 Action    name: MakeAnyName

This command gives name/renames/deletes name for the specified address. This is a more powerful variant of Rename command.

To delete a name, simply give an empty name.

If the specified address is referenced, you can not delete its name. Even if you try, IDA will generate a dummy name.

You can include/remove the names using the name list too. If the name is hidden you will not see it in names window.

If this command is applied to a stack variable in an instruction, then IDA allows you to rename the stack variable.

For explanation of the dialog box entries please see the Rename current address command.

See also

         Edit|Other submenu.
         How to Enter an Identifier.
         Names representation.


Create segment - simple case

IBM PC case -----------

Suppose we need to create a segment occupying addresses F000:1000..F000:2000 Let's calculate linear addresses:

        start = (0xF000 << 4) + 0x1000 = 0xF1000
        end   = (0xF000 << 4) + 0x2000 = 0xF2000

The segment base must be selected so that the first offset in our segment will be 0x1000. Let's find it using the following equation:

        VirtualAddress = LinearAddress - (SegmentBase << 4);
        0x1000         = 0xF1000 - (base << 4);

After solving this equation we see that the segment base is equal to 0xF000. (you see, this is really a very simple case :)

Now, we can create a segment entering:

        segment start address:  0xF1000
        segment end address:    0xF2000
        segment base:           0xF000

Please note that the end address never belongs to the segment in IDA.

Go back to addressing space concepts


Create segment - simple case

 Z80 case
 --------

Suppose we need to create a segment occuping virtual addresses 8000-C000. Since we are free to place our segment anywhere in the linear address space, we choose the linear addresses at our convenience. Say, we choose a linear address 0x20000:

        start = 0x20000
        end   = start + 0x4000 = 0x24000

The segment base must be selected so that the virtual address in our segment will be 0x8000. Let's find it using the following equation:

        VirtualAddress = LinearAddress - (SegmentBase << 4);
        0x8000         = 0x20000 - (base << 4);
        base << 4      = 0x20000 - 0x8000
        base << 4      = 0x18000
        base           = 0x1800

After solving this equation we see that the segment base is equal to 0x1800.

Now we can create a segment entering:

        segment start address:  0x20000
        segment end address:    0x24000
        segment base:           0x1800

Please note that the end address never belongs to the segment in IDA.

Go back to addressing space concepts


Create segment - automatically chosen selector case

Suppose we need to create a segment occupying linear addresses 200000-200C00 and the virtual addresses must have be 0000..0C00. If we simply enter

        segment start address:  0x200000
        segment end address:    0x200C00
        segment base:           0x20000

Then IDA will notice that the segment base is too big and does not fit into 16bits. Because of this IDA will find a free selector (let's say it has found selector number 5), define it to point at paragraph 0x20000 and create a segment. After all this we will have:

        - a new selector is defined (5 -> 0x20000)
        - a new segment is created. Its attributes:
                start = 0x200000
                end   = 0x200C00
                base  = 5

The first virtual address in the segment will be 0:

        VirtualAddress = LinearAddress - (SelectorValue(SegmentBase) << 4)
                       = 0x200000      - (SelectorValue(5) << 4)
                       = 0x200000      - (0x20000 << 4)
                       = 0x200000      - 0x200000
                       = 0

Please note that the end address never belongs to the segment in IDA.

Go back to addressing space concepts


Create segment - user-defined selector case

If the previous example we saw how IDA allocates a selector automaticlly. You could make it yourself:

1. Create a selector. For this, open the selectors window and press Ins. Enter a selector number and its value.

2. Create a segment. Specify the selector number as the segment base.

Go back to addressing space concepts


If you can see this, your help file has no topics! See the status tab and webtwin.log for more information.

Note that it is important that you exit WebTwin first to make sure the log file is up to date.

Be aware that restarting WebTwin will cause the log file to be emptied, so check it before restarting.


This URL was excluded from the pulldown


The protocol used in this URL is not at present supported by WebTwin


This URL referenced an unknown protocol


This link was broken when WebTwin tried to fetch it


This URL contained unknown content


Robots are excluded from this URL


This link was not retrieved


This link was skipped because it was suspected to be an invalid URL


This link was skipped at user request


This link was skipped it was suspected to be CGI. This can be changed from the WebTwin Options tab.


This link was skipped it was an image, and the NoImages option was on. This can be changed from the WebTwin Options tab.


This link was skipped because either the user pressed the WebTwin 'Enough' button or the given retrieval time limit expired.


Registration information goes here