Latest available version: IDA and decompilers v8.4.240527sp2 see all releases
Hex-Rays logo State-of-the-art binary code analysis tools
email icon
If IDA suspects that an operand can be represented as something different from a plain number, it will mark the operand as "suspicious" and display it in red/orange.

Two values control the definition of suspiciousness. An operand is 'suspicious' if it has an immediate value between low and high 'suspicious' limits. The comparison is always unsigned, i.e. in the instruction

        mov ax,[bp-2]
  the immediate operand is 0xFFFE, not -2.

IDA uses a simple heuristic to determine initial suspiciousness limits. You may change these limits any time you want.

See also

         Comments Dialog
         How to Enter a Number.
Index | Previous topic | Next topic