Igor’s tip of the week #05: Highlight – Hex Rays

In IDA, highlight is the dynamic coloring of a word or number under the cursor as well as all matching substrings on the screen. In the default color scheme, a yellow background color is used for the highlight.

Highlight is updated when you click on a non-whitespace location in the listing or move the cursor with the arrow keys. Highlight is not updated (remains the same) when:

• moving the cursor with PgUp, PgDn, Home, End;
• scrolling the listing with mouse wheel or scroll bar;
• using Jump commands or clicking in the navigation band (unless the cursor happens to land on a word at the new location);
• highlight is locked by the LockHighlight action (it is one of the handful of actions which are only available as a toolbar button by default).

Register highlight

For some processors, highlighted registers are treated in a special way: not only is the same register highlighted but also any register which contains it or is a part of it. For example, on x86_x64, if ax is selected, then al, ah, eax and rax get highlighted too.

Manual highlight

In addition to the automatic highlight by clicking on a word/number, you can also select an arbitrary substring using mouse or keyboard and it will be used to highlight all matching sequences on the screen. For manual highlight, only exactly matching substrings are highlighted — there is no special handling for the registers.

Highlight navigation

You can quickly jump between highlighted matches using Alt–Up and Alt–Down. This works even if the closest match is not on screen — IDA will look for next match in the selected direction.

Highlight is available not only in the disassembly listing but in most text-based IDA subviews: Pseudocode, Hex View, Structures and Enums.