IDA’s behavior and defaults can be configured using the Options dialog, saved desktop layouts, or config files. However, sometimes the behavior you need depends on something in the input file and can’t be covered by a single option, or you may want IDA to do something additional after the file is loaded. Of course, there is always the possibility of making a plugin or a loader using IDA SDK or IDAPython, but it could be an overkill for simple situations. Instead, you can make use of several startup files used by IDA every time it loads a new file or even a previously saved database, and do the necessary work there.
The following files can be used for such purpose:
ida.idc
This file in idc subdirectory if IDA’s install is automatically loaded on each run of IDA and can be used to perform any actions you may need. The default implementation defines a utility class for managing breakpoints and a small helper function, but you can add there any other code you need. As an example, it has a commented call to change a global setting:
// uncomment this line to remove full paths in the debugger process options: // set_inf_attr(INF_LFLAGS, LFLG_DBG_NOPATH|get_inf_attr(INF_LFLAGS));
Instead of editing the file itself (which may have been installed in a read-only location), you can create a file idauser.idc with a function user_main() and put it in the user directory. If found, IDA will parse it and the main function of ida.idc will try to call user_main(). This feature allows you to keep the custom behaviour across multiple IDA installs and versions, without having to edit ida.idc every time.
onload.idc
This file is similar to ida.idc, but is only executed for newly loaded files. In it you can, for example, do some additional parsing and formatting to augment the behavior of the default file loader(s). The default implementation detects when a DOS driver (EXE or COM file with .sys or .drv extension) is loaded and tries to format its header.
Similarly to ida.idc, instead of editing the file itself, you can create a file named userload.idc in the user directory and define a function userload.
// If you want to add your own processing of newly created databases,
// you may create a file named "userload.idc":
//
// #define USERLOAD_IDC
// static userload(input_file,real_file,filetype) {
// ... your processing here ...
// }
//
#softinclude <userload.idc>
// Input parameteres:
// input_file - name of loaded file
// real_file - name of actual file that contains the input file.
// usually this parameter is equal to input_file,
// but is different if the input file is extracted from
// an archive.
// filetype - type of loaded file. See FT_.. definitions in idc.idc
idapythonrc.py
Unlike the previous examples, this a Python file, so it is only loaded if you have IDAPython installed and working. If the file is found in the user directory, it will be loaded and executed on startup of IDAPython, so you can put there any code to perform fine-tuning of IDA, add utility functions to be called from the CLI, or run any additional scripts.
Useful functions
Some functions which can be called from the startup files to configure IDA:
get_inf_attr()/ set_inf_attr()/set_flag(): read and set various flags controlling IDA’s behavior. For example, INF_AF can be used to change various analysis options.
process_config_directive(): change a setting using keyword=value syntax. Most settings from ida.cfg can be used, as well as some processor-specific or debugger-specific ones. A few examples:
process_config_directive("ABANDON_DATABASE=YES");: do not save the database on exit. Please note that this setting has a side effect in that it disables most user actions which change the database, for exampleMakeUnknown(U) orMakeCode(C).process_config_directive("PACK_DATABASE=2");: set the default database packing option to “deflate”;process_config_directive("GRAPH_OPCODE_BYTES=4");: enable display of opcode bytes in graph mode;- for more examples, see
ida.cfg(open it in any text editor).