Igor’s Tip of the Week #123: Opcode bytes

When disassembling, you are probably more interested in seeing the code (disassembly or pseudocode) rather than the raw file data, but there may be times you need to see what actually lies behind the instructions.

One option is to use the Hex View, possibly docked and synchronized with IDA View.

But probably a simpler solution is the disassembly option Number of opcode bytes.

By setting it to a non-zero value, IDA will use the specified number of columns to display the bytes of the instructions at the start of the disassembly line.

If the instruction is longer than the specified number of bytes, extra lines will be used to display the remainder of the opcode:

If you prefer to have IDA simply truncate the long opcodes instead of using extra lines, specify a negative value (e.g. -4).

Showing opcode bytes by default

If you prefer to always see opcode bytes, you can use the OPCODE_BYTES setting in ida.cfg (either the one in your IDA install, or the override in user directory). This enables opcode bytes in the text view only; for the graph view use the setting GRAPH_OPCODE_BYTES.

Another possibility is set up the opcode bytes (and other disassembly options) as you like and save the current desktop layout as default; it will be used for all new databases.

See also:

IDA Help: Text Representation Dialog

Igor’s tip of the week #38: Hex view – Hex Rays

Igor’s tip of the week #25: Disassembly options

Igor’s tip of the week #22: IDA desktop layouts