Igor’s Tip of the Week #154: Synchronized views

When working with a binary in IDA, most of the time you probably use one of the main views: disassembly (IDA View) or decompilation (Pseudocode). If you need to switch between the two, you can use the Tab key – usually it jumps to the the same location in the other view. If you want to consult disassembly and pseudocode at the same time, copying pseudocode to disassembly is one option, however it is of rather limited usefulness. You can dock two view side-by-side and Tab between them, but this can be rather tedious.

Synchronizing views

To ensure that position in one view follows another automatically, select it in the “Synchronize with” context submenu.

Now, if you place disassembly and pseudocode side-by-side, the cursor position will be synchronized automatically when navigating in either window. The matching lines are also helpfully highlighted. Because a single pseudocode line may be represented by several assembly instructions and vice versa, the match is not one-to-one.

Any view which displays information tied to addresses can be synchronized to another. As of IDA 8.3 these include:

Disassembly (IDA View)
Decompilation (Pseudocode)
Hex View

You can even sync more than two views at the same time, although this has to be done in a specific sequence. For example:

Synchronize IDA View-A and Pseudocode-A
Synchronize Hex View with the other pair

Synchronizing to registers in debugger

During debugging, an additional feature is available: synchronizing a view to a register value. You may have noticed that during debugging the default disassembly view changes name to IDA View-EIP (IDA View-RIP for x64 or IDA View-PC for ARM). This is because cursor follows the current execution address stored in the corresponding processor register.

You can also synchronize the default Hex View to a register, or open additional views if you need to follow a specific one. For this, use “Open register window” from the context menu on the register in the registers view.