Hex-Rays' blog

Igor’s tip of the week #33: IDA’s user directory (IDAUSR) – Hex Rays

Written by Igor Skochinsky | Apr 1, 2021

The user directory is a location where IDA stores some of the global settings and which can be used for some additional customization.

Default location 

On Windows: %APPDATA%/Hex-Rays/IDA Pro

On Linux and Mac: $HOME/.idapro

For brevity, we’ll refer to this path as $IDAUSRin the following text.

Contents/settings

The directory is used to store the processor module caches (proccache.lst and proccache64.lst) as well as the trusted database caches (trusted_i64_list.bin and trusted_idb_list.bin). Trusted databases are those that were authorized by the user to be run under debugger. The cache is used to prevent accidental execution of unknown binaries (for example, a database provided by a third party can contain a malicious executable path so it’s not run without confirmation by default).

On Linux and Mac, the user directory also contains the pseudo registry file ida.reg. It holds global IDA settings which are stored in the registry on Windows (for example, the custom desktop layouts).

If you modify or add shortcuts, modifications are stored in shortcuts.cfg in this directory.

Plugins

The user directory (more specifically, $IDAUSR/plugins) can be used for installing plugins instead of IDA’s installation directory. This has several advantages:

  1. No need for administrative permissions on Windows;
  2. The plugins can be shared by multiple IDA installs or versions, so there’s no need to reinstall plugins in new location when installing a new IDA version;
  3. plugins in the user directory can override plugins with the same name in IDA’s directory so this feature can be used to replace plugins shipped with IDA.

Both native (C++) and scripted (Python/IDC) plugins can be used this way.

Config files

To change some default options, you sometimes need to edit configuration files in IDA’s cfg subdirectory (for example, ida.cfg or hexrays.cfg). Instead of editing them in-place, you can extract only the options you need to change and put them into the same-named file in $IDAUSR/cfg. Unlike the plugins, the config files don’t override IDA’s files completely but are applied additionally. For example, to enable synchronization and split view for the decompiler, put the following lines in $IDAUSR/cfg/hexrays.cfg:

//--
PSEUDOCODE_SYNCED=YES
PSEUDOCODE_DOCKPOS=DP_RIGHT
//--

Other addons

The user directory can also be used to provide additional loaders, processor modules, type libraries and signatures. IDA will scan the following directories for them:

$IDAUSR/loaders
$IDAUSR/procs
$IDAUSR/til/{processor}
$IDAUSR/sig/{processor}

IDAPython

If a file named idapythonrc.py is present in the user directory, it will be parsed and executed at the end of IDAPython’s initialization. This allows you, for example, to add custom IDAPython functions, preload some commonly used scripts, or do any other customization that’s more convenient to do in Python code.

Overriding the user directory location

If you prefer to use a custom location for user settings or need several sets of such directories, you can set the IDAUSR environment variable to another path (or even a set of paths) before running IDA.

Debugging

If you copied files to the correct location but IDA does not seem to pick them up, you can use the -z commandline switch to confirm that it’s finding your file. For example, the following command line enables debug output of processing of all types of customizations (plugins, processor modules, loaders, FLIRT signatures, config files) and also copies the debug output to a log file:

ida -zFC -Lida.log file.bin

Among the output, you should see lines similar to following:

Scanning plugins directory C:\Users\Igor\AppData\Roaming\Hex-Rays\IDA Pro\plugins, for *.dll.
Scanning plugins directory C:\Users\Igor\AppData\Roaming\Hex-Rays\IDA Pro\plugins, for *.idc.
Scanning plugins directory C:\Program Files\IDA Pro 7.6\plugins, for *.dll.
Scanning plugins directory C:\Program Files\IDA Pro 7.6\plugins, for *.idc.
<...>
Scanning directory 'C:\Users\Igor\AppData\Roaming\Hex-Rays\IDA Pro\loaders' for loaders

So you can verify whether IDA is looking in the expected location.

For even more details on this feature, please check Environment variables (IDAUSR section).