Igor’s tip of the week #47: Hints in IDA

Hints (aka tooltips) are popup windows with text which appear when you hover the mouse cursor over a particular item in IDA. They are available in many situations.

Disassembly hints

In the disassembly view, hints can be shown in the following cases:

1. When hovering over names or addresses, a fragment of disassembly at the destination is shown. 
   
2. When hovering over stack variables, a fragment of the stack frame layout is shown
   
3. When hovering  over structure offset operands, the fragment of the struct definition.
   
4. For enum operands – the enum with the definition.
   
5. For renamed registers, the hint shows the original register name
   

All these hints except the last one can be expanded or shrunk using the mouse wheel.

Decompiler hints

In the pseudocode, the hints are shown for:

1. Local variables and current function arguments: type and location (register or stack).
   
2. global variables: type.
   
3. structure or union members: member type and offset.
   
4. function calls: prototype and information about arguments and return value.
   
5. other expressions and operators: type, signedness, etc.
   

Debugger hints

During debugging, the hints behave mostly in the same way but with addition of dynamic information:

1. In the disassembly view, hovering on instruction operands shows a hint with their values and, if the value resolves to a valid address, a fragment of memory at that address.
   
2. In pseudocode, values of variables are shown in hints.
   

Configuring hints

The way hints work can be configured via Options > General…, Browser tab. You can set how many lines are displayed by default and the delay before the hint is shown. The hints can be disabled completely by setting the number of lines to 0, or only disabled during the debugging (showing the hint during debugging may lead to memory reads which can be slow in some situations).

See also: Browser options