Igor’s tip of the week #96: Loading additional files

Although most of the time IDA is used to work on single, self-contained file (e.g. an executable, library, or a firmware image), this is not always the case. Sometimes the program may refer to or load additional files or data, and it may be useful to have that data in the database and analyze it together with the original file.

Load Additional Binary File

For simple cases where you have a raw binary file with the contents you want to add to the database, you can use File > Load file > Additional binary file…

Please note that any file you select will be treated as raw binary, even for formats otherwise supported by IDA (e.g. PE/ELF/Mach-O). Once you select a file, IDA will show you the dialog to specify where exactly you want to load it:

Loading segment and Loading offset together specify the location where you want to load the file’s data. By default, IDA tries to pick the values which are located just after the end of the last segment of the database in such a way that the newly loaded data starts at offset 0 in the new segment. However, if you are working with flat memory layout binary such as the case with most of modern OSes, you should instead set the segment value to 0 and offset to the linear address where you need to have the data loaded.

File offset in bytes and Number of bytes specify what part of the file you need loaded. With the default values IDA will load the whole file from the beginning, but you can also change them to load only a part of it.

Create segments is checked by default because in most cases the file is being loaded into a new address range which does not exist in the database. If you’ve already created a segment for the file’s data or plan to do it after loading the bytes, you can uncheck this checkbox.