Graph view is the default disassembly representation in IDA GUI and is probably what most IDA users use every day. However, it has some lesser-known features that can improve your workflow. Parts of the graph The graph consists of nodes (blocks) and edges (arrows between blocks). Each node roughly corresponds to a basic block. a basic block is a straight-line […]
Read MoreIDA’s default windows layout is sufficient to perform most standard analysis tasks, however it may not always be the best fit for all situations. For example, you may prefer to open additional views or to modify existing ones depending on your monitor size, specific tasks, or the binary being analyzed. Rearranging windows The standard operation is mostly […]
Read MoreWhen reverse-engineering, sometimes you need to perform some simple calculations. While you can always use an external calculator program, IDA has a built-in one. You can invoke it by pressing ? or via View > Calculator. The calculator shows the result in hex, decimal, octal, binary and as a character constant. This information is also duplicated […]
Read MoreEven if you prefer to move around IDA by clicking, the G shortcut should be the one to remember. The action behind it is called simply “Jump to address” but it can do many more things than what can be guessed from the name. Jump to address First up is the actual jumping to an address: enter an […]
Read MoreWhen dealing with big programs or huge functions, you may want to know how various functions interact, for example where the current function is called from and what other functions it calls itself. While for the former you can use “Cross-references to”, for the latter you have to go through all instructions of the function […]
Read MoreIDA Pro for ARM64 is coming! We have ported all of IDA to run natively on Apple Silicon and it will be available in IDA 7.6. Initial analysis shows that the hype is real. IDA is consistently performing much faster on M1 macs: And a visual representation, for your viewing delight: https://www.hex-rays.com/wp-content/uploads/2020/12/split.mp4 We have also ported the mac […]
Read MorePreviously we’ve covered cross-references in the disassembly view but in fact you can also consult them in the decompiler (pseudocode) view. Local cross-references The most common shortcut (X) works similarly to disassembly: you can use it on labels, variables (local and global), function names, but there are some differences and additions: for local variables, the list of […]
Read MorePython 3.9 has been released fairly recently and it was a bit too short notice for us to ensure it works with IDA 7.5 Service Pack 3 (if you have tried it, you may have had a bad time.) We have now added support for Python 3.9 in IDAPython. Here’s how you can get it to […]
Read MoreCross references view The jump to xref actions are good enough when you have a handful of cross-references but what if you have hundreds or thousands? For such cases, the Cross references view may be useful. You can open it using the corresponding item in the View > Open Subviews menu. IDA will gather cross-references to […]
Read Morecross-reference, n. A reference or direction in one place in a book or other source of information to information at another place in the same work (from Wiktionary) To help you during analysis, IDA keeps track of cross-references (or xrefs for short) between different parts of the program. You can inspect them, navigate them […]
Read More