When reverse-engineering, sometimes you need to perform some simple calculations. While you can always use an external calculator program, IDA has a built-in one. You can invoke it by pressing ? or via View > Calculator.
The calculator shows the result in hex, decimal, octal, binary and as a character constant. This information is also duplicated […]
Even if you prefer to move around IDA by clicking, the G shortcut should be the one to remember. The action behind it is called simply “Jump to address” but it can do many more things than what can be guessed from the name.
Jump to address
First up is the actual jumping to an address: enter an […]
Previously we’ve covered cross-references in the disassembly view but in fact you can also consult them in the decompiler (pseudocode) view.
Local cross-references
The most common shortcut (X) works similarly to disassembly: you can use it on labels, variables (local and global), function names, but there are some differences and additions:
for local variables, the list of […]
Cross references view
The jump to xref actions are good enough when you have a handful of cross-references but what if you have hundreds or thousands? For such cases, the Cross references view may be useful. You can open it using the corresponding item in the View > Open Subviews menu. IDA will gather cross-references to […]
cross-reference, n.
A reference or direction in one place in a book or other source of information to information at another place in the same work
(from Wiktionary)
To help you during analysis, IDA keeps track of cross-references (or xrefs for short) between different parts of the program. You can inspect them, navigate them […]
The “I” in IDA stands for interactive, and one of the most common interactive actions you can perform is adding comments to the disassembly listing (or decompiler pseudocode). There are different types of comments you can add or see in IDA.
Regular comments
These comments are placed at the end of the disassembly line, delimited by an […]
Most of IDA users probably analyze software that uses English or another Latin-based alphabet. Thus the defaults used for string literals – the OS system encoding on Windows and UTF-8 on Linux or macOS – are usually good enough. However, occasionally you may encounter a program which does use another language.
Unicode strings
In case the program […]
Sometimes you know the structure size but not the actual layout yet. For example, when the size of memory being allocated for the structure is fixed:
In such cases, you can quickly make a dummy structure and then modify it as you analyze code which works with it. There are several approaches which can be used […]
When reverse engineering a big program, you often run into information stored in structures. The standard way of doing it involves using the Structures window and adding fields one by one, similar to the way you format data items in disassembly. But are there other options? Let’s look at some of them.
Using already formatted data
This […]
Arrays are used in IDA to represent a sequence of multiple items of the same type: basic types (byte, word, dword etc.) or complex ones (e.g. structures).
Creating an array
To create an array:
Create the first item;
Choose “Array…” from the context menu , or press *;
Fill in at least the Array size field and click OK.
Step 1 […]