Igor’s tip of the week #37: Patching

Although IDA is mostly intended to be used for static analysis, i.e. simply looking at unaltered binaries, there are times you do need to make some changes. For example, you can use it to fix up some obfuscated instructions to clean up the code flow or decompiler output, or change some constants used in the […]

Igor’s tip of the week #36: Working with list views in IDA

List views (also called choosers or table views) are used in many places in IDA to show lists of different kind of information. For example, the Function list we’ve covered previously is an example of a list view. Many windows opened via the View > Open subviews menu are list views: Exports Imports Names Strings Segments Segment registers Selectors Signatures Type libraries Local types Problems Patched […]

Igor’s tip of the week #34: Dummy names

In IDA’s disassembly, you may have often observed names that may look strange and cryptic on first sight: sub_73906D75, loc_40721B, off_40A27C and more. In IDA’s terminology, they’re called dummy names. They are used when a name is required by the assembly syntax but there is nothing suitable available, for example the input file has no […]

Igor’s tip of the week #31: Hiding and Collapsing

You may have come across the menu items View > Hide, Unhide but possibly never used them. These commands allow you to hide, or collapse and unhide/uncollapse parts of IDA’s output. They can be used in the following situations: Hiding instructions or data items To make your database more compact and reduce clutter, you can opt to hide […]

Igor’s tip of the week #30: Quick views

IDA has three shortcuts as an alternative to some menus which could be cumbersome to navigate. Quick view Probably the most commonly used, it is triggered by the shortcut Ctrl+1 and shows the items under the View > Open subviews menu. It can be especially useful for opening views which have no dedicated shortcut such as Notepad (although […]

Igor’s tip of the week #06: IDA Release notes

With every IDA release, we publish detailed release notes describing various new features, improvements and bugfixes. While some of the additions are highlighted and therefore quite visible, others are not so obvious and may require careful reading. Having a closer look at these release notes, you will be surprised to see many small but […]

Igor’s tip of the week #04: More selection!

In the previous post we talked about the basic usage of selection in IDA. This week we’ll describe a few more examples of actions affected by selection. Firmware/raw binary analysis When disassembling a raw binary, IDA is not always able to detect code fragments and you may have to resort to trial & error for finding the code […]

Igor’s tip of the week #03: Selection in IDA

This week’s post is about selecting items in IDA and what you can do with the selection. As a small change from the previous posts with mainly keyboard usage, we’ll also use the mouse this time! Actions and what they are applied to When an action is performed in IDA, by default it is applied only to the […]