Last changed: 28.07.2020

IDA Pro basics

Here you can find some of the most useful commands and shortcuts for IDA Pro.

navigation

g           goto symbol/location
Enter       step into selected location
ESC         go back
Ctrl+Enter  go forward
Numpad-/+   enter/leave proximity view
Ctrl+x/j    show xrefs to/from
Ctrl+l      search by label/name

searching

Alt+i       search immediate value
Ctrl+i      next immediate value
Alt+t       search text
Ctrl+t      next text
Alt+b       search bytes (use '?' for wildcards)
Ctrl+b      next bytes

strings

Shift+F12   show strings

Right click and open Setup... do choose which string types should be searched for.

renaming

functions

n           rename function/variable/argument
y           edit function signature
p           define function
e           set function end
Alt+p       change function characteristics (e.g. noreturn)

data interpretation

h, q, r     display operand as decimal/hex/string
_           toggle signed/unsigned
o           interpret operand as data/memory location
c, a, t     interpret as code/ascii string/struct
Alt+a       select string style (e.g. 'unicode')
d           interpret as raw data/data carousel
*           create array
u           undefine

comments

:           local comment
;           repeatable comment

graph view

w           zoom to fit window
1           zoom to 100%

grouping nodes

Hold Ctrl to select multiple nodes in graph view. Then use the context menu to group them. Afterwards you can hide/collapse all groups from the context menu to improve readability.

display settings

To temporarily change the configuration the menu inside IDA Pro can be used.

Options->General 
    Line prefixes
    Number of Opcode bytes 8
    Instruction Intendation 10

Global settings can be changed in the config files IDA.CFG, IDATUI.CFG or IDAGUI.CFG.

IDA.CFG

OPCODE_BYTES            = 8
GRAPH_SHOW_LINEPREFIXES     = YES

IDAGUI.CFG

Depending on your filename policy it could be helpful to set the default file filter to all file types.

DEFAULT_FILE_FILTER = { ALL KNOWN IDB EXE DLL DRV OBJLIB JAVA NET DRV_NETWARE GEOS EXE_FLEX EXE_RT11 ARM EPOC SPSX EXE_PALM EXE_XBOX EXE_N64 EXE_SDC HEX MAS SBN RAW_BIN ROM_BIN DUMP_BIN }

finding call paths with proximity view

In proximity view you can try to find a path between different functions. Use the context menus to Collapse children, Collapse parents and Add node by name to reduce the view to the functions you are interested in. Then use Find path and Paths -> Func_A => Func_B -> Details to show a list.

debug dll export with ida

Select the Windows Debugger in IDAs drop-down menu. Then configure the Debugger -> Process options... as follows


Application	`C:\Windows\System\rundll32.exe` (or `SysWOW64` resp.)
Input File	`<dll>`
Directory	`<directory>`
Parameters	`<dll>,<export>`

ida python

You can find information about the python API in the hex rays documentation or the source code on github.

IDA Pro supports both Python2 and Python3. To switch the language version create an empty file called use_python2.

echo '' >  'C:\Program Files\IDA Pro 7.5\python\use_python2'
del 'C:\Program Files\IDA Pro 7.5\python\use_python2'

debugging with ida

remote gdb debugger

gdbserver --once 0.0.0.0:23946 ./my_app < <(echo -e "input\n")

Select Remote GDB debugger in IDA Pro and set the correct ip address in Debugger -> Process options...

Alternatively there are some debugging server binaries in the dbgsrv folder of IDA Pro.

export database to x64dbg

The plugin x64dbgida can be used to convert the ida database into a database for x64dbg.

In x64dbg you can use File -> Import database to load the database.

binary diffing

bindiff

The bindiff plugin can be downloaded from zynamics.com. Make sure to give it the correct IDA Pro installation path during installation.

To run it press Ctrl + 6 and select the IDA database to diff against. In the new Matched Functions tab you can select View flow graphs from the context menu for a graphical view.

diaphora

A free alternative is diaphora. Just run the diaphora.py from a file you want to diff and create a sqlite database from it. Then run the script again from the other file to diff and select that database.

To show differences select the function you are interested in in the Partial matches tab and select Diff assembly from the context menu.