IDA (Interactive Disassembler) tips and tricks

makeing sense of listing output

I use this c++ program to parse LST output files into a nested callflow. this sometimes gives a clearer view of what is happening.
you can find a compiled version here.

how to setup stackframes

left are disassembled example instructions, right is the action to take based on that line. alt-k should be executed on the line with 'sub' alt-p anywhere in the function. sometimes the keyboard shortcut 'alt-p' does not work, in that case just choose it from a menu. 
stmfd sp!, {r4-r7,lr}     -> [alt-p] set sizeof saved regs to 0x10
sub sp,sp,#0x24           -> [alt-p] set sizeof locals to 0x24
                          -> [alt-k] set sp diff to -0x10-0x24

       ... [sp,#4]       'k'  set to stack var
sometimes a function wants to take a pointer of one of the first 4 arguments, for instance in this simple example: 
int somefunction(FILE *f, char c)
{
    return fwrite(&c, 1, 1, f);
}
in that case the start of the function will look like this: 

stmfd sp!, {r0}           -> do not count these in the save regs count.
stmfd sp!, {r4-r7,lr}     -> [alt-p] set sizeof saved regs to 0x10
sub sp,sp,#0x24           -> [alt-p] set sizeof locals to 0x24
                          -> [alt-k] set sp diff to -0x10-0x24

       ... [sp,#4]       'k'  set to stack var

writing IDA extensions

several ida extensions are possible:
extensiondescriptioninterface structheaderfile
idpprocessor moduleprocessor_t LPHidp.hpp
plwpluginplugin_t PLUGINloader.hpp
ldrloaderloader_t LDSCloader.hpp

idc tips and tricks

easy execute of current (shift-f2) idc code

The current shift-f2 manual idc code is stored in idc function named _idc. if you add a hotkey AddHotkey("Shift-I", "_idc"); you can call the current idc func at any time with an easy shortcut. ( without having to type shift-f2 + alt-enter )

example usage: 

    auto ea,b;
    for (ea=SelStart(); ea<SelEnd() ; ea=ea+4) { MakeUnkn(ea,0); }
    b=SelStart()+4;
    MakeDword(b-4);
    MakeArray(b-4, (SelEnd()-SelStart())/4);
    OpOffset(b-4, b);
i use this piece of idc code to convert unrecognised jumptables into a jumptable. I use text search (alt-t) to search for regular expression "PC,.*," then select the unrecognised data part, press shift-I. see if it was correct. then ctrl-t to find the next.

define functions without having to run an .idc file

if you start the contents of the shift-f2 manual idc window with '}' and follow it with a function definition like 'static fname() {...' and omit the terminating '}'
you can add idc functions interactively.

example usage: 

  AddHotkey("Shift-O", "HK_showrefs");
}
static HK_showrefs() {
    auto ea,r;
    ea=ScreenEA();
    Message("%08lx: Rfirst/Rnext: ", ea);
    for (r=Rfirst(ea); r!=-1 ; r=Rnext(ea,r)) { Message(" %08lx", r); }
    Message("\n");

    Message("%08lx: RfirstB/RnextB: ", ea);
    for (r=RfirstB(ea); r!=-1 ; r=RnextB(ea,r)) { Message(" %08lx", r); }
    Message("\n");

    Message("%08lx: Dfirst/Dnext: ", ea);
    for (r=Dfirst(ea); r!=-1 ; r=Dnext(ea,r)) { Message(" %08lx", r); }
    Message("\n");

    Message("%08lx: DfirstB/DnextB: ", ea);
    for (r=DfirstB(ea); r!=-1 ; r=DnextB(ea,r)) { Message(" %08lx", r); }
    Message("\n");
this will add a function for hotkey shift-o. which will display all references to and from the cursor address

things I would like to see in IDA

note: this list is only added to, over the years, several of these issues have been resolved in ida now.

things to investigate