IDA Tip of the week 01

Malware Analysis
1

This post starts a new blog series that will draw attention to tips and IDA functionalities which are not always known or obvious.

Today we will talk about using the keyboard in IDA. While nowadays most actions can be done with the mouse, it can be much faster or efficient to use the keyboard. IDA started as a DOS program, long before GUI and mouse became common which is why you can still do most of your work without touching the mouse.

While you can find most of the common shortcuts in the cheat sheet (HTML, PDF), there are also some which are less obvious.

Text input dialog boxes (e.g. Enter Comment or Edit Local Type)

use ctrl-enter

You can use Ctrl–Enter to confirm (OK) or Esc to dismiss (Cancel) the dialog. This works regardless of the button arrangement (which can differ depending on the platform and/or theme used).

Quick menu navigation

If you hold down Alt on Windows (or enable a system option), you should see underlines under the menu item names.

IDA menu with underlined accelerator keys

You can press the underlined letter (also known as “accelerator”) while holding down Alt to open that menu, and then press the underlined letter of the specific menu item to trigger it. The second step will work even if you release Alt. 

For example, to execute “Search > Not
function” (which has no default hotkey),
you can press Alt–H, F.
Although there may be no underlines on Linux or Mac, the same key sequence should still work.
If you don’t have access to a Windows IDA and don’t want to bruteforce accelerator keys manually, you can check the
<code>cfg/idagui.cfg</code> file which describes IDA’s default menu layout and all assigned accelerators (prefixed with &amp;).

</p><h3>Dialog box navigation</h3>

In addition to OK/Cancel buttons, many of IDA’s dialog boxes have checkboxes, radio buttons or edit fields. You can use the standard Tab key to navigate between them and Space bar to toggle, however, similarly to the menus, most dialog box controls in IDA have accelerator shortcuts. You can use Alt on Windows to reveal them but, unlike menus, they work even without Alt. For example. to quickly exit IDA discarding any changes made since opening the database, use this key sequence:

  • Alt–X (or Alt–F4) to show the “Save database” dialog
  • D to toggle the “DON’T SAVE the database” checkbox
  • Enter or Alt–K (or K) to confirm (OK)

dialog exit

NOTE: a few dialogs are excluded from this feature, for example the Options-General… dialog, also Script Command (Shift–F2) or other dialogs with a text edit box. In such dialogs you have to hold down Alt to use accelerators.

Article Link: https://www.hex-rays.com/blog/ida-tip-of-the-week-01/