Igor’s tip of the week #31: Hiding and Collapsing

Malware Analysis
1

You may have come across the menu items View > Hide, Unhide but possibly never used them.

These commands allow you to hide, or collapse and unhide/uncollapse parts of IDA’s output. They can be used in the following situations:

Hiding instructions or data items

To make your database more compact and reduce clutter, you can opt to hide or replace some parts of the listing by short text:

    1. Select some instructions or data items
    2. Invoke View > Hide (or press Ctrl+Numpad-)
    3. Enter the text with which to replace the selected area (and optionally pick a color)

The instructions/data are replaced by the entered text but are not removed from the database; you can reveal them using View > Unhide (or Ctrl+Numpad+).

Hiding whole functions

You can also hide or collapse whole functions by using the Hide command while the cursor is on the function’s name:

763×387

You may have already seen the “COLLAPSED FUNCTION” text for library functions detected by the FLIRT signatures (colored cyan in the function list and navigation bar). The actual implementation of library functions is rarely important for analyzing the program’s code so IDA collapses them to not distract the user. 

Hiding structures and enums

Structure or enum definitions can be collapsed and uncollapsed similarly to functions.

719×759

Terse struct representation

When defining structure instances in data, IDA will by default try to display them in terse form, with everything on one line. By using Unhide, you can have it printed in full, or verbose form, with each field on separate line and a comment with the field name.

703×322

Conversely, you can use Hide to collapse a structure instance into a terse form (this may not work in some cases due to the specific structure’s layout).

Collapsing blocks in decompiler

The decompiler also has similar but separate pair of actions. They are available in the context menu or via the Numpad- and Numpad+ hotkeys. You can collapse compound operators, as well as the variable declaration block at the start of the function.

More info:

Hide and Unhide (IDA)

Collapse/uncollapse item (Decompiler)

Article Link: https://www.hex-rays.com/blog/igors-tip-of-the-week-31-hiding-and-collapsing/