Skip to content

Analyzing and Reversing Malicious Code

IDA Pro Cheat Sheet

IDA Pro Cheat Sheet

Based on the PDF from Hex-Rays.

File Operations

Action	Shortcut
Parse C Header file	`Ctrl`+`F9`
Create ASM file	`Alt`+`F10`
Save	`Ctrl`+`W`
Exit with Save	`Alt`+`X` or `Alt`+`F4`

Action	Shortcut
Jump to operand	`Enter`
Jump in new window	`Alt`+`Enter`
Jump to previous position	`Esc`
Jump to next position	`Ctrl`+`Enter`
Jump to address	`G`
Jump by name	`Ctrl`+`L`
Jump to function	`Ctrl`+`P`
Jump to segment	`Ctrl`+`S`
Jump to segment register	`Ctrl`+`G`
Jump to problem	`Ctrl`+`Q`
List xrefs to ...	`Ctrl`+`X`
Jump to xref to operand	`X`
Jump to entry point	`Ctrl`+`E`
Mark position	`Alt`+`M`
Jump to marked position	`Ctrl`+`M`
Error operand	`Ctrl`+`F`

Search

Action	Shortcut
Next code	`Alt`+`C`
Next data	`Ctrl`+`D`
Next explored	`Ctrl`+`A`
Next unexplored	`Ctrl`+`U`
Immediate value	`Alt`+`I`
Next immediate value	`Ctrl`+`I`
Text	`Alt`+`T`
Next text	`Ctrl`+`T`
Sequence of bytes	`Alt`+`B`
Next sequence of bytes	`Ctrl`+`B`

Edit (Datatypes, etc.)

Action	Shortcut
Rename	`N`
Enter repeatable comment	`;`
Enter comment	`:`
Begin selection	`Alt`+`L`
Code	`C`
Data	`D`
Struct var	`Alt`+`Q`
String	`A`
Array	`*`
Undefine	`U`
Enter anterior lines	`Ins`
Enter posterior lines	`Shift`+`Ins`
Offset (data segment)	`O`
Offset (current segment)	`Ctrl`+`O`
Offset by (any segment)	`Alt`+`R`
Offset (user-defined)	`Ctrl`+`R`
Offset (struct)	`T`
Number (default)	`#`
Hexadecimal	`Q`
Decimal	`H`
Binary	`B`
Character	`R`
Segment	`S`
Enum member	`M`
Stack variable	`K`
Change sign	`_`
Bitwise negate	`~`
String literals	`Alt`+`A`
Setup data types	`Alt`+`D`
Edit segment	`Alt`+`S`
Change segment register value	`Alt`+`G`
Struct var	`Alt`+`Q`
Select union member	`Alt`+`Y`
Undo	`Ctrl`+`Z`
Redo	`Ctrl`+`Shift`+`Z`

Opne Subviews

Action	Shortcut
Local types	`Shift`+`F1`
Functions	`Shift`+`F3`
Names	`Shift`+`F4`
Signatures	`Shift`+`F5`
Segments	`Shift`+`F7`
Segment registers	`Shift`+`F8`
Structures	`Shift`+`F9`
Enumerations	`Shift`+`F10`
Type libraries	`Shift`+`F11`
Strings	`Shift`+`F12`

Functions

Action	Shortcut
Create function	`P`
Edit function	`Alt`+`P`
Set function end	`E`
Stack variables	`Ctrl`+`K`
Change stack pointer	`Alt`+`K`
Rename register	`V`
Set type	`Y`

Lumina

Action	Shortcut
Pull all metadata	`F12`
Push all metadata	`Ctrl`+`F12`
View all metadata	`Alt`+`F12`

Debugger

Action	Shortcut
Add breakpoint	`F2`
Start process	`F9`
Terminate process	`Ctrl`+`F2`
Step into	`F7`
Step over	`F8`
Run until return	`Ctrl`+`F7`
Run to cursor	`F4`
Breakpoint list	`Ctrl`+`Alt`+`B`
Stack trace	`Ctrl`+`Alt`+`S`

Dialog Boxes

Action	Shortcut
Navigate	`Tab` or `Shift`+`Tab`
Toggle	`Space`
Confirm	`Enter` or `Alt`+`K` or `Ctrl`+`Enter`
Cancel	`Esc` or `Alt`+`F4`

Miscellaneous

Action	Shortcut
Calculator	`?`
Windows list (next)	`Ctrl`+`Tab`
Switch to window #1…9	`Alt`+`1..9`
Close window	`Alt`+`F3`
Script command	`Shift`+`F2`
Exit	`Alt`+`X`