HF:kvüÉó░╡╛╞╘∞
O
e
ä
│
╜
σ
Q╢≥2P}¬┘┤╛▄µ≡2hï╣╫(JT╖ÿ─ "ë"▒$╥%Z&`'▓(°)b,∞,≡.╠/ú02┬2û3 4≈4┘5q6<8≤:┬<n>ü>Ü>¼>┐>╫>??#?=?k?;@u@AXAB5BVBÇB⌐B┌BC)CVCC«C▀CD<DVDyDìDóD▓D╩D┌D≈D(E<ESEvEôE⌐E┴E∞EF*FHFVFçF¼F┬F╙FGG8GKGSG[GcGkGrG~GÆG£G▓G║G┬G╦G╘G▌GµG±G√GHHH"H,H;HJHXHhHöH║H╥HΩHI+IfIÅI│IµIJ%JYJ~JñJ█JK)KnKïK├K⌡KL[LwLòL╗L╘LΩLM*MLM{MñMεMNHNbNvNºN╟NΩN OQOéO⌐O╒OP
PP:PrPÉP╣P╞PQ@QfQèQ╒Q■QºR╒R≡R√RSSS&S4SBSPS\SñSßSTATKTRTêT¬T╣T≤TUHUwUúU╓U	V5VcVæV┼V∙V-WWW~W¿W┬W╙WΓWφWXX(X;XQXXXgXäXÖX▒X▌X#Y>Y]YîYºY┤Y╛Y╩Y╥Y▀YδY·Y	ZZ3Z\ZnZâZÜZñZ«Z╢Z╛Z╠Z▄ZεZ[[&[:[L[Z[j[u[ç[Æ[Ü[º[╬[▐[Ω[ⁿ[\\)\a\\Ñ\Ω\,]Y]r]F_│_öaαbòc±d\eYf└f g,j╣jMl,m ngpMqfr3s½s╔x ~ƒÇ{éèâbä₧ä╧ä■ä"àdàÑà╘àåYåzåùå╧åç'çUçêâëçëÉë¥ëªë▓ë╗ë╟ë╨ë▌ëµë⌠ëèè è)è6è?èIèRè^èjèyèçè¥è¬è╟è╨èαèφèïï/ïDïYïmïvïäïÿïíï╡ï╙ïτïîî,î7îLî^înî|îèîÿî¼î╜î╦î▐îτî⌡îìì+ì8ìEìNìWìnìxìéìÅì⌐ì╨ì∩ìÄ,ÄEÄaÄÄ£Ä╣Ä╧ÄεÄ
Å%Å=ÅVÅlÅ~Å₧Å╚Å≥ÅÉFÉkÉÉÉƒÉ½É╗É╤ÉαÉ■Éæ+æ;æNæhæüæöæ▓æ╦æΩæÆÆÆ)Æ3ÆQÆgÆ}ÆÿÆ«Æ┼Æ∞Æô)ôKô[ôkôÇôæôúô│ô╤ôΘô√ô
öö$öBödö}öôöªö¡ö╢ö┐ö╚ö╤ö┌öπöòò-ò╡ò╧û ùZùüùÿΣ¢'£X£é£¼£╠¥∙ƒàáíóí╕í┘íó0ó_óôó╟óúú?úGú¼ú╖ú╫ú²úñ<ñnñôñ«ñ╜ñ▄ñ√ñÑ9Ñ[Ñ}Ñ£Ñ╠ÑⁿÑEªtªûª╕ª╦ª█ªººBºmºÿº╜º╙º⌡º¿A¿n¿▒⌐ÿ¬┴¬½Q½o½α½·½$¼w¼¢¼╙¼¡"¡;¡Y¡ê¡╖¡σ¡«N«~«¬«┴«φ«»`»Ç»╡»╫»√»(░V░ï░⌐░╞░π░▒▒,▒F▒V▒d▒t▒ë▒₧▒╣▒╫▒·▒▓+▓G▓U▓e▓ä▓á▓Ñ▓D┤5╕║Θ╗╙╜M└α╞±╤╙▌▐τ-Θ∞Φεv±Γ⌡~	[
▓╩
=K┤Σgpd¢h!∞"═$ε&D))+,-A.▐/c46ï7
9B:╤;"=K>µ?MB-EJ5LFNiP$TVôW┤Y3\*^┴_haùb≥d=f¢h&j=lεl.o·p┌sΩuñy║{╨}╬Ç┤ü·éïä¼à╩å▓êtëôèüîÇÄ╡ÅjÆ?ò╕ûmÿû¢ê£s¥≥ƒí%ó\úvñåÑ╠ª═º÷¿¬"¼
»╢▒ß▓>┤f╢K╕â║▌╗╜j╛ú┐E┴┼┬u─╞²╟Ö╦é═F╨φ╤╙╘α╒A╫(┘û▄ε▌┤▀âαΩßñπYΣèσ╬µ>Φ)ΩWδQφqε╟∩±X≤í⌡h÷{°à√ÿⁿ»ⁿ╢ⁿ╝ⁿHF	No error	OS error
Disk is fullDisk read errorF1 for HelpOKCancelErrorInfofmationEnter - Yes, Esc - No @0:63[]
No memory for module %s?@0:56[]
Disk Positioning error: %s
Handler: %d. Position: %ld.Command cancelled.
@0:55[]
Disk Write error: %s-@0:67[]
You've entered bad identificator: %sWarning&@0:52[]
Can't open for read file '%s'.@0:54[]
Can't open file '%s' for modification:@0:57[]
Not Enough Disk Space. Needed: %ld Available: %ldcThere is a possibility that IDA will run out of disk space.
Needed %ld, Available %d.
Continue ?:@0:58[]
Disk Space is Low !!!
Press F1 for explanations.@0:51[]
Can't close file: %s@0:50[]
Can't create file '%s'@0:53[]
Disk Read error: %s+@0:68[]
You've entered an invalid address.+@0:65[]
You've entered invalid segment: %s-@0:66[]
You've entered an invalid expressionñFatal Internal Error ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

       This is an internal error.
   Please, inform the author about it.

Look at 'readme' file to find the address.3

















































@0:69[]@0:48[]
File '%s' not found@0:49[]@0:45[]!Please press a key for macro...
Macro definition cancelled.
4@0:61[]
You can't redefine the keys Alt-- and Alt-=!Defining macro for the key '%s'
,@0:62[]
Already recording a macro for '%s'!Macro for '%s' is defined.
;@0:59[]
Not enough memory available to complete operation.@0:60[]@0:70[] @0:64[]
Enter string for search@0:44[]aWRAP
How to use the help subsystem ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

You can use the following keys:
  F1            this screen
  @0:648[Shift-F1]      help index
  Tab           next highlighted phrase
  Shift-Tab     prev highlighted phrase
  Enter         follow a link
  Backspace     previous help screen
  F5            zoom help window
  Esc           close help window

  arrows        one step movement
  PgUp          Page Up
  PgDn          Page Down
  Ctrl-PgUp     top of the window
  Ctrl-PgDn     bottom of the window
  Home          start of the line
  End           logical end of the line▀WRAP
Main Help Screen ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

F1 is context sensitive help. Use it when you want to know
more about IDA. If you want to know more about
@0:44[help subsystem], press now Enter.

When you don't know which command to use, try to find out it
through menus. For @0:717[menus], press F10.
When you are in the menu,
F1 will explain what the current command does.
Exception: @0:46[keyboard macros] are not available through menus.

To @0:784[exit] IDA, press @<Quit>.

General Notes ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀

0. With IDA you can achieve 3 goals:
     A. get a compilable source code
     B. learn a programming tricks of an interesting program
     C. patch a file when you have no access to the source code.

 The goal A is the toughest and hardest job to do. Most of the
people try to achive goals B and C.
With IDA you can perform all 3 kinds of the job.

1. IDA is not an automatical analyser of programs. 
Normally it is expected that you and IDA work together.
IDA will hint you of suspicious instructions, unsolved
problems etc. It is your job to inform IDA how to proceed.

2. If your goal is to get a fully compilable source code
of the file (goal A) then don't forget:
    - to use correct @0:704[segment register values]
    - to get rid of @0:735[unexplored bytes]
    - to get rid of @0:726[void] marks @0:744[converting]
      their operands to numbers or offsets.

3. There is no documentation on IDA. I think that built-in
help is sufficient in the most of cases. So, use frequently
help system and you will learn IDA quickly.

3. Keep in mind that usually it is enough to learn a program
and patch it (if you are authorized to do so).
IDA does these jobs perfectly.

   Have fun !

You can move around using:

        arrows          one step movement
        PgUp            Page Up
        PgDn            Page Down
        Ctrl-Left       word left
        Ctrl-Right      word right
        Ctrl-PgUp       top of the file
        Ctrl-PgDn       bottom of the file
        Home            start of the line
        End             logical end of the line

You can use mouse to move too.

Use Shift-<arrows> or Alt-L to drop @0:47[anchor].
If you have a mouse, you can drop anchor with it too.

Double click of the mouse is equvalent to <Enter> key.
*WRAP
Keyboard Macros ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

You can define as many macros as you want.
They are defined in the same manner as in the Borland IDE:
        - Press Alt--
        - Press <key> - macro name
        - Enter macro body
        - Press Alt-=

All macros are lost when you @0:784[exit] IDA.ZWRAP
Anchor  ▄
 ▀▀▀▀▀▀▀▀

Various IDA commands use an anchor. For example to select a portion
of file to output or to specify a segment to move... you need an anchor.
To drop the anchor, you can use Alt-L command. Or, more convinient way is
Shift-<arrow> combination. You can drop the anchor with the mouse also:
simply click and drag.

To raise (clear) the anchor:
          press Alt-L
       or click the mouse anywhere in the window

After you've dropped the anchor, you can move freely using arrows, etc.
Any command that uses the anchor, raises it.

The anchor is used by certain commands to point the
exact place or area to work with. Below is the list:

        @0:708[Generate ASM file]
        @0:740[Make ASCII string]
        @0:758[Move Segment]

The anchored area is displayed with another color.

When you exit from IDA, anchor value is lost.gWRAP
File Not Found ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

IDA can't find the specified file.
May be you've mistyped it ?&WRAP
File Viewer ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀

Here you can see text file.

You can move around using:

        arrows          one step movement
        PgUp            Page Up
        PgDn            Page Down
        Ctrl-Left       word left
        Ctrl-Right      word right
        Ctrl-PgUp       top of the file
        Ctrl-PgDn       bottom of the file
        Home            start of the line
        End             logical end of the line

You can use mouse to move too.

To close this window, use 'WindowClose' command.
Hot key is @<WindowClose>.WRAP
Cannot Create File ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Probably this file exists and has
read-only attribute.  Try to delete it
or clear this attribute.

Another reason is that you have too few
number in FILES= statement of your
CONFIG.SYS file. IDA requires about 10
file handlers to be free.åWRAP
Can't close file ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Probably this happens due to IDA internal error.
Could you inform the author about this ?WRAP
Can't Open File ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Probably the file doesn't exist.  Or,
may be it resides at the other place ?

Another reason is that you have too few
number in FILES= statement of your
CONFIG.SYS file. IDA requires about 10
file handlers to be free.PWRAP
Disk Read Error ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Probably your disk contains unmarked BAD
SECTORS. This is very dangerous.  I
recommend you to re-format your disk or
to mark somehow these sectors.

Now I cannot guarantee that IDA
database is in a good shape. If it is
not a big job, the best solution is to
start disassembling from a scratch.DWRAP
Can't Open File ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Probably the file doesn't exist or has
read-only attribute set.  Or, may be it
resides at the other place ?

Another reason is that you have too few
number in FILES= statement of your
CONFIG.SYS file. IDA requires about 10
file handlers to be free.

May be, memory is not enough ?!hWRAP
Disk Write Error ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Probably your disk contains unmarked BAD
SECTORS. This is very dangerous.  I
recommend you to re-format your disk or
to mark somehow these sectors.

Another reason is that your DISK IS
FULL.  Try to delete some unnessesary
files. It is a good style to have at
least 1MB of free disk space when you
work with IDA.

As you analyse the program, the IDA
database grows. You can compress the
file '0.ida' using 'compress' utility.

Now I cannot guarantee that IDA
database is in a good shape. If it is
not a big job, the best solution is to
start disassembling from a scratch.êWRAP
Disk Positioning Error ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Something is wrong, I can't tell you exactly the reason.
May be, disk is full ?WRAP
Not Enough Disk Space ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

IDA requires lot of disk memory to
disassemble files. Try to delete some
unnessesary files.

It is a good style to have at least
3-4MB when you start to disassemble and
1MB of free disk space when you work
with IDA.  Below is very rough formula 
for the disk space:

  SizeOfProgram * 5 + 100K

As you analyse the program, the IDA
database grows. You can compress the
file '0.ida' using 'btc' utility.

You should give more space for IDA to continue its work.┌WRAP
Disk Space is Low ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

VERY DANGEROUS situation!

Normally when you work with IDA you should have at least 1 MB (or more)
of free disk space.
Please @0:784[exit] now and provide more disk space.╒WRAP
Not enough memory available to complete operation. ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Try to close some windows.
If this doesn't help, try to unload TSRs, etc.
Shortly, make more memory.yWRAP
How to move/resize windows ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Keyboard:

Arrows,Home,End,PgUp,PgDn move the window.
All keys with Shift resize the window.
Ctrl key in the combination with other keys
move/resize the window faster.

Mouse:

To move: point to title of the window and drag to the new location.

To resize: point to the right lower corner of the window and drag.óWRAP
Bad Macro ▄
 ▀▀▀▀▀▀▀▀▀▀

You can't redefine the keys Alt-- and Alt-=
because they are used to define other macros.

Please choose another key for the macro.╥WRAP
Already recording a macro for... ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

You can't define 2 macros at the same time.
Please finish definition of the first macro
(press Alt-=) and after define the other one.êWRAP
No Memory ▄
 ▀▀▀▀▀▀▀▀▀▀

There is not enough memory
to initialize IDA.
Please free some memory unloading TSRs,device drivers, etc.╒WRAP
Entering String for Search ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

You can enter any string to search.

Search will be case-insensitive
Search direction: forward

If the substring is not found,
cursor will not move.αWRAP
How to Enter a Segment Value ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

You must enter segment in hexadecimal format or segment name.  If you
enter invalid segment, IDA will warn you.

You may enter a segment register name too.ûWRAP
How to Enter a Number ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

You can enter any 'C' expression with constants. Long arithmetic will
be used for calculations.╔WRAP
How to Enter an Identificator ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

An identificator is a name which starts with a letter and contains
only letters and digits. Characters '@','$', '_' and '?' are
considered as letters. All names are case-sensitive.

Maximal length of a name is specified in the @0:650[configuration]
file:

        NAME_LENGTH=32          // Maximal length of new names

Default is 32.


If you enter an illegal name, IDA will warn you.
╡WRAP
How to Enter an Address ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

You must enter address in the hexadecimal format or a location name.  When
you enter address in the hexadecimal format, you can omit the segment
part of the address - the current segment will be used. If you enter an
invalid address, IDA will warn you.  Addresses beyond the program
limits are invalid.

Special addresses:
        $ - current location

Examples:
        456             current segment, offset 0x456
        5E              current segment, offset 0x5E
        3000:34         segment 0x3000,  offset 0x34
        ds:67           segment pointed by ds, offset 0x67
        start           a location with name 'start'═WRAP
Messages Window  ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

In this window you see various IDA messages. You can use arrow keys,
their combinations with Ctrl key, PgUp,PgDn keys to walk through this
window. IDA will keep the most recent messages only.

You can't close this window.

        arrows    - one step movements
        PgUp      - Page Up
        PgDn      - Page Down
        Ctrl-PgUp - top (the most ancient message)
        Ctrl-PgDn - bottom (the last message)¬WRAP
How To Use List Viewer ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

1. You can use all movement keys: PgUp,PgDn,Home,End and arrows.

2. You can position to a line simply by typing in the desired line number.

3. You can find a line typing in the beginnig of it.

4. You can search for a substring (case-insensitive). The key is '?'.

5. You can refresh information in the window pressing the Ctrl-U key.

Esc or Enter closes the window.can't close filecan't position in filefile read errorfile write errorpage is not in memory(attempt to write but declared read onlyfatal error? unknown error ?Virtual Memory '%s': %s,@0:81[]
File %s is not a virtual array file╬WRAP
Not a virtual array file ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

The most probable error is the you tried to use incompatible version
of IDA. Starting from IDA 2.0 beta2 the format of virtual files was changed.8@0:83[]
Virtual Array %s: Accessing illegal address %lXíWRAP
Virtual Array: Accessing illegal address ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Normally this is an internal error of IDA. Please inform the author.>@0:85[]
Virtual Array %s: Maximum number of chunks is reached╕WRAP
Virtual Array: Maximum number of chunks is reached ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Virtual array can have up to ~ 170 chunks. You have reached this limit.!Lexical analyser: bad digit '%c'Lexical analyser: no Separator(Lexical analyser: non-terminated string'Lexical analyser: too long string '%s'/Lexical analyser: non-terminated char constant%Lexical analyser: bad character '%c'&Lexical analyser: too long ident '%s'+Lexical analyser: bad preprocessor command'Lexical analyser: bad 'include' syntax-Lexical analyser: max depth of includes is 8/Lexical analyser: can't open include file '%s'3Lexical analyser: getstr() function is not defined&Lexical analyser: end of file reachedCompiling file '%s'...
!Missing while statement for a doMissing semicolonMissing braket '['Missing colonSyntax error near: %sMissing braceFunction '%s' is too large/You've reached the maximum number of functionsMisplaced 'break'Misplaced 'continue'!Variable '%s' is already definedVariable '%s' is undefinedToo complex programInternal parser error)Bad number of arguments for the function!Extra symbols at the end of fileToo many local variablesExecuting function '%s'...
Zero divide/Attempt to call non-existent external function#Attempt to call undefined functionIDC stack overflow!Undefined code0Runtime error at '%s' 0x%04X: %s, arg: '%s'(%u)
Not IDL file"Name '%s' at %08lX is deleted...
Unexplored byte Code Data Tail Proc Ret 
Analysed With_extra_lines Flowed With_immediate_arg Byte Word Dword Qword Tbyte Ascii 	Decimal Offset 	Segment 
Variable Void Char Number 
Forced_arg1 
Forced_arg2 Referenced With_comment *@0:27[]
CORE INIT: Unknown file type (%d)$Loading file '%s' into database...
Loading registers...
Creating segments...
&IDA database is successfully created
Stack segment at %04X
9Checking that segments for all addresses are created...
'Creating additional segment for %08lX
"Seaching for the data segment...
1@0:318[]
May be packed file, you decode it firstReading relocation table...
@0:319[]
Bad relocation table2@0:320[]
Warning: This file may have overlays !!!#Marking typical code sequences...
$@0:321[]
Can't find input file '%s'5@0:322[]
Can't generate this type of executable file%; File Name                       %s%; Format                          %sC; Base Address: %04Xh Range: %04lXh - %04lXh Loaded length: %04lXh; Entry point : %04X:%04lX6@0:323[]
FLOW: NextHead %08lX of %08lX in data base !0@0:324[]
BIOS comments base is open. Close it ?'@0:325[]
Can't use BIOS comments base.;@0:326[]
BIOS comments internal error: database is corrupt@0:327[]
Input string: %s@0:327[]
Syntax error: '%s'$@0:327[]
Register '%s' is not valid[ **** New Line **** ]Choose line to edit@0:328[]
Choose mark number @0:329[]
Enter mark description @0:330[]
Choose marked location-Can't find offset base (hint: delete offset)'Can't find name (hint: use forced arg)HCan't find alternative string for an operand (hint: delete alt. string)*Can't find comment (hint: delete comment),Can't find references (hint: redo analisys)Indirect execution flowCan't disassemble/Already data or code (hint: make 'unexplored')Execution flows beyond limits!Too many lines (hint: divide it)4@0:27[]
SEGMENT: Can't create 'Segments' structure./@0:332[]
SEGMENT: Can't find file segmentation/%3d. Creating a new segment  (%08lX-%08lX) ...%Additional segment (%08lX-%08lX) ...*       Undefining bytes (%08lX-%08lX) .../     Request for reanalysing (%08lX-%08lX) ... Ok
	 Failed
 Deleting segment (%08lX-%08lX)
6@0:333[]
Can't create segment (%08lX-%08lX) base %04X    Name    Start     End  ' Base Align Type Cls  32 ES   SS   DS   FS   GS ;@0:334[]
Instructions/data can't cross segment boundaries.;@0:335[]
The segment would have bytes with negative offset$@0:27[]
Can't set segreg area start"@0:27[]
Can't set segreg area endI@0:336[]
Can't move segment bounds (%08lX->%08lX) over instructions/data'@0:337[]
Fatal: Can't create database.º@0:338[]
Press F1 to get help, Enter to exit. Russian:
ìáª¼¿ΓÑ F1 ñ½∩ »«½πτÑ¡¿∩ »«¼«Θ¿, Enter - ñ½∩ óδσ«ñá.
Fatal: Can't find database. (Hint: use '-c' for new file),@0:340[]
Database isn't closed. Repair it ?@0:341[]
bTree error: %s	Ready   	Thinking	* Subr *	Working St:%3ldAU:disabledAU:**idle**AU: * off *
Heap:%6ldF@0:342[]
Fatal: Database has obsolete format. Use old version of IDA.;@0:27[]
Lines Array: Attempt to display tail byte at %08lX9@0:27[]
Fatal internal error: Too many lines generated !#@0:331[]
Can't rename byte as '%s'AddressName4@0:343[]
The program has no user-defined names yet. Searching for text string "%s"

; Title '%s'8; Format                          New Executable Format*; Target operating system         unknown'; Target operating system         OS/2-; Target operating system         MS Windows*; Target operating system         DOS 4.x1; Target operating system         MS Windows 3861; Target operating system         unknown (%04X)*; File Load CRC                   0%08lXh,; Program Entry Point   (CS:IP)   %04X:%04X,; Initial Stack Pointer (SS:SP)   %04X:%04X2; Auto Data Segment Index         %04Xh  ( %5u. )2; Initial Local Heap Size         %04Xh  ( %5u. )2; Initial Stack Size              %04Xh  ( %5u. )(; Linker Version                  %d.%d%; Miminum code swap area size     %d(; Expected Windows Version        %d.%d; Program Flags (%04X): Multiple data
 Single data	 No data Global initialization Protected mode Self loading Errors in image Uses windowing API DLL
 Application; Other EXE Flags (%04X): 2.X protected mode2.X proportional font*Fastload area (start: %08lX, size: %08lX)D;------------------------------------------------------------------; Segment Number    : %d; Alloc Size        : %04lXh-; Offset in the file: %04lXh  Length: %04lXh; Attributes  (%04X): %s Allocated Loaded
 Moveable Pure Preloaded
 Readonly
 Executeonly
 Relocations
 Discardable; Resource, type (%04X):'; File offset : %04lXh  Length: %04lXh; Attributes  :; Resource ID : %d; Resource ID : '%s' Cursor Bitmap Icon Menu Dialog box String table Font directory Font component Accelerator table Resource data Cursor directory Icon directory Name table Version info	 Unknown User defined '	 Movable Pure Preloaded%; External Entry #%d into the Module; Attributes:
 Exported Shared dataseg Ring transactions %d Fixed
 Moveable6I don't know what to do with relocation type OS FIXUPUnknown relocation type %Xh$Unknown relocation address type %XhCUnknown entry in the module '%s' encountered, creating entries...
@Couldn't find module '%s', symbolic names are not available...
+Importing module '%s', %d entry points...
Fixing relocations...
╥WRAP
Packed Files ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀

Sometimes, executable files are shipped in a packed form.  It means
that to disassemble these files you need to unpack them.  I hope that
you have a good collection of packers/unpackers. If you don't have,
you can try our 'UUP - Universal EXE Unpacker'.  Nobody guarantees
that it always does successfully, but sometimes it proves to be very
useful.  

IDA says that the file is packed when Relocation Table of exe-file is
empty.kWRAP
Bad Relocation Table ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Relocation table has references beyond program limits.▀WRAP
File with overlays ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Some EXE files are built with overlays.
This means that not the whole file is
loaded into the memory at the start of
the program, but a part only. Other
parts are loaded by the program itself
into the dynamic memory or over some
subroutines of the program.  This fact
leads to many difficulties when you
disassemble such program.  IDA
doesn't support overlays yet. However,
you can try to disassemble the root segment
of the file.JWRAP
Can't Find Input File ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

IDA've tried to find file with the following extensions:

        .com    .ovr    .ov5
        .exe    .ov0    .ov6
        .ovl    .ov1    .ov7
        .drv    .ov2    .ov8
        .sys    .ov3
        .bin    .ov4

No such files were found.

See also @0:785[IDA usage help]│WRAP
Can't generate executable file ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

IDA produces executable files only for:
  - MS DOS .exe
  - MS DOS .com
  - MS DOS .drv
  - general binaryZWRAP
FLOW: Bad Next Flow ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This means that IDA database is corrupt.
Try to re-analyse program.  (you can
force IDA to re-analyse the program by
changing processor type to the current
processor type.

If you have previously saved your database into a text file,
you can load it. See @0:707[Unload] command for explanations.iWRAP
BIOS Comments Base Open ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Very strange situation. Let IDA to correct it.√WRAP
Bad BIOS & DOS Comments Base ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

IDA can't use this base due to:
        - it doesn't exist or
        - it is corrupt

IDA won't generate new automatic
comments on DOS and BIOS interrupts and
port I/O instructions.eWRAP
Internal Error ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Comments database is corrupt. IDA won't
generate comment(s).=WRAP
Bad Syntax for Comments Retrieval ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

The correct syntax is:

  Reg=Number ....

where reg is register name (e.g. AX,BX,CX)
          or Op1 - for first operand
          or Op2 - for second operand
      number is its value (in C-notation)

For example:

  Op1=0x21 AX=0x4C01+WRAP
Choose mark number ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This command allows you to mark a location so that afterwards you can
jump to the marked location immediately. Select any line from the list.
The selected line will be used for mark description.
Afterwards you will be able to jump to the marked location using <Alt-J> key.

You can use <Up>, <Down>, <PgUp>, <PgDn>, <Home>, <End> keys. If you
select the first line of the list, nothing will be selected.

Press <Enter> to select line, <Esc> to cancel.

See also:
 @0:330[How to jump to the marked location]ïWRAP
Enter mark description ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Mark description is any text line. The description is
solely for your information.ÆWRAP
Choose marked location ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This command allows you to jump to the previously marked location.
Select any line. You will jump to the selected location.

You can use <Up>, <Down>, <PgUp>, <PgDn>, <Home>, <End> keys. If you
select the first line of the list, nothing will be selected.

Press <Enter> to select line, <Esc> to cancel.

See also:
 @0:328[How to mark a location]▌WRAP
Can't Rename a Byte ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Probably this name is already used in
the program. Try to use another name.

To know where it is used you can
try to jump to it using 
 @0:779[Jump to the Named Location]≥WRAP
Can't find file segmentation ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

The database is corrupt. All information is lost.

If you have previously saved your database into a text file,
you can load it. See @0:707[Unload] command for explanations.EWRAP
Segment Creation Failure ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Reason: Bad value for segment base. If this value
        was specified by you, try an allowed value.
        (segment must fit into program address space)
        You can't specify segment base address higher
        than cursor location address base.

Another reason: The database is corrupt.
                Result of disassembling may be surprising,
                nothing can be guaranteed.

If you have previously saved your database into a text file,
you can load it. See @0:707[Unload] command for explanations.ΣWRAP
Segment Boundaries Fault ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

A attempt to change/add a segment failed.
This happened because a segment can't contain a part of
instruction or data. It can contian only a whole
instruction or data.WRAP
Negative Offsets ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

A segment can't have bytes with negative offset from the segment base.
Example:
        if segment base is 0x3000, this segment can have
        start address above or equal to 0x30000, but it can't
        have start address 0x2FFFF.╦WRAP
Can't move segment bounds ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

IDA can't change segment bounds if some instructions/data would occur outside
of the segment. @0:736[Undefine] this instructions/data first.vWRAP
Can't Create Database ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Most probably your disk is full or some
disk I/O error occured.WRAP
Main Idea ▄
 ▀▀▀▀▀▀▀▀▀▀

Russian: ìáª¼¿ΓÑ @0:339[Enter] ñ½∩ »«½πτÑ¡¿∩ »«¼«Θ¿ ¡á απßß¬«¼ ∩ºδ¬Ñ.

▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
 1. IDA is not an automatical analyser of programs. 
Normally it is expected that you and IDA work together.
IDA will hint you of suspicious instructions, unsolved
problems etc. It is your job to inform IDA how to proceed.

 2. There is no documentation on IDA. I think that built-in
@0:44[help] is sufficient in the most of cases. So, use frequently
help system and you will learn IDA quickly.

 3. If you started IDA the very first time, there are commands
you will find useful:
  - convert to @0:738[instruction] : the hotkey is @<MakeCode>
  - convert to @0:739[data] : the hotkey is @<MakeData>

 4. All changes made by you are saved to disk. When you start IDA again
all the information about the file being disassembled is read from disk
and  you can continue your work. You can disassemble one file in a directory.

For other commands please refer to the @0:717[menu] system and the help.

Below is the description of the error just occured:

Can't Find Database

There is no current file being disassembled. To disassemble a new file,
enter the following command line:

        ida -c file

See also @0:785[IDA usage help]UWRAP
Äß¡«ó¡á∩ ¿ñÑ∩ ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 1. IDA ¡Ñ ∩ó½∩ÑΓß∩ áóΓ«¼áΓ¿τÑß¬¿¼ ñ¿ºáßßÑ¼í½Ñα«¼ Γ¿»á Sourcer'á.
ÅαÑñ»«½áúáÑΓß∩, τΓ« »«½∞º«óáΓÑ½∞ ¿ »α«úαá¼¼á αáí«ΓáεΓ ó¼ÑßΓÑ, ó¿ñ«¿º¼Ñ¡∩∩
ñ¿ºáßßÑ¼í½¿απÑ¼πε »α«úαá¼¼π. IDA íπñÑΓ »αÑñπ»αÑªñáΓ∞ óáß « ¡Ñπñáτ¡δσ »«»δΓ¬áσ
ñ¿ºáßßÑ¼í½¿α«óá¡¿∩, ºá¼ÑτÑ¡¡δσ ßΓαá¡¡«ßΓ∩σ ¿ Γ.ñ. éáΦá ºáñáτá - »«ñß¬áºáΓ∞ »α«úαá¼¼Ñ,
¡Ñ«íσ«ñ¿¼δÑ ñÑ⌐ßΓó¿∩,
¬«úñá «¡á ¡Ñ ¼«ªÑΓ áóΓ«¼áΓ¿τÑß¬¿ ñ¿ºáßßÑ¼í½¿α«óáΓ∞.

 2. ä«¬π¼Ñ¡Γáµ¿¿ »« IDA ¡ÑΓ. ƒ ¡áñÑεß∞ τΓ« óßΓα«Ñ¡¡«⌐ ß¿ßΓÑ¼δ
@0:44[»«¼«Θ¿] íπñÑΓ ñ«ßΓáΓ«τ¡«. Æá¬ τΓ« »«τáΘÑ ¡áª¿¼á⌐ΓÑ ¡á F1 ¿ óδ íδßΓα«
¡áπτ¿ΓÑß∞ »«½∞º«óáΓ∞ß∩ IDA. éß∩ »«¼«Θ∞ ¡á á¡ú½¿⌐ß¬«¼ ∩ºδ¬Ñ.

 3. àß½¿ óδ ºá»πßΓ¿½¿ IDA ó »Ñαóδ⌐ αáº, ºá»«¼¡¿ΓÑ ß½ÑñπεΘ¿Ñ ¬«¼á¡ñδ:
  - »αÑóαáΓ¿Γ∞ ó @0:738[¿¡ßΓαπ¬µ¿ε] : ¬½áó¿Φá @<MakeCode>
  - »αÑóαáΓ¿Γ∞ ó @0:739[ñá¡¡δÑ] : ¬½áó¿Φá @<MakeData>

 4. éßÑ ¿º¼Ñ¡Ñ¡¿∩, ó¡ÑßÑ¡¡δÑ óá¼¿, ºá»«¼¿¡áεΓß∩ ¡á ñ¿ß¬Ñ.
Åα¿ ß½ÑñπεΘÑ¼ ºá»πß¬Ñ IDA φΓ¿ ñá¡¡δÑ ßτ¿ΓδóáεΓß∩ ß ñ¿ß¬á ¿ óδ ¼«ªÑΓÑ
»α«ñ«½ª¿Γ∞ αáí«Γπ ß Σá⌐½«¼. é «ñ¡«⌐ ñ¿αÑ¬Γ«α¿¿ ¼«ª¡« ñ¿ºáßßÑ¼í½¿α«óáΓ∞
«ñ¿¡ Σá⌐½.

ä½∩ »«½πτÑ¡¿∩ ¿¡Σ«α¼áµ¿¿ »« ñαπú¿¼ ¬«¼á¡ñá¼ «íαáΘá⌐ΓÑß∞ ¬ ß¿ßΓÑ¼Ñ 
@0:717[¼Ñ¡ε] ¿ »«½∞ºπ⌐ΓÑß∞ ¬½áó¿ΦÑ⌐ F1.

Ä»¿ßá¡¿Ñ Γ«½∞¬« τΓ« »α«¿ßΦÑñΦÑ⌐ «Φ¿í¬¿:

ìÑ ¼«úπ ¡á⌐Γ¿ íáºπ ñá¡¡δσ

öá⌐½ ñ½∩ ñ¿ºáßßÑ¼í½¿α«óá¡¿∩ ¡Ñ ºáúαπªÑ¡ ó íáºπ ñá¡¡δσ.
ä½∩ ñ¿ºáßßÑ¼í½¿α«óá¡¿∩ ¡«ó«ú« Σá⌐½á óóÑñ¿ΓÑ ß½ÑñπεΘπε ¬«¼á¡ñπ:

        ida -c file

æ¼«Γα¿ΓÑ Γá¬ªÑ: @0:785[èá¬ ºá»πßΓ¿Γ∞ IDA]}WRAP
DataBase isn't closed ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

The database was not closed after last IDA session. Most probably
this happened due to power fault, unexpected reboot of the computer,
generally, any abnormal session termination. Try to repair database.

No guarantee that the 'repair' utility will restore the database.

If you have previously saved your database into a text file,
may be the best solution is to load it now.
See @0:707[Unload] command for explanations.

If there is not enough memory, IDA can't repair database automatically.
In this case you should repair it yourself:
        - quit IDA
        - run 'idacheck'┌WRAP
bTree Error ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀

If memory is low, you may get the error 'no memory for...'.
Try to free some memory and start again.

Other errors should not happen. If you have got another error message,
please inform the author about this error.
Don't forget to keep all IDA files and to describe the events occured
immediately before the error.

If you have previously saved your database into a text file,
you can load it. See @0:707[Unload] command for explanations.
WRAP
Obsolete Database Format ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Please, use old version of IDA. This
version of IDA doesn't support this
format.

If you have previously saved your database into a text file,
now you can load it. See @0:707[Unload] command for explanations.╓No User Defined Names Yet ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This command allows you to select a name from USER DEFINED names.
No such names are defined now. To give a name to the location,
use @0:659[Rename] command.:@0:27[]
Internal error: Attempt to use UNDEFINED register/@0:27[]
Internal error: output operand type %x-;             External Entry into Subroutine";             S u b r o u t i n e@@0:27[]
Internal error: loading void operand at %08lX, work: %s?@0:27[]
Internal error: saving void operand at %08lX, work: %s-@0:27[]
Internal error (PC_EMU): %s at %08lX=@0:27[]
Internal error (PC_ANA): Illegal addressing at %08lXD@0:27[]
Internal error (PC_ANA): Illegal immediate type %x at %08lX; End of subroutine **********Default DS register: %04X
6@0:359[]
Can't create segment registers area at %08lX=@0:360[]
Can't assign to Segment Register at %08lX (%s=%04X)  Looking for '%s'...
,@0:27[]
Can't create segment register areas(WRAP
Can't create segment registers area

Happened due to the database. The
database is corrupt.  Try to finish
your work as soon as possible and get
the text source file.

If you have previously saved your database into a text file,
you can load it. See @0:707[Unload] command for explanations.WRAP
Can't assign to Segment Register

The database is corrupt.
Result of disassembling may be surprising,
nothing can be guaranteed.

If you have previously saved your database into a text file,
you can load it. See @0:707[Unload] command for explanations.-~F~ile~N~avigate~E~dit
~W~indows~V~iew
~O~ptions~H~elp~A~nalysis~T~ext~R~egisters~S~egments
~P~atch core~R~esize/move~Z~oom~P~revious~N~ext~C~lose~T~ile
C~a~scade
~J~ump to
~S~earch for~D~efine as~T~oggle displaying~C~omments~T~ype of immediate arg(s)~O~penIDC ~c~ommand~I~DC file~P~roduce output fileProduce ~M~AP fileProduce ~A~SM fileProduce ~L~ST fileProduce ~E~XE file~U~nload database~S~ave~D~OS shell~R~epaint desktop~Q~uit~A~sk for addressChoose from ~l~ist of namesAsk for ~s~egmentChoose from list of se~g~regs~N~ext problemMarked ~p~osition	~R~eturnSearch ~d~irectionMark ~p~ositionnext '~v~oid'next ~c~odenext ~d~atanext p~r~ocnext ~u~nexplorednext d~e~fined~i~mmediatenext i~m~mediate~t~extnext te~x~ttext in c~o~renext text in co~r~e
~J~ump table~A~dd xref~D~el xref~W~ait~C~ode~D~ata(byte,word...)~A~SCIIA~r~ray~U~ndefine~C~hange processor type%Enable/Disable background ~a~nalysisSet ~l~ow  limit for 'void'sSet ~h~igh limit for 'void'sSet ASCII line br~e~ak charSet ASCII brea~k~ charSet ASCII ~s~trings styleSet cross-~r~eference depth(~R~e)name current addressSet '~p~roc' near/far/noneSet '~e~ndp' / noneEnter ~1~st operand manuallyEnter ~2~nd operand manually~I~ncrement indention~D~ecrement indentionUse ~t~abulations / noDrop/Raise ~a~nchorEnter ~c~ommentRetrieve ~p~redefined comment(Edit extra lines (~b~efore gen-d lines)(Edit extra lines (~a~fter  gen-d lines)(Delete last e~x~tra line (before lines)(Delete last ex~t~ra line (after  lines)#~I~ncrement indention for comments#~D~ecrement indention for comments
~D~ecimal/No
Cha~r~/No~N~umber/Void~V~ariable/Constant
~S~egment/No~O~ffset by data segment/NoOffset by ~c~urrent segment
~A~ny offset~N~ew segment~D~elete segmentChange segment ~b~ounds~M~ove current segment~R~ename segmentChange segment ~a~ddressingChange segment ~c~lassChange segment c~o~mbinationChange segment a~l~ignment
P~r~ivate	~P~ublic	~C~ommon~S~tack~A~bsolute, not relocatable~B~yte, relocatable~W~ord, relocatable~P~aragraph, relocatablePa~g~e, relocatable~D~word, relocatable%Set ~d~efault segment register value Change se~g~ment register value~S~how general registers ~O~pen segment registers windowChange ~b~yteChange ~w~ord~C~ross references'~V~oid' marks~A~uto comments~E~mpty lines~B~orders between data/codeBackground a~n~alysisLine ~p~refixes~S~egment names~F~ile~C~alculateC~u~rrent segment registers Open segment ~r~egisters windowOpen ~s~egments windowOpen ~n~ames window~I~nternal flags808680286r80286p80386r80386p80486r80486p,Error occured during opening file '%s' : %s%sCan't find file '%s'åCFG (%ld): Syntax error

Configuration file syntax is:

        KeyWord = Value

You can use C,C++ style comments and include files.
CFG (%ld): Bad keyboard assignment

Keyboard definition syntax is:

        "ActionName" = Value

  where value may be:

        a string:       "Ctrl-F5"
        a char:         'F'
        a scancode:     0x4900
        zero:           0

  Zero scancode disables the hot key.
OCFG (%ld): '=' not found

By configuration file syntax here must be '=' sign.
8CFG (%ld): Too big value

Maximal allowed value is 32.
%CFG (%ld): Illegal action name '%s'
¢CFG (%ld): Illegal key code '%s'

You've mistyped key code. Below are some examples:

        "Alt-F1"
        "Shift-F10"
        "Tab"
        "Ctrl-D"
─CFG (%ld): Illegal key name

You've mistyped key name. Below is the list of
allowed keys:

 ASCII_PREFIX      Prefix for new ASCII strings
 NAME_LENGTH       Maximal length of new names
 OUTPUT            Deafult path for output Files
 AUTOSAVE          Autsave frequency
 EDITOR            Editor
 TEXT_COLOR        Normal text color
 TEXT_REV_COLOR    Text with anchor color
 WARNING_COLOR     Warning message color
 ERROR_COLOR       Error message color
 LIST_NORMAL_COLOR Help and lists color
 LIST_HIGH_COLOR   Select list item color
 STATUS_COLOR      Status line color
 INDICATOR_COLOR   Indicator color
 MENU_NORMAL_COLOR Menu color
 MENU_HIGH_COLOR   Selected item of menu color
 ASK_COLOR         Dialog window color
 SWAP_EXTENDED     Specify extended memory size for swapping
                   (only overlayed code will be swapped)
 SWAP_EXPANDED     Specify expanded memory size for swapping
                   (only overlayed code will be swapped)
A@0:27[]
GL internal error: item size = 0 at %08lX, Flags = %08lX/  Knowledge is power.
                F. Bacon(
  Address         Publics by Value
  
(@0:714[]
Can't open for write file '%s';
; ╔═════════════════════════════════════════════════════════════════╗
; ║ This file is generated by Interactive DisAssembler (IDA)        ║
; ║ Copyright (c) 1991-94 by Ilfak Guilfanov. (2:5020/209@fidonet)  ║
; ╚═════════════════════════════════════════════════════════════════╝
;

+//
// ╔═════════════════════════════════════════════════════════════════╗
// ║ This file is generated by Interactive DisAssembler (IDA)        ║
// ║ Copyright (c) 1991-94 by Ilfak Guilfanov. (2:5020/209@fidonet)  ║
// ╚═════════════════════════════════════════════════════════════════╝
//

static main(void) {
        GenInfo();
        Segments();
        Bytes();
        SegRegs();
}

//------------------------------------------------------------------------
// General information

static GenInfo(void) {

        DeleteAll();    // purge database
è}

//------------------------------------------------------------------------
// Information about segmentation

static Segments(void) {
ï}

//------------------------------------------------------------------------
// Information about bytes

static Bytes(void) {
  auto x;

Ä}

//------------------------------------------------------------------------
// Information about segment registers

static SegRegs(void) {
}

// End of file.

// Partial file is produced.
)@0:715[]
Write error, may be disk full ?*Assembler file created, total %ld lines.
-Unloading information about segmentation...
2Unloading information about instructions/data...
2Unloading information about segment registers...
;Unload information to file '%s' (Ctrl-Break to cancel)...
Unloading completed.
!Flushing buffers, please wait... Ok.
c@0:651[]
This command can't be applied to the addresses without a segment. Create a segment first.	@0:785[]@0:785[]
Unknown switch '-%c'$@0:785[]
Use switch -c for new file @0:673[]
Invalid processor type@0:786[]
Database is empty0@0:790[]
Can't use these switches with old file#Database for file '%s' is loaded.
You are kidding me ! %lx
Good bye...
@0:706[]
Enter MAP file name@0:708[]
Enter ASM file name@0:709[]
Enter LST file name@0:710[]
Enter EXE file name @0:707[]
Enter unload file name @0:711[]
Enter IDC statement(s)@0:711[]
Enter IDC file name.@0:712[]
Enter new value for the current byte.@0:712[]
Enter new value for the current wordG@0:713[]
Auto analysis is not completed, the result may be inaccurate!-@0:686[]
Enter address to jump (hex or name) @0:685[]
Choose segment to jump @0:687[]
Choose address to jump@0:689[]
%lX: %sChoose a name$@0:661[]
Enter value to search (%c)Search for value %lX
'@0:662[]
Enter text search (%c) string)@0:660[]
Enter binary search (%c) string)@0:660[]
Bad binary search string format#Search completed. Found at %08lX.
Pattern not found.
 Searching for binary string %s
(@0:652[]
Enter array size (in elements) @0:653[]
Choose base for offset+@0:653[]
Enter base address for the offsetA@0:674[]
Create a new segment

Start address and end address should be valid.
        End address > Start address
    Specify addresses as segment:offset

<Start address   :$:32:12::>
<End   address   :$:32:12::>
<Class           :A:9 :12::> (class is any text)
<32-bit segment  :N:1 :::>

<Base            :S:32:12::>

σ@0:675[]
Change segment bounds

Segment: %A

<Start address   :$:32:12::>
<End   address   :$:32:12::>

Start address and end address should be valid.
        End address > Start address
    Specify addresses as segment:offset

'@0:674[]
Invalid segment start addressC@0:674[]
Segment end address is invalid or less than start addressI@0:674[]
Bad segment base: segment would have bytes with negative offset@0:677[]
Can't move segmento@0:678[]
You are up to move the segment '%s' (%08lX-%08lX) so that it will have start address %08lX. Continue?@0:679[]
Choose segment(@0:680[]
Enter new name for the segmentQ@0:681[]
The segment '%s' addresing
will be changed to %d-mode.
Are you sure ?"@0:682[]
Enter segment class name6@0:654[]
Enter alternate string for the first operand7@0:654[]
Enter alternate string for the second operand@0:655[]
Enter line@0:658[]
Enter comment@0:656[]
Enter command type-@0:657[]
Enter comment index for the command-@0:659[]
Enter name for the current location,@0:701[]
Enter Indirect Jumps Table Address)@0:701[]
Enter Indirect Jumps Table Size<@0:702[]
Can't create Indirect Jumps Table at %08lX size %d.@0:703[]
Link: Enter address to be referenced*@0:703[]
UnLink: Enter referenced addressEnter register value*@0:705[]
Enter new segment register valueEnter register name[@0:704[]
Segment Register Value

<Segment Register :A:2:::>

<Value            :S:10:::>

@0:673[]
Enter processor type3@0:673[]
Illegal or not allowed processor type: %s @0:663[]
Enter ASCII end symbol"@0:664[]
Enter ASCII break symbol+@0:666[]
Enter new value low 'voids' limit,@0:666[]
Enter new value high 'voids' limit3@0:667[]
Enter maximal depth for tail bytes lookup@0:672[]
Enter C expression@0:671[]
Enter a file name@0:668[]
Segment Registers@0:669[]
Program Segmentation@0:670[]
NamesSearch direction: up
Search direction: down
Auto analisysTabulationsAuto commentsVoid marks displayDebugging messagesCross-references displayASCII strings style is "C"
!ASCII strings style is "Pascal"
Auto analisys displayVoids marks displayingBorders between data/codeEmpty linesLine prefixesSegment names in addresses: Result = %ld (%lXh) '%c'
On¥WRAP
IDC language ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀

IDC language is a C-like language. It has the same lexical tokens as C does:
character set,constants,identifiers,keywords, etc.
A program in IDC consists of function declarations. By default, execution
starts from a function named 'main'.
Select a topic to read:

  @0:637[Variables]
  @0:636[Functions]
  @0:635[Statements]
  @0:634[Expressions]
  @0:638[Built-in functions]
∩WRAP
IDC: Expressions ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

In expressions you can use almost all C operations except:
  ++,--
  complex assigment operations as '+='
  , (comma operation)

You can use the following construct in the expressions:

  [ s, o ]

This means to calculate linear (effective) address for segment 's' offset 'o'.
The calculation is made using the following formula:

  (s << 4) + o

If a string constant is specified as 's', it denotes a segment by its name.

There are 2 type conversion operations:

  long( expr )
  char( expr )

However, all type conversions are made automatically:
  - operand(s) are converted to 'long'
  - the operation is performed.

Exceptions:
 1. binary '+' operation. If the first
    operand is string type, the second
    operand is converted to a string and
    the operands are concatenated.
 2. relational operations
    (such as ==,!=, etc.) If both operands
    are strings, the string comparision
    is performed, otherwise - they are
    converted to numbers.
═WRAP
IDC: Statements ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

In IDC there are the following statements:
  @0:634[expression];        (expression-statement)
  if (expression) statement
  if (expression) statement else statement
  for ( expr1; expr2; expr3 ) statement
  while (expression) statement
  do statement while (expression);
  break;
  continue;
  return <expr>;
  return;              the same as 'return 0;'
  { statements... }
  ;                    (empty statement)
πWRAP
IDC: Functions ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

A function in IDC returns a value. There are 2 kinds of functions:
  - @0:638[built-in] functions
  - user-defined functions

A user-defined function is declared in this way:

  static func(arg1,arg2,arg3) {

    @0:635[statements] ...

  }

where arg1,arg2,arg3 are the function parameters,'func' is the function name.
It is not nesessary to specify the types of the parameters
because any @0:637[variable] can contain a string or a number.
ΦWRAP
IDC: variables ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

All variables in IDC are
automatic local variables (sic!). A variable can contain:
  - a 32-bit signed long integer
  - a character string
    (max 255 characters long)

A variable is declared in this way:

  auto var;

This declaration introduces a variable named 'var'. It can contain a string
or a number. All C and C++ keywords are reserved and cannot be used as
a variable name. The variable is defined up
to the end of the @0:636[function].
xWRAP
IDC: Built-in functions ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

The following conventions are used in this list:
  'ea' is a linear address
  'success' is 0 if a function failed, 1 otherwise
  'void' means that function returns no meaningful value (always 0)

All function parameter conversions are made automatically.

 @0:639[A.] Utility functions
 @0:640[B.] Functions that change program representation
 @0:641[C.] Functions that produce output files
 @0:642[D.] Informational functions
 @0:643[E.] Functions that change global settings
 @0:644[F.] Functions that interact with the user
 @0:645[G.] Functions that work with segments
æA. Utility functions ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

long    MK_FP    (long seg,long off);   // the same as [ seg, off ]
long    _lpoke   (long RAMea,long value); // poke a long integer into RAM
                                        // returns old value
long    _poke    (long RAMea,long value);// poke a byte into RAM
                                        // returns old value
long    _peek    (long RAMea);          // get a byte from RAM
char    form     (char format,long value); // works as sprintf, takes only
                                        // 1 parameter. Specifying %f as a
                                        // parameter will lead to abnormal
                                        // program termination with bad
                                        // consequences.
                                        // The resulting string should
                                        // be less than 255 characters.
long    strstr  (char str,char substr); // find a substring, -1 - not found
                                        // if x2 == -1, then till end of line
long    strlen  (char str);             // calculate length
long    xtol    (char str);             // ascii hex -> number
                                        // (use long() for atol)
success AssignKey(char action,long key);// assign a key to an action
                                        // meaningful only before the main
                                        // menu is constructed
success Jump     (long ea);             // move cursor to ea
                                        // screen is refreshed at the end
                                        // of IDC execution
B. Functions that change program representation ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

void    DeleteAll();                    // delete ALL information
                                        // about the program
long    MakeCode (long ea);             // convert to instruction
                                        // returns number of bytes
                                        // occupied by the instruuction
success MakeName (long ea,char name);   // assign a name to a location
success MakeComm (long ea,char comment);// give a comment
success MakeArray(long ea,long nitems); // convert to an array
success MakeStr  (long ea,long size);   // convert to ASCII string
success MakeByte (long ea);             // convert to byte
success MakeWord (long ea);             // convert to word
success MakeDword(long ea);             // convert to double-word
success MakeQword(long ea);             // convert to quadro-word
success MakeTbyte(long ea);             // convert to 10 bytes (tbyte)
void    MakeUnkn (long ea);             // convert to 'unknown'
success OpDec    (long ea);             // operands are decimal
success OpChar   (long ea);             // operands are characters
success OpOffset (long ea,long segbase);// operands are offsets
                                        // if segbase==-1, then operands
                                        // aren't offsets
success OpSegment(long ea);             // operands are segments
success OpNum    (long ea);             // operands are numbers
success OpAlt1   (long ea,char opnd);   // manually enter 1st operand
success OpAlt2   (long ea,char opnd);   // manually enter 2nd operand
void    MakeVar  (long ea);             // the location is 'variable'
success MakeProc (long ea,long fl);     // fl=0: no proc, fl=1: near proc,
                                        // fl=2: far proc
success MakeEndp (long ea,long fl);     // fl=0: no endp,1: endp
void    ExtLinA  (long ea,long n,char line); // insert an additional line
                                        // before the generated ones
void    ExtLinB  (long ea,long n,char line); // insert an additional line
                                        // after the generated ones
void    DelExtLnA(long ea,long n);      // delete an additional line
                                        // before the generated ones
void    DelExtLnB(long ea,long n);      // delete an additional line
                                        // after the generated ones
success JmpTable (long jmpea,long tableea,long nitems); // define jump table
void    PatchByte(long ea,long value);  // change a byte
void    SetFlags (long ea,long flags);  // change internal flags for ea
success SetReg   (long ea,char reg,long value); // set value of
                                        // segment register
 C. Functions that produce output files ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

void    WriteMap(char file);            // produce a .map file
void    WriteTxt(char file,long ea1,long ea2); // produce an .asm file
void    WriteExe(char file);            // produce an executable file
╚D. Informational functions

long    GetFlags (long ea);             // get internal flags for ea
long    Byte     (long ea);             // get a byte at ea
long    Word     (long ea);             // get a word at ea
long    Dword    (long ea);             // get a double-word at ea
long    LocByName(char name);           // -1 - no such name
long    SegByBase(long base);           // -1 - no such segment
long    MinEA    ();                    // the minimal address defined
                                        // in the program
long    MaxEA    ();                    // the maximal address defined
                                        // in the program
long    ScreenEA ();                    // the current screen ea
long    BeginEA  ();                    // where execution starts
long    GetReg   (long ea,char reg);    // get segment register value
                                        // -1 - undefined or error
long    SegStart (long ea);             // returns start of the segment
                                        // -1 if bad address passed
long    SegEnd   (long ea);             // return end of the segment
                                        // this address doesn't belong
                                        // to the segment
                                        // -1 if bad address passed
char    SegName  (long ea);             // returns name of the segment
                                        // "" if bad address passed
long    NextAddr (long ea);             // returns next defined address
                                        // -1 if no such address exists
long    PrevAddr (long ea);             // returns prev defined address
                                        // -1 if no such address exists
long    NextHead (long ea);             // returns next defined item address
                                        // -1 if no such address exists
long    PrevHead (long ea);             // returns prev defined item address
                                        // -1 if no such address exists
long    NextNotTail(long ea);           // returns next not tail address
                                        // -1 if no such address exists
long    PrevNotTail(long ea);           // returns prev not tail address
                                        // -1 if no such address exists
long    ItemEnd  (long ea);             // returns address past end of
                                        // the item
long    ItemSize (long ea);             // returns item size, min answer=1
char    LineA    (long ea,long num);    // get additional line before
                                        // generated ones
char    LineB    (long ea,long num);    // get additional line after
                                        // generated ones
char    Comment  (long ea);             // get comment
char    AltOp1   (long ea);             // get manually entered 1st operand
char    AltOp2   (long ea);             // get manually entered 2nd operand9E. Functions that change global settings ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

long    StringEnd(long asciiendchar);   // set current ASCII end character
                                        // returns old value
long    StringStp(long asciistopchar);  // set current ASCII break character
                                        // returns old value
long    LowVoids (long lowlimit);       // set current low limit for voids
                                        // returns old value
long    HighVoids(long highlimit);      // set current high limit for voids
                                        // returns old value
long    TailDepth(long taildepth);      // set current tail depth
                                        // returns old value
long    Direction(long direction);      // set current search direction
                                        // returns old value
long    Analysis (long analysis);       // enable/disable auto analysis
                                        // returns old value
long    Tabs     (long tabulations);    // enable/disable tabulations in
                                        // output file. returns old value
long    Comments (long comments);       // enable/disable automatic comments
                                        // returns old value
long    Voids    (long voids);          // enable/disable void marks display
                                        // returns old value
long    XrefShow (long xrefshow);       // enable/disable cross-references
                                        // display. returns old value
long    Indent   (long indent);         // set indention for instruntions
                                        // returns old value
long    CmtIndent(long cmtindent);      // set indention for comments
                                        // returns old value
long    AutoShow (long autoshow);       // enable/disable autoanalysis
                                        // display. returns old value
success SetPrcsr (char processor);      // set processor type
                                        F. Functions that interact with the user ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

char    AskStr  (char defval,char prompt); // ask a string
long    AskAddr (long defval,char prompt); // -1 - no or bad input
long    AskSeg  (long defval,char prompt); // -1 - no or bad input
char    AskIdent(char defval,char prompt);
void    Message (char str);     // show a message in messages window
void    Warning (char str);     // show a warning in a dialog box
void    Fatal   (char str);     // show a message, exit IDA immediately
╒G. Functions that work with segments ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

success SegCreate(long startea,long endea,long base,long use32,
                  long @0:646[alignment],long @0:647[combination]);
success SegDelete(long segea);
success SegBounds(long segea,long startea,long endea);
success SegRename(long segea,char name);
success SegClass (long segea,char class);
success SegAlign (long segea,long @0:646[alignment]);
success SegComb  (long segea,long @0:647[combination]);
success SegAddrng(long segea,long addrng);
long    SegByName(char segname);        // returns segment base
success SegDefRef(long segea,char reg,long value);
                                        // set default value for segment regΓSegment aligments ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

#define saAbs      0 // Absolute segment.
#define saRelByte  1 // Relocatable, byte aligned.
#define saRelWord  2 // Relocatable, word (2-byte, 16-bit) aligned.
#define saRelPara  3 // Relocatable, paragraph (16-byte) aligned.
#define saRelPage  4 // Relocatable, aligned on 256-byte boundary (a "page"
                     // in the original Intel specification).
#define saRelDble  5 // Relocatable, aligned on a double word (4-byte)
                     // boundary. This value is used by the PharLap OMF for
                     // the same alignment.
#define saRel4K    6 // This value is used by the PharLap OMF for page (4K)
                     // alignment. It is not supported by LINK.
îSegment combinations ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

#define scPriv     0    // Private. Do not combine with any other program
                        // segment.
#define scPub      2    // Public. Combine by appending at an offset that
                        // meets the @0:646[alignment] requirement.
#define scPub2     4    // As defined by Microsoft, same as C=2 (public).
#define scStack    5    // Stack. Combine as for C=2. This combine type
                        // forces byte @0:646[alignment].
#define scCommon   6    // Common. Combine by overlay using maximum size.
#define scPub3     7    // As defined by Microsoft, same as C=2 (public).
jHelp Index ▄
 ▀▀▀▀▀▀▀▀▀▀▀

  @0:338[Main Idea]
  @0:339[Russian: Äß¡«ó¡á∩ ¿ñÑ∩]

Basics

  @0:650[Configuration file]
  @0:46[Keyboard Macros]
  @0:672[Calculator]
  @0:688[Segment Register Change Points]
  @0:690[Problems List]
  @0:47[Anchor]
  @0:785[IDA command line switches]
  @0:649[Menu system]

Windows

  @0:45[Main IDA window]
  @0:69[Messages window]
  @0:49[File viewer]

How to...

  @0:70[How To Use List Viewer]
  @0:67[How to Enter an Identificator]
  @0:65[How to Enter a Segment Value]
  @0:68[How to Enter an Address]
  @0:66[How to Enter a Number]

@0:633[IDC language]
  @0:634[Expressions]
  @0:635[Statements]
  @0:637[Variables]
  @0:636[Functions]
    @0:638[Built-in functions:]
      @0:639[A. Utility functions]
      @0:640[B. Functions that change program representation]
      @0:641[C. Functions that produce output files]
      @0:642[D. Informational functions]
      @0:643[E. Functions that change global settings]
      @0:644[F. Functions that interact with the user]
      @0:645[G. Functions that work with segments]
        @0:646[Segment aligments]
        @0:647[Segment combinations]
:
@0:717[Main Menu Bar]
  @0:716[File]
    @0:718[Open]
    @0:711[IDA command]
    @0:780[Produce output file]
      @0:706[Generate MAP file]
      @0:708[Generate ASM file]
      @0:709[Generate LST file]
      @0:710[Generate EXE file]
      @0:707[Unload database]
    @0:781[Save]
    @0:737[Wait]
    @0:782[DOS shell]
    @0:783[Repaint desktop]
    @0:784[Quit]
  @0:770[Edit]
    @0:774[Analysis]
      @0:735[Define As...]
        @0:738[instruction]
        @0:739[data]
        @0:740[ascii]
        @0:652[array]
        @0:736[undefine]
      @0:736[Convert to Unknown]
      @0:701[Jump Table]
      @0:703[Links]
    @0:775[Text]
      @0:744[Argment type]
        @0:751[Convert to decimal number]
        @0:752[Convert to character]
        @0:753[Convert to hex number]
        @0:755[Convert to segment]
        @0:756[Convert to offset (DS)]
        @0:757[Convert to offset (CS)]
        @0:653[Convert to offset (any)]
        @0:754[Mark as variable]
      @0:743[Comments]
        @0:658[Regular comments]
        @0:749[Predefined comments]
        @0:655[Additional comment lines]
        @0:750[Change Indention of Comments]
      @0:659[Rename]
      @0:745[Make procedure]
      @0:746[Make end of procedure]
      @0:654[User-defined operand]
      @0:663[Set Ascii break char]
      @0:747[Indention of program code]
      @0:748[Tabulation]
    @0:776[Registers]
      @0:705[Set default segment register value]
      @0:704[Change segment register value]
      @0:759[Show general register]
      @0:668[Open segment registers window]
    @0:777[Segments]
      @0:674[How to create a new segment]
      @0:676[How to delete a segment]
      @0:675[How to change segment bounds]
      @0:758[How to move a segment start]
      @0:680[How to change segment name]
      @0:681[How to change segment addressing mode]
      @0:682[How to change segment class]
      @0:683[How to change segment alignment]
      @0:684[How to change segment combination]
    @0:778[Patch core]
      @0:712[Patch core]
      @0:710[Produce EXE file]
  @0:769[Navigate]
    @0:722[Jump to...]
      @0:686[Jump to the Specified Address]
      @0:779[Jump to the Named Location]
      @0:685[Jump to the Specified Segment Start]
      @0:719[Jump to the Previously Marked Position]
      @0:687[Jump to the Specified Segment Register Change Point]
      @0:689[Jump to the Next Address from the Problems List]
      @0:725[How to Mark a Location]
    @0:723[Search for...]
      @0:662[substring in the text representation]
      @0:660[substring in the binary image of the file]
      @0:730[unexplored bytes]
      @0:731[explored bytes]
      @0:727[instruction bytes]
      @0:728[data bytes]
      @0:661[immediate operand values]
      @0:726[void operands]
      @0:729[start of procedures]
    @0:721[Return]
  @0:772[View]
    @0:671[View File]
    @0:672[Calculator]
    @0:759[View general registers]
    @0:668[Open segment registers window]
    @0:669[Open segments window]
    @0:670[Open names window]
    @0:768[View internal flags]
  @0:773[Options]
    @0:673[Processor type]
    @0:742[Auto analysis]
    @0:666[Limits of voids]
    @0:724[Search direction]
    @0:667[Tail depth]
    @0:664[Ascii break character]
    @0:663[Ascii end character]
    @0:665[Pascal-style strings]
    @0:741[Toggle displaying]
      @0:760[Cross references display]
      @0:761['void' marks display]
      @0:762[Simple comments display]
      @0:763[Empty line display]
      @0:764[Borders display]
      @0:765[Auto analysis display]
      @0:766[Line prefixes display]
      @0:767[Segment names display]
  @0:771[Windows]^WRAP
Configuration file ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Configuration file 'ida.cfg' is searched in PATH.
If it is not found, IDA uses default values.
You can use C,C++ style comments and include files.
Configuration file syntax is:

        KeyWord = Value
        "ActionName" = Value

  where value may be:

        a string:       "Ctrl-F5"
        a char:         'F'
        a scancode:     0x4900
        zero:           0

  Zero scancode disables the hot key.

Below is the list of allowed keywords:

 ASCII_PREFIX      Prefix for new ASCII strings
 NAME_LENGTH       Maximal length of new names
 OUTPUT            Deafult path for output Files
 AUTOSAVE          Autsave frequency
 EDITOR            Editor
 TEXT_COLOR        Normal text color
 TEXT_REV_COLOR    Text with anchor color
 WARNING_COLOR     Warning message color
 ERROR_COLOR       Error message color
 LIST_NORMAL_COLOR Help and lists color
 LIST_HIGH_COLOR   Select list item color
 STATUS_COLOR      Status line color
 INDICATOR_COLOR   Indicator color
 MENU_NORMAL_COLOR Menu color
 MENU_HIGH_COLOR   Selected item of menu color
 ASK_COLOR         Dialog window color
 SWAP_EXTENDED     Specify extended memory size for swapping
                   (only overlayed code will be swapped)
 SWAP_EXPANDED     Specify expanded memory size for swapping
                   (only overlayed code will be swapped)█WRAP
No Segment for the current byte ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Some commands can't be applied to the addresses without a segment.

Create a segment first. You can do this using
@0:674[CreateSegment] command.UWRAP
Array Size ▄
 ▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeArray
 Current hotkey: @<MakeArray>

Enter array size in current array elements (not bytes).
IDA proposes maximal possible array size by default.

You can use this command for ASCII strings also.

See also
 @0:735[Other Edit|Analysis|Define As... commands]
 @0:66[How to Enter a Number].WRAP
Immediate Operand -> Offset (specified base) ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeAnyOffset
 Current hotkey: @<MakeAnyOffset>

This command converts immediate operand(s) type of the
current instruction/data to an offset by specified segment base.

See also: @0:756[offset by data segment/no]
          @0:757[offset by current segment]
          @0:744[Edit|Text|Type of immediate args] submenu.

If this command affects another operand, try to use
 @0:654[Enter #th operand manually] commands.qWRAP
Alternate String For Operand ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: Alter1Operand, Alter2Operand
 Current hotkey: @<Alter1Operand>, @<Alter2Operand>

You may use Alternate String for operand when IDA doesn't represent
operand in the needed form. In this case IDA will simply show the
specified string instead of the operand. No offset references are
generated.

You can use this not only with the code instructions but with data
instructions also.

IDA proposes the previous Alternate String as default.

If you want to delete the Alternate String, specify empty string.

See also @0:775[Edit|Text] submenu.╔WRAP
Extra Lines ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀

 Action         Name             Hotkey
 ------         ----             ------
 add before     MakeExtraLineA   @<MakeExtraLineA>
 add after      MakeExtraLineB   @<MakeExtraLineB>
 del before     DeleteExtraLineA @<DeleteExtraLineA>
 del after      DeleteExtraLineB @<DeleteExtraLineB>

If you want to enter multi-line comments or additional instructions,
you can use this feature of IDA.

There are two kinds of Extra Lines: generated before instruction line
and generated after instruction line.

You can add new lines, edit existing lines and delete the last line.

Don't forget that maximal number of lines for an item is 100.

See also @0:743[Edit|Text|Comments] submenu.AWRAP
Command Type ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀

This command allows you to get predefined comment for the current
instruction. Like:
        ; INT 21,Fn 4C00h - DOS - Quit

Enter an instruction name to get comment about.
For example:
        int
        add
        movzx
        in

See @0:749[Retrieve predefined comment] command.gWRAP
Comment Index for the Command ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

The correct syntax is:

  Reg=Number ....

where reg is register name (e.g. AX,BX,CX)
          or Op1 - for first operand
          or Op2 - for second operand
      number is its value (in C-notation)

For example:

  Op1=0x21 AX=0x4C01

See @0:749[Retrieve predefined comment] command..WRAP
Enter a comment ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeComment
 Current hotkey: @<MakeComment>

This command allows to enter an indented comment for
the current item.

Don't forget that you can use '\n' symbol to enter
multi-line indented comment.

See also @0:743[Edit|Text|Comments] submenu.üWRAP
Give Name to the Location ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeName
 Current hotkey: @<MakeName>

This command gives name/renames/deletes @0:67[name] for the current
item.

To delete a name, simply give an empty name.

If the current item is referenced, you can't delete its name.

See also @0:775[Edit|Text] submenu.
         @0:67[How to Enter an Identificator].WRAP
Search for substring in the file ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: AskBinaryText
 Current hotkey: @<AskBinaryText>

This command searches for the specified substring in the file being
disassembled. This command can be used for fast lookups of text
strings in the executable file or even to find references to a data.

You can:
  - enter sequence of numbers in C notation
  - enter string constants

Example:

  0xCD 0x21    - to search bytes CD 21 (int 21)
  "Hello", 0   - to search string "Hello"

For example, if you want to find a reference to the following string:

 35F2:106A      db 'Hello',0

you could search for the string '0x6A, 16' in the file.

See also @0:662[search for text] command.
         @0:723[Navigate|Search for...] submenu.≥WRAP
Search for next instruction/data with the specified operand ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: AskNextImmediate
 Current hotkey: @<AskNextImmediate>

This command searches for the first instruction or data byte 
that contains the specified immediate operand. This command is
relatively slow, because it disassembles each instruction to
find operand values.

See also @0:723[Navigate|Search for...] submenu.
         @0:66[How to Enter a Number].5WRAP
Search for substring in the text representation ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: AskNextText
 Current hotkey: @<AskNextText>

This command searches for the specified substring in the text
representation. This command is a slow command, because it
disassembles each instruction to get the text representation.

Note that this command searches the same what you see on your
screen (not in binary image !).

For binary search look at
 @0:660[Search for substring in the file]

See also @0:723[Navigate|Search for...] submenu.╦WRAP
ASCII End Symbol ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: SetAsciiEnd
 Current hotkey: @<SetAsciiEnd>

This symbol forces IDA to stop scanning for the end of the
ASCII string when a new string is being
created. By default it equals to '$'.
IDA ends new string by '\0' symbol
also.

See also:
 @0:664[ASCII Break Symbol]
 @0:665[Set Ascii Style]
 @0:740[Convert to ASCII]
 @0:775[Edit|Text] submenu.
 @0:773[Options] submenu.
 @0:66[How to Enter a Number].éWRAP
ASCII Break Symbol ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: SetAsciiBreak
 Current hotkey: @<SetAsciiBreak>

This symbol forces IDA to start a new
line when it displays ASCII string on the
screen. By default, it equals to '\n'.

See also:
 @0:663[ASCII End Symbol]
 @0:665[Set Ascii Style]
 @0:740[Convert to ASCII] command
 @0:773[Options] submenu.
 @0:66[How to Enter a Number].▀WRAP
ASCII String Style ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: SetAsciiStyle
 Current hotkey: @<SetAsciiStyle>

There are 2 string styles: Pascal and C.
 C-style:
   all strings are terminated by '\0'.
 Pascal-style:
   all strings have:
     first byte - length
     other bytes - string itself.

Using Set ASCII Style command you can choose
the desired ASCII strings style. All new strings
will have the current style.

Default is C-style.

See also @0:773[Options] submenu.WRAP
Low & High Offset Limits ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: SetLowLimit, SetHighLimit
 Current hotkey: @<SetLowLimit>, @<SetHighLimit>

These values control 'void' marks generation.  An item is 'void' if
it has an immediate value as operand or part of operand and this
immediate value is between low and high 'voids' limits. The comparision
is always unsigned, i.e. in the instruction

        mov ax,[bp-2]

  the immediate operand is 0xFFFE, not -2.

See also @0:773[Options] submenu.
         @0:66[How to Enter a Number].TWRAP
Maximal Depth For Tail Bytes Lookup ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: SetTailDepth
 Current hotkey: @<SetTailDepth>

This value controls @0:760[cross references] displaying.
 It means
 'how many bytes of an object to look at
        to collect cross references'.

For example we have an array:
        A       db 100 dup(0)

If some instruction refers to the 5-th element of the array:
        mov     al,A+5

 with TD=3      we'll have no xrefs displayed
 with TD=10     we'll have this xref

See also @0:773[Options] submenu.
         @0:66[How to Enter a Number].πWRAP
Open Segment Registers Window▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ShowSegmentRegisters
 Current hotkey: @<ShowSegmentRegisters>

This command opens the segment registers window.
The window will contain segment register
@0:688[change points]
list.

You can use @0:70[list viewer] commands in this window.

Depending on the current processor type, you will see
DS,CS,SS with or without FS,GS.

See also @0:776[Edit|Registers] submenu.
         @0:772[View] submenu.≤WRAP
Open Segments Window▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ShowSegments
 Current hotkey: @<ShowSegments>

This command opens the segments window.

You can use @0:70[list viewer] commands in this window.

See also @0:772[View] submenu.∞WRAP
Open Names Window▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ShowNames
 Current hotkey: @<ShowNames>

This command opens the @0:659[names] window.

You can use @0:70[list viewer] commands in this window.

See also @0:772[View] submenu.3WRAP
File Viewer ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ViewFile
 Current hotkey: @<ViewFile>

You can create an additional window to look at the file contents.
Unfortunately, for the moment you can open only 1 text file window.
To close the opened window, press @<WindowClose>.


See also @0:772[View] submenu.¢WRAP
Calculator ▄
 ▀▀▀▀▀▀▀▀▀▀▀

 Action    name: Calculate
 Current hotkey: @<Calculate>

A simple calculator is provided. You can enter constant C-style
expressions. Syntax of the expressions is the same is the syntax of
IDC @0:634[expressions].
Result is displayed in the message window in three
forms: hexadecimal,decimal and character.

See also @0:772[View] submenu.
         @0:66[How to Enter a Number].âWRAP
Processor Type ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

           Action            Hotkey
           ------            ------
        SetProcessor8086   @<SetProcessor8086>
        SetProcessor80286r @<SetProcessor80286r>
        SetProcessor80286p @<SetProcessor80286p>
        SetProcessor80386r @<SetProcessor80386r>
        SetProcessor80386p @<SetProcessor80386p>
        SetProcessor80486r @<SetProcessor80486r>
        SetProcessor80486p @<SetProcessor80486p>
        SetProcessor8085   @<SetProcessor8085>

Changing the Processor Type leads to reanalysis of all program.
Sometimes this is useful.

Valid processor types are:

        8086    - Intel 8086
        80286r  - Intel 80286 real mode
        80286p  - Intel 80286 protected mode
        80386r  - Intel 80386 real mode
        80386p  - Intel 80386 protected mode
        8085    - Intel 8085

If you've used 8085 you can't select
other processor types and vice versa.

You can't select a processor type that is lower that the current
one.  For example, if the current processor type is 80286p, you
can select 80286p,80386r,80386p and you can't select
8086,80286r.

See also @0:773[Options] submenu.⌐WRAP
Create a New Segment ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: CreateSegment
 Current hotkey: @<CreateSegment>

This command allows to create a new segment.
If another segment already exists at the specifed addresses,
the existing segment is truncated and the new segment lasts from the
specified start address to the next segment
(or specified end address, whatever is lower).

See also @0:777[Edit|Segments] submenu.{WRAP
Change Segment Bounds ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: SegmentBounds
 Current hotkey: @<SegmentBounds>

This command allows to change the starting and the ending addresses
of the current segment.
If another segment already exists at the specifed addresses,
you will hear a beep and the segment bounds will not be changed.

See also @0:777[Edit|Segments] submenu.ÇWRAP
Delete a Segment ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: KillSegment
 Current hotkey: @<KillSegment>

This command allows to delete a segment.

All information about the segment will be lost!

To disassemble the addresses occupied by the segment you need to create a
new segment again (i.e. you can't disassemble bytes without a segment).

See also @0:777[Edit|Segments] submenu.3WRAP
Can't Move Segment ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

IDA can't move this segment to the specified place.
This may occur due to the following errors:
  - moving of the segment start would
    create bytes with negative offset
    within the segment
  - other error (in this case you would
    see error messages)ìWRAP
Moving Segment ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

If you are sure, please confirm (press Enter).
Otherwise, press Esc.

 Caution: moving the first segment of the program will
delete all information about the bytes between the old start of the segment
and the new start of the segment!

See also another command that changes segment bounds:
 @0:675[Change Segment Bounds]
and
 @0:777[Edit|Segments] submenu.OWRAP
Choose segment ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Select any line. By default, the cursor
is on the current segment.

You can use <Up>, <Down>, <PgUp>,
<PgDn>, <Home>, <End> keys. If you
select the first line of the list,
nothing will be selected.

Press <Enter> to select line, <Esc> to cancel.

See also @0:777[other segment related commands]'WRAP
Change Segment Name ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: RenameSegment
 Current hotkey: @<RenameSegment>

Enter new name for the segment.
Segment name is up to 8 characters long.
IDA doesn't check it for good shape.
Try to give mnemonic names.

See also @0:777[Edit|Segments] submenu.ÖWRAP
Change Segment Addressing ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: SegmentAddressing
 Current hotkey: @<SegmentAddressing>

If the segment had 16-addressing, it will have 32-bit addressing and
vice versa ( use16 <-> use32 ).

All previous information about the segment will be lost!

Never do it if you are not sure. It may have irreversible consequences.

See also @0:777[Edit|Segments] submenu.eWRAP
Segment Class Name ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: SegmentClass
 Current hotkey: @<SegmentClass>

The Segment Class Name identifies the segment with a class name
(such as CODE, FAR_DATA, or STACK). The linker places segments with
the same class name into a contiguous area of memory in the run-time
memory map.

Changing the segment class changes only the segment definition
on the screen. Nothing else will happen.

!!! Attention !!! Segment class names are not deleted. Once you
define a segment class name, you can't reuse it as a name of another object.

See also @0:777[Edit|Segments] submenu.▐WRAP
Change Segment Alignment ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

            Action             Hotkey
            ------             ------
         SegmentAlignAbs     @<SegmentAlignAbs>
         SegmentAlignByte    @<SegmentAlignByte>
         SegmentAlignWord    @<SegmentAlignWord>
         SegmentAlignPara    @<SegmentAlignPara>
         SegmentAlignPage    @<SegmentAlignPage>
         SegmentAlignDble    @<SegmentAlignDble>

Alignment:  select between abs,byte,word,dword,para,page

You can specify the segment alignment for the selected
segment. By default, IDA assumes 'byte' alignment.
Changing the aligment changes only the segment definition
on the screen. Nothing else will happen.

See also @0:777[Edit|Segments] submenu.φWRAP
Change Segment Combination ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

            Action             Hotkey
            ------             ------
         SegmentCombPrivate @<SegmentCombPrivate>
         SegmentCombPublic  @<SegmentCombPublic>
         SegmentCombCommon  @<SegmentCombCommon>
         SegmentCombStack   @<SegmentCombStack>

Combination

A field that describes how the linker can combine the
segment with other segments. Under MS-DOS, segments with
the same name and class can be combined in two ways: they
can be concatenated to form one logical segment, or they
can be overlapped. In the latter case, they have either the
same starting address or the same ending address, and they
describe a common area in memory. Values for the field
are:

  Private. Do not combine with any
           other program segment.
  Public.  Combine by appending at 
           an offset that meets the
           alignment requirement.
       
  Stack.   Combine as for Public.
           This combine type forces
           byte alignment.
       
  Common.  Combine by overlay using
           maximum size.
       

Changing segment combination changes only the segment definition
on the screen. Nothing else will happen.

See also @0:777[Edit|Segments] submenu.WRAP
Jump to the Specified Segment ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpSegment
 Current hotkey: @<JumpSegment>

This command jumps to the start of the selected segment.
IDA will ask to select a segment to jump to.
After:
  The current address is saved in the 'Jumps Stack'.
  Cursor is positioned to the specified segment start.

The @0:721[Return] command (usually Esc) will return you back.

See also:
 @0:679[How to choose a segment]
 @0:777[Other segment related commands]
 @0:722[Navigate|Jump to...] submenu.WRAP
Jump to the Specified address ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpAsk
 Current hotkey: @<JumpAsk>

IDA will ask an address to jump to.
You can enter name or address in hexadecimal format
with or without segment.
If you enter a valid address, then:
  The current address is saved in the 'Jumps Stack'.
  Cursor is positioned to the specified address.

The @0:721[Return] command (usually Esc) will return you back.

See also @0:722[Navigate|Jump to...] submenu.
         @0:68[How to Enter an Address].!WRAP
Jump to the Specified Segment Register Change Point ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpSegmentRegister
 Current hotkey: @<JumpSegmentRegister>

This command jumps to the selected
@0:688[Segment Register Change Point].
IDA will ask to select a change point to jump to.
And after:
  The current address is saved in the 'Jumps Stack'.
  Cursor is positioned to the specified change point.

The @0:721[Return] command (usually Esc) will return you back.

See also @0:722[Navigate|Jump to...] submenu.╣WRAP
Segment Register Change Points ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

When IDA encounters an instruction which changes a segment
register, it creates a change point. So, mostly change points
are maintained by IDA itself. IDA assumes that between change
points the segment registers don't change their values. If you
find out that IDA failed to locate a segment resgiter changing,
or you want to change a register value,
you can create a change point using @0:704[Change Segment Register]
command. You can change value of a segment register
using @0:705[Set default segment register value] command.

IDA classifies the change points. In the change points list
you can see the following postfixes after register values:

 a (auto)     - Created by IDA. May be
                changed by IDA afterwards.
 u (by user)  - Created by user. IDA will
                not change it.

IDA generates the appropriate 'assume' instructions for the
change points.
┌WRAP
Jump to the Next Address from the Problems List ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpQ
 Current hotkey: @<JumpQ>

This command jumps to the next address from the
@0:690[Problems List].
If the Problems List is empty, you will hear a beep.
Otherwise, IDA will display a brief description of the problem
and will jump to it.
The @0:721[Return] command (usually Esc) will return you back.

See also @0:722[Navigate|Jump to...] submenu.æWRAP
Problems List ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀

The following problems exist:
  @0:691[Can't find offset base]
  @0:692[Can't find name]
  @0:693[Can't find alternative string for an operand]
  @0:694[Can't find comment]
  @0:695[Can't find references]
  @0:696[Indirect execution flow]
  @0:697[Can't disassemble]
  @0:698[Already data or code]
  @0:699[Execution flows beyond limits]
  @0:700[Too many lines]WRAP
Problem: Can't find offset base ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Description:
        The current item has an operand marked as an offset,
        but IDA can't find the offset base in the database.

 Possible reason(s):
        Probably, IDA base is corrupt.
        This may occur after database repairing.

 What to do:
        Mark the operand again as an offset. Use one of the following
        commands:
         @0:756[Convert to offset (DS)]
         @0:757[Convert to offset (CS)]
         @0:653[Convert to offset (any)]
}WRAP
Problem: Can't find name ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Description:
        Two reasons can cause this problem:
          1.Reference to an illegal address is made in the program being
            disassembled;
          2.IDA couldn't find a name for the address but
            it should exist.
 What to do:
        1. If this problem is caused by a reference to an illegal address
            - try to enter the operand @0:654[manually]
            - or make the illegal address legal @0:674[creating] a new segment.
        2. Otherwise, database is corrupt, the best thing to do is
           to @0:707[reload] the database.
⌡WRAP
Problem: Can't find alternative string for an operand ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Description:
        The current item has an operand marked as entered manually,
        but IDA can't find the manually entered string in the database.

 Possible reason(s):
        IDA base is corrupt. This may occur after database repairing.

 What to do:
        Enter the operand manually again. Use one of the following
        commands:
         @0:654[User-defined operand]òWRAP
Problem: Can't find comment ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Description:
        The current item is marked as having a comment,
        but IDA can't find the comment in the database.

 Possible reason(s):
        IDA base is corrupt. This may occur after database repairing.

 What to do:
        Enter the comment again. Use the following command:
         @0:658[How to enter regular comments]ÑWRAP
Problem: Can't find references ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Description:
        The current item is marked as referenced from other place(s) in the
        program, but IDA can't find any reference to it.

 Possible reason(s):
        IDA base is corrupt. This may occur after database repairing.

 What to do:
        Database is corrupt, the best thing to do is
           to @0:707[reload] the database.-WRAP
Problem: Indirect execution flow ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Description:
        Actually, this is not a problem. IDA warns you,
        that here it encountered an indirect jump and
        can't follow the execution.

 What to do:
        Nothing, that is only for your informationYWRAP
Problem: Can't disassemble ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Description:
        IDA can't disassemble the specified bytes as an instruction.
        Probably, you should choose another processor type.

 Possible reason(s):
        1. The specified bytes don't contain instruction.
        2. The current @0:673[processor] type is not correct.

 What to do:
        If you are sure that the specified bytes contain an instruction,
        you can try to change @0:673[processor] type and
        mark this bytes as instruction using the following command:
         @0:738[Convert to instruction]IWRAP
Problem: Already data or code ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Description:
        IDA can't convert this byte(s) to an @0:738[instruction]
        or @0:739[data] because it would overlap another instruction.

 What to do:
        Make following instruction or data 'unexplored'
        using @0:736[undefine] command.\WRAP
Problem: Execution flows beyond limits ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Description:
        IDA encountered a jump or call instruction to an illegal address.
        Namely:
          - jump/call beyond program segments
          - near jump/call beyond the current segment
 What to do:
        1. Enter the operand @0:654[manually]
        2. or Create a new @0:674[segment] making the illegal address legal
        3. or Change the current segment bounds using one of the following:
              @0:675[How to change segment bounds]
              @0:758[How to move a segment start]ëWRAP
Problem: Too many lines ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Description:
        The current item (instruction or data) can't be
        represented in the text form using 100 lines.

 What to do:
        1. If the current item is an @0:652[array] or @0:740[ASCII] string, try to divide it.
        2. Delete @0:655[Additional comment lines]
        3. @0:760[Disable] cross-references displayWRAP
Indirect Jumps Table ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeJumpTable
 Current hotkey: @<MakeJumpTable>

When you find indirect jumps by table you can inform IDA
about address and size of this table. In this case IDA will
continue analysing of the program using the table. For example,
it will convert to code all addresses referenced by the table.

You should specify address and size of this table.

See also @0:774[Edit|Analysis] submenu
         @0:66[How to Enter a Number]
         @0:68[How to Enter an Address].»WRAP
Bad Indirect Jumps Table ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

The specified table is overlapped with some other object
(any data,code instructions) or table address is invalid.>WRAP
Cross References control ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: Link, Unlink
 Current hotkey: @<Link>, @<Unlink>

Sometimes you want to add/delete some cross-references,
because IDA fails to follow cross-references or misplaces them.
Usually this happens due to bad segment register values.
First check segment register values and if it doesn't help,
then apply this command as a last resort.

You can disable displaying of xrefs using
  @0:760[toggle display of xrefs] command.

See also @0:774[Edit|Analysis] submenu.
         @0:68[How to Enter an Address].╩WRAP
Change Segment Register Value ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: SetSegmentRegister
 Current hotkey: @<SetSegmentRegister>

Meaningful only for Intel 80x86 processors.

This command creates or updates a segment register
@0:688[change point].

See @0:687[jump to segment register change point] for more info.

 See also @0:776[Edit|Registers] submenu.
 See also @0:65[How to enter segment value].
 See also @0:66[How to Enter a Number].▐WRAP
Set Default Segment Register Value ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: SetSegmentRegisterDefault
 Current hotkey: @<SetSegmentRegisterDefault>

Meaningful only for Intel 80x86 processors.

You can specify a default value of a segment register for the current segment.
When you change the default value, IDA will reanalyse the segment,
taking the default value when it can't determine the actual value
of the register. This takes time, so don't be surprised if references
are not corrected immediately.

To specify other than default value of a segment register you can
use @0:704[change segment register value] command.

 See also @0:776[Edit|Registers] submenu.
 See also @0:65[How to enter segment value].WRAP
Create MAP File ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ProduceMap
 Current hotkey: @<ProduceMap>

Enter a file name for the map. IDA will write the following
information to this file:
  current segmentation
  list of names sorted by values
    (automatically generated names are not listed)

You can use this map file for your information and you can
use it for debugging (for example, Periscope from Periscope
Company or Borland's Turbo Debugger can read this file).

See also other @0:780[Produce output file] commands.╕WRAP
Unload database ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: Unload
 Current hotkey: @<Unload>

This command saves current IDA database into a text file.

You can use it as a safety command:
  - to protect your work from disasters
  - to migrate information
    into new database formats of IDA.

The 'Unload' command is used when you want to switch to a new version
of IDA. Usually each new version of IDA has its own database
format. To create a new format database, you need:
  - to issue the  'Unload' command for the old
    database (using old version of IDA). You will
    receive an IDC file containing all information
    from your old database.
  - to reload your database using new IDA with switch
    -x.
  - to compile and execute the IDC file with command
    'Execute IDC file' (usually F2)

To load the saved information, use the following
@0:711[IDC] command:

  dofile "filename";

See also other
 @0:780[Produce output file] commands.WRAP
Create ASM File ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ProduceAsm
 Current hotkey: @<ProduceAsm>

Enter a file name for the assembler text file. IDA will write
the disassembled text to this file.

If you've selected an area on the screen using @0:47[Drop Anchor]
command, IDA will write only the selected area (from the
current address to the anchor).

If some I/O problem (e.g. disk full) occurs during writing
to this file, IDA will stop - a partial file will be created.

See also other @0:780[Produce output file] commands.WRAP
Create LST File ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ProduceLst
 Current hotkey: @<ProduceLst>

Enter a file name for the assembler text file. IDA will write
the disassembled text to this file.

If you've selected an area on the screen using @0:47[Drop Anchor]
command, IDA will write only the selected area (from the
current address to the anchor).

If some I/O problem (e.g. disk full) occurs during writing
to this file, IDA will stop - a partial file will be created.

See also other @0:780[Produce output file] commands.ⁿWRAP
Create Executable File ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ProduceExe
 Current hotkey: @<ProduceExe>

Enter a file name for the new executable file. Usually this
command is used after patching (see commands @0:712[Patch byte] and
@0:712[Patch word]) to obtain a patched version of the file.


NOTE: only @0:712[Patch byte/word] commands affect the executable
file contents, other commands
(including @0:654[Alternate String for the #th Operand]) don't affect it.

 EXE files:
 ----------
 IDA will reproduce the same EXE-header, relocation table as before
and fill with zero unused areas of the EXE file (e.g. between
relocation table and loadable pages).

See also @0:780[File|Produce output file] submenu,
         @0:778[Edit|Patch core] submenu.ΣWRAP
IDC Command ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: Execute
 Current hotkey: @<Execute>

    You can execute small scripts written in the built-in
    language named @0:633[IDC].

See also @0:716[other File... submenu] commands.DWRAP
Patching the Image ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: PatchByte, PatchWord
 Current hotkey: @<PatchByte>, @<PatchWord>

You can modify executable file and
@0:710[generate a new] file.  You can modify
@0:736[unexplored] items only.

See also @0:778[Edit|Patch core] submenu.
See also @0:66[How to Enter a Number].ÅWRAP
Auto analysis is not completed ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Till auto analysis is not completed, the IDA database is not consistent:
  - not all @0:760[cross-references] are found
  - not all @0:738[instructions] are disassembled
  - not all @0:739[data] items are defined

See also:
  @0:742[enable/disable analysis]
  @0:765[auto analysis display]
  @0:737[wait until end of analysis]WRAP
Cannot Create File ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Probably this file exists and has
read-only attribute.  Try to delete it
or clear this attribute.

Another reason is that you have too few
number in FILES= statement of your
CONFIG.SYS file. IDA requires about 10
file handlers to be free.WRAP
Disk Write Error ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

May be your DISK IS FULL?  Try to
delete some unnessesary files.

Probably your disk contains unmarked BAD
SECTORS. This is very dangerous.  I
recommend you to re-format your disk or
to mark somehow these sectors.

Partial file is created.µWRAP
File submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀

In this submenu you can:

  @0:718[Open]               Open a window
  @0:711[IDA command]        Execute an IDC command
  @0:780[Produce output file] Generate output file
  @0:781[Save]               Flush changes to disk
  @0:737[Wait]               Wait until end of analysis
  @0:782[DOS shell]          Execute DOS command
  @0:783[Repaint desktop]    Repaint screen
  @0:784[Quit]               Quit to DOS

See also @0:717[Menu Bar] submenus.└WRAP
Main Menu Bar ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀

All IDA commands are available from the followings menus:

 @0:716[File]
 @0:770[Edit]
 @0:769[Navigate]
 @0:772[View]
 @0:773[Options]
 @0:771[Windows]
WRAP
Open a window ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: WindowOpen
 Current hotkey: @<WindowOpen>

Opens a new window with disassembled text.
IDA automatically opens one big window
at the start. If you want, you can open other windows.

See also @0:716[other File... submenu] commands.∞WRAP
Jump to the Previously Marked Position ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpPosition
 Current hotkey: @<JumpPosition>

This command jumps to the selected postion.
IDA will ask to select a position to jump to.
After:
  The current address is saved
  in the @0:720[Jumps Stack].
  Cursor is positioned to the
  specified segment start.

The @0:721[Return] command (usually Esc) will return you back.

You can mark position using @0:725[Mark Position] command.
²WRAP
Jumps Stack ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀

Each IDA Window has its own jumps stack. This stack keeps cursor locations.
Many IDA commands use jumps stack, i.e. they save old cursor position to
the stack. For example, when you are at the address 3000:0100 and press
key Ctrl-C (find instruction), the 3000:0100 is saved into the jumps stack
and the search is started. Afterwards, you can return to the old position
using @0:721[Return] command.

You can see the current depth of this stack in the bottom
of the screen.
3WRAP
'Return' Command ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: Return
 Current hotkey: @<Return>

This command returns you back to the previous positions.
It takes positions from @0:720[Jumps Stack].
You can see the current depth of this stack in the bottom
of the screen.

See also @0:769[Navigate] submenu.│WRAP
Navigate|Jump to   submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

In this menu you can select a command to jump to the specified
location in the file.  Jumps are very fast and your previous
position is saved. This submenu contains the following items:

 @0:686[Jump to the Specified Address]
 @0:779[Jump to the Named Location]
 @0:685[Jump to the Specified Segment Start]
 @0:719[Jump to the Previously Marked Position]
 @0:687[Jump to the Specified Segment Register Change Point]
 @0:689[Jump to the Next Address from the Problems List]
 @0:725[How to Mark a Location]

Look also @0:723[Search for...] menu for fast navigating.
See @0:720[Jumps Stack] concept.
See @0:769[Navigate] submenu.╙WRAP
Navigate|Search for   submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

In this menu you can select a command to search for something
in the file.  Searches are relatively slow and your previous
position is saved in @0:720[Jumps Stack].

You can search for:
   @0:662[substring in the text representation]
   @0:660[substring in the binary image of the file]
   @0:730[unexplored bytes]
   @0:731[explored bytes]
   @0:727[instruction bytes]
   @0:728[data bytes]
   @0:661[immediate operand values]
 * @0:726[instructions that need your ATTENTION] (voids)
   @0:729[start of procedures]

 in both @0:724[directions] (up and down).

Look also @0:722[Jump to...] menu for fast navigating.

See also @0:769[Navigate] submenu.
wWRAP
Set Direction for Searches ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: SetDirection
 Current hotkey: @<SetDirection>

The current direction for searches is displayed in the right
upper corner of the screen. Using this command you can toggle
it.

See also @0:723[Navigate|Search for...] submenu,
         @0:769[Navigate] submenu,
         @0:773[Options] submenu.
│WRAP
Mark Position ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MarkPosition
 Current hotkey: @<MarkPosition>

You can mark certain locations of the file to be able to @0:719[jump] to
them quickly. Text description of the location may help to find
a desired location easily.

First you select a slot for the mark, after you enter a
description for the location.

See also @0:769[Navigate] submenu,
         @0:722[Navigate|Jump to...] submenu.'WRAP
Search for next void ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpVoid
 Current hotkey: @<JumpVoid>

'void' instructions are instructions that need your attention
because they contain an immediate operand that could be a
number or offset. IDA doesn't know about it, so it marks these
instructions as 'void'.  You can change 'void' operands
definition using @0:666[set lower limit of voids] and
@0:666[set upper limit of voids] commands.

You can also disable display of the 'void' marks using
@0:761[toggle voids display] command.

NOTE ▄
 ▀▀▀▀▀

I strongly recommend that before producing an ASM file you go
through 'void' marks and get rid of them.  After this you have
a certain level of confidence that the file have been
disassembled correctly.

See also @0:723[Navigate|Search for...] submenu.≡WRAP
Search for next code ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpCode
 Current hotkey: @<JumpCode>

This command searches for the first instruction in the
@0:724[current direction].

See also @0:723[Navigate|Search for...] submenu.ΘWRAP
Search for next data ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpData
 Current hotkey: @<JumpData>

This command searches for the first data in the
@0:724[current direction].

See also @0:723[Navigate|Search for...] submenu.}WRAP
Search for next procedure ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpProc
 Current hotkey: @<JumpProc>

This command searches for the first procedure in the
@0:724[current direction].

IDA doesn't use the concept of procedures. It simply allows
you to create prcedure headings (assembler 'proc' instruction)
and endings ('endp' command).
You can create them using appropriate commands. IDA won't
check this.

 NOTE ▄
 ▀▀▀▀▀▀
 Never create a procedure ending without procedure heading.
This can cause IDA to spend a great lot of time in searching
for the procedure heading.

See also @0:723[Navigate|Search for...] submenu.WRAP
Search for next unexplored byte ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpUnknown
 Current hotkey: @<JumpUnknown>

This command searches for the first unexplored byte in the
@0:724[current direction].

See also @0:723[Navigate|Search for...] submenu.WRAP
Search for next defined byte ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpDefined
 Current hotkey: @<JumpDefined>

This command searches for the first defined byte 
(instruction or data) in the 
@0:724[current direction].

See also @0:723[Navigate|Search for...] submenu.5WRAP
Repeat search for instruction/data with the specified operand ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpImmediate
 Current hotkey: @<JumpImmediate>

This command repeats @0:661[search for immediate] command.

See also @0:723[Navigate|Search for...] submenu.WRAP
Repeat search for substring in the text representation ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpText
 Current hotkey: @<JumpText>

This command repeats @0:662[search for text] command.

See also @0:723[Navigate|Search for...] submenu.WRAP
Repeat search for substring in the file ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpBinaryText
 Current hotkey: @<JumpBinaryText>

This command repeats @0:660[search for text in core] command.

See also @0:723[Navigate|Search for...] submenu.DWRAP
Edit|Analysis|Define as submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This submenu allows you to change text representation of the file
converting unexplored bytes to instructions and data.

  @0:738[instruction]
  @0:739[data]
  @0:740[ascii]
  @0:652[array]
  @0:736[undefine]

See also @0:774[Edit|Analysis] submenu. WRAP
Undefine a byte ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeUnknown
 Current hotkey: @<MakeUnknown>

This command deletes the current instruction or data converting
it to 'unexplored' bytes.

See also
 @0:735[Other Edit|Analysis|Define As... commands]'WRAP
Wait for end of auto analys ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: Wait
 Current hotkey: @<Wait>

This command suspends execution of @0:46[macro] until auto
analysis in ended,
i.e. the auto analysis @0:765[indicator] is 'Ready'.

See also @0:716[other File... submenu] commands.WRAP
Convert to instruction ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeCode
 Current hotkey: @<MakeCode>

This command converts the current unexplored bytes to instruction(s).
If it is not possible, IDA will warn you.

See also
 @0:735[Other Edit|Analysis|Define As... commands]WRAP
Convert to data ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeData
 Current hotkey: @<MakeData>

This command converts the current unexplored bytes to data.
If it is not possible, IDA will warn you.
Multiple using of this command will change data type:

        db -> dw -> dd -> dq -> dt -        ^                           |
        `---------------------------'

To convert back, use @0:736[Undefine] command.
To create an array, use @0:652[Array] command.

See also
 @0:735[Other Edit|Analysis|Define As... commands]µWRAP
Convert to ASCII string ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeAscii
 Current hotkey: @<MakeAscii>

This command converts the current unexplored bytes to a string.  IDA
will add characters to the string until '\0' or
@0:605[ASCII end symbol] is not encountered.
You can change ASCII end symbol using appropriate
command.  If the @0:47[anchor] was dropped, then IDA takes for the string
all characters between the current cursor position and the anchor.

You can change ASCII string length using @0:652[Array] command.

Pascal Strings ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
 To create Pascal style strings (with first byte indicating string
length) use @0:665[Set Ascii Style] command.

See also
 @0:735[Other Edit|Analysis|Define As... commands]¬WRAP
Options|Toggle displaying   submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Here you can show or hide some details in the text representation
of the file.

Sometimes it is nessesary to clean up heavy screens full of details.
You can disable cross-references,@0:726[void] marks, empty lines display
and much more...

Besides, the generated text file is smaller if you disable cross
references etc.

 @0:760[Cross references display]
 @0:761['void' marks display]
 @0:762[Simple comments display]
 @0:763[Empty line display]
 @0:764[Borders display]
 @0:765[Auto analysis display]
 @0:766[Line prefixes display]
 @0:767[Segment names display]

See also @0:773[Options] submenu.)WRAP
Enable/Disable auto analysis ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: SetAuto
 Current hotkey: @<SetAuto>

Usually, auto analysis is enabled.
Disable it if you are sure that this will help you.

Mainly this command is for debugging purposes only.

See also @0:773[Options] submenu.[WRAP
Edit|Text|Comments   submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Here you can manipulate with different kinds of comments.
Use them to make disassembled text more understandable.

 @0:658[Regular comments]
 @0:749[Predefined comments]
 @0:655[Additional comment lines]
 @0:750[Change Indention of Comments]

See also @0:775[Edit|Text] submenu.&WRAP
Edit|Text|Type of immediate args   submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Here you can change operand types to offset,number,chars, etc. 
Use them to make disassembled text more understandable.

Use this commands to delete @0:726[void] marks.

 @0:751[Convert to decimal number]
 @0:752[Convert to character]
 @0:753[Convert to hex number]
 @0:755[Convert to segment]
 @0:756[Convert to offset (DS)]
 @0:757[Convert to offset (CS)]
 @0:653[Convert to offset (any)]
 @0:754[Mark as variable]

See also @0:775[Edit|Text] submenu.πWRAP
Make Procedure Heading ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeProcedure
 Current hotkey: @<MakeProcedure>

IDA doesn't use the concept of procedures. It simply allows
you to create prcedure headings (assembler 'proc' instruction)
and endings ('endp' command).

With this command you can create procedure heading:

        sub_45          proc near

Multiple using of this command toggles:

        proc near -> proc far -> no proc

See also @0:775[Edit|Text] submenu.6WRAP
Make Procedure Ending ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeEndOfProcedure
 Current hotkey: @<MakeEndOfProcedure>

IDA doesn't use the concept of procedures. It simply allows
you to create procedure headings (assembler 'proc' instruction)
and endings ('endp' command).

With this command you can create procedure ending:

        sub_45          endp

 NOTE:
 -----
 Never create a procedure ending without procedure heading.
This can cause IDA to spend a great lot of time in searching
for the procedure heading.

See also @0:775[Edit|Text] submenu.XWRAP
Change Indention of Text ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    names: IncrementIndent, DecrementIndent
 Current hotkeys: @<IncrementIndent>, @<DecrementIndent>

You can change indention of text using these commands.

This can be a great help when you are going to produce
a large disassembled text.

See also @0:775[Edit|Text] submenu.8WRAP
Enable/Disable Tabulations ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: SetTabulations
 Current hotkey: @<SetTabulations>

You can disable tabulation symbols (0x09) in the 
output file if you don't like them.

By default, IDA produces output files with tabulations.

See also @0:775[Edit|Text] submenu.QWRAP
Retrieve predefined comment ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakePredefinedComment
 Current hotkey: @<MakePredefinedComment>

You can retrieve predefined comment for instructions.

For this, you should specify the @0:656[command type]
and so-called @0:657[help index].

See also @0:743[Edit|Text|Comments] submenu.7WRAP
Change Indention of Comments ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: IncrementCommentsIndent, DecrementCommentsIndent
 Current hotkey: @<IncrementCommentsIndent>,@<DecrementCommentsIndent>

You can change indention of comments using these commands.

See also @0:743[Edit|Text|Comments] submenu.áWRAP
Immediate Operand -> Decimal ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeDecimal
 Current hotkey: @<MakeDecimal>

This command converts immediate operand(s) type of the
current instruction/data to decimal. Therefore, it
becomes a 'number'.

If this command affects another operand, try to use
 @0:654[Enter #th operand manually] commands.

See also
 @0:744[Edit|Text|Type of immediate args] submenu.~WRAP
Immediate Operand -> Character ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeChar
 Current hotkey: @<MakeChar>

This command converts immediate operand(s) type of the
current instruction/data to character.

If this command affects another operand, try to use
 @0:654[Enter #th operand manually] commands.

See also
 @0:744[Edit|Text|Type of immediate args] submenu.«WRAP
Immediate Operand -> Number ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeNumber
 Current hotkey: @<MakeNumber>

This command converts immediate operand(s) type of the
current instruction/data to hex number. So you can
delete @0:726[void] mark of the item.

If this command affects another operand, try to use
 @0:654[Enter #th operand manually] commands.

See also
 @0:744[Edit|Text|Type of immediate args] submenu.¢WRAP
Make Current Byte as a Variable ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeVariable
 Current hotkey: @<MakeVariable>

This command mark the current byte as variable.
Variable bytes have asterisk (*) in the beginning
of the line.

Use it only for your purposes only. IDA ignores
these marks, but creates them for your convinience.

See also
 @0:744[Edit|Text|Type of immediate args] submenu.ΘWRAP
Immediate Operand -> Segment ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeSegment
 Current hotkey: @<MakeSegment>

This command converts immediate operand(s) type of the
current instruction/data to segment base.

If IDA can't find a segment with the immediate operand's
value, it simply displays it as hex number.

If this command affects another operand, try to use
 @0:654[Enter #th operand manually] commands.

See also
 @0:744[Edit|Text|Type of immediate args] submenu.ÜWRAP
Immediate Operand -> Offset (base DS) ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeOffset
 Current hotkey: @<MakeOffset>

This command converts immediate operand(s) type of the
current instruction/data to offset by DS.

If current DS value is unknown (or equal 0xFFFF) IDA
will warn you -- beep at you. In this case you should
define DS register value for the current byte. The
best way to do it:
  - @0:687[jump to segment register change point]
  - @0:704[change value of DS]
  - @0:721[return]

or you can @0:705[change default value] of DS for the current
segment.

If you want to delete offset definition, you can use
this command again - it works as trigger.

See also: @0:757[offset by current segment]
          @0:653[any offset]
          @0:744[Edit|Text|Type of immediate args] submenu.

If this command affects another operand, try to use
 @0:654[Enter #th operand manually] commands.τWRAP
Immediate Operand -> Offset (base CS) ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeOffsetCs
 Current hotkey: @<MakeOffsetCs>

This command converts immediate operand(s) type of the
current instruction/data to offset by CS.

See also: @0:756[offset by data segment/no offset]
          @0:653[any offset]
          @0:744[Edit|Text|Type of immediate args] submenu.

If this command affects another operand, try to use
 @0:654[Enter #th operand manually] commands.┬WRAP
Move a Segment ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MoveSegment
 Current hotkey: @<MoveSegment>

Moving a segment means moving its beginning. So, the proper name
for this command would be 'Expand/Shrink a Segment' (due to
historical reasons the name is 'move segment'). First you
choose a segment by droping the @0:47[anchor] anywhere in the segment.
After you go to the desired new beginning of the segment and
call this command.  IDA will try to shrink/expand previous
segment in order to move the beginning of the selected segment.

You cannot shrink a segment to 0 bytes. A segment must have
at least 1 byte. You can use this instead of deleting segments.

See also @0:777[Edit|Segments] submenu.ÑWRAP
Show Registers ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ShowRegisters
 Current hotkey: @<ShowRegisters>

This command displays segment register contents in the messages window.
If the messages window is hidden beyond other windows, the screen will
not change.

Usually I use this command for screen refreshes, because
it is fast and does no harm.

See also @0:776[Edit|Registers] submenu.
         @0:772[View] submenu.WRAP
Disable/Enable Cross-references Display ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ToggleCrossReferences
 Current hotkey: @<ToggleCrossReferences>

This command enables or disables cross-references display.

See also
 @0:741[other display toggle commands]■WRAP
Disable/Enable 'void' Marks Display ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ToggleVoids
 Current hotkey: @<ToggleVoids>

This command enables or disables @0:726[void] marks display.

See also
 @0:741[other display toggle commands]╫WRAP
Disable/Enable AutoComments Display ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ToggleSillyComments
 Current hotkey: @<ToggleSillyComments>

This command enables or disables AutoComments display.

If you forgot meaning of a certain command, you can use
this command to get comments to all lines of the screen.

This command doesn't give comments to 'mov' command
and doesn't override existing comments.

See also
 @0:741[other display toggle commands]_WRAP
Disable/Enable Empty Lines Display ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ToggleEmptyLines
 Current hotkey: @<ToggleEmptyLines>

This command enables or disables empty lines display.

Useful to decrease number of blank lines on the screen
increasing amount of information on it.

See also
 @0:741[other display toggle commands]σWRAP
Disable/Enable Border Lines Display ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ToggleBorders
 Current hotkey: @<ToggleBorders>

This command enables or disables border lines display.

Useful to decrease number of border lines on the screen
increasing amount of information on it.

Border line:
 ;---------------------------------------------------------

is generated automatically by IDA to separate data and code.

See also
 @0:741[other display toggle commands]lWRAP
Disable/Enable AutoAnalysis Display ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ToggleAutoShow
 Current hotkey: @<ToggleAutoShow>

This command enables or disables auto analysis display. The display
is located in the upper right corner of the screen, near the timer.

 AU:??????    AutoAnalysis indicator. This indicator represents
              the state of AutoAnalysis. Possible values of
              this indicator are presented below:
 AU:*off*      the indicator is turned off. This command turns
               on/off this indicator.
 AU:*idle*     AutoAnalysis is finished.
 AU:disable    AutoAnalysis is disabled.
 AC:<address> the code analysis goes through the noted address
 PL:<address> the code analysis is planned through the noted address
 ??:<address> the noted address becomes unexplored

See also
 @0:741[other display toggle commands]VWRAP
Disable/Enable Line Prefixes Display ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: TogglePrefixes
 Current hotkey: @<TogglePrefixes>

This command enables or disables line prefixes display.
Line prefix is the address of the current byte:

 3000:1000      mov ax,bx
 ^^^^^^^^^
See also
 @0:741[other display toggle commands]─WRAP
Disable/Enable Segment Names Display ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ToggleSegmentNames
 Current hotkey: @<ToggleSegmentNames>

This command enables or disables segment names display.
If enabled, IDA will use segment name in all addresses.
If disabled, IDA will use segment bases.

Example (codeseg has base 3000):

   Enabled:     codeseg:0034
   Disabled:    3000:0034

See also
 @0:741[other display toggle commands]═WRAP
Show Internal Flags ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ShowFlags
 Current hotkey: @<ShowFlags>

This command displays internal flag values for the current byte.

See also @0:772[View] submenu.eWRAP
Navigate submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This submenu allows fast access to desired address
or item in the file. You can search for things,
jump to specified addresses etc.

 @0:722[Jump to...] submenu
 @0:723[Search for...] submenu
 @0:721[Return] command

 @0:724[Set direction for searches]
 @0:725[Mark position]

See also @0:717[Menu Bar] submenus.╕WRAP
Edit submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀

This submenu allows to modify text representation
and to patch the file.
Also, here you'll find commands to control program
analys. There are the following submenus:
  
 @0:774[Analysis] - affect analysis & text
 @0:775[Text] - affect disassembled text only
 @0:776[Registers] - Emulated registers
 @0:777[Segments]
 @0:778[Patch core]

See also @0:717[Menu Bar] submenus.
         @0:770[Edit] submenu.│WRAP
Windows submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Here you can manipulate with windows on the screen.
I think that you don't need help on this topic?

See also @0:717[Menu Bar] submenus./WRAP
View submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀

All sorts of information.

  @0:671[View File]
  @0:672[Calculator]
  @0:759[View general registers]
  @0:668[Open segment registers window]
  @0:669[Open segments window]
  @0:670[Open names window]
  @0:768[View internal flags]

See also @0:717[Menu Bar] submenus.BWRAP
Options Submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 @0:673[Processor type]
 @0:742[Auto analysis]
 @0:666[Limits of voids]
 @0:724[Search direction]
 @0:667[Tail depth]
 @0:664[Ascii break character]
 @0:663[Ascii end character]
 @0:665[Pascal-style strings]
 @0:741[Toggle displaying] submenu

See also @0:717[Menu Bar] submenus.nWRAP
Edit|Analysis Submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Here are commands to define a flow control in the program,
change operand types etc.
They affect program analysis and text representation.

 @0:735[Define As...] submenu
 @0:736[Convert to Unknown]
 @0:701[Jump Table]
 @0:703[Links]

See also @0:775[text representation] commands.
         @0:770[Edit] submenu.ΘWRAP
Edit|Text Submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Here you can change text representation of the program:
add comments, set indents, set alternative strings
for operands etc.

 @0:744[Argment type] submenu
 @0:743[Comments] submenu
 @0:659[Rename]
 @0:745[Make procedure]
 @0:746[Make end of procedure]
 @0:654[User-defined operand]
 @0:663[Set Ascii break char]
 @0:747[Indention of program code]
 @0:748[Tabulation]

See also @0:774[analysis & text] commands.
         @0:770[Edit] submenu.,WRAP
Edit|Registers submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Here you can inspect and change emulated register values.

 @0:705[Set default segment register value]
 @0:704[Change segment register value]
 @0:759[Show general register]
 @0:668[Open segment registers window]

See also @0:770[Edit] submenu.°WRAP
Edit|Segments submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 @0:674[How to create a new segment]
 @0:676[How to delete a segment]
 @0:675[How to change segment bounds]
 @0:758[How to move a segment start]
 @0:680[How to change segment name]
 @0:681[How to change segment addressing mode]
 @0:682[How to change segment class]
 @0:683[How to change segment alignment]
 @0:684[How to change segment combination]

See also:
 @0:679[How to choose a segment]
 @0:685[How to jump to a segment]
 @0:770[Edit] submenu.WRAP
Edit|Patch core  submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This submenu gives the way of quick patching of the file.
You can easily modify executable file and get a modifyed version
of the executable file.

 @0:712[Patch core]
 @0:710[Produce EXE file]

See also @0:770[Edit] submenu.TWRAP
Jump to the Chosen Name ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpName
 Current hotkey: @<JumpName>

You can choose a byte name to jump to.
IDA will display a list of names (sorted by addresses)
and you can choose a name to jump to.
Dummy names (generated by IDA) are not listed.

See also @0:722[Navigate|Jump to...] submenu.SWRAP
File|Produce output files  submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This submenu allows you to produce ASM, MAP and EXE files.
It also allows you to unload the database.

 @0:706[Generate MAP file]
 @0:708[Generate ASM file]
 @0:710[Generate EXE file]
 @0:707[Unload database]

See also @0:716[other File... submenu] commands.:WRAP
Save Buffers ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: Flush
 Current hotkey: @<Flush>

This command writes all IDA buffers to the disk.  IDA executes
this command periodically itself, so normally this command is
not nessesary. Use it before long and dangerous operations (for
example, before reanalysing the whole file).
Another solution is to use @0:707[Unload] command before dangerous
operations.


You can change the flushing frequency in the @0:650[configuration] file:

        AUTOSAVE=1

By default, AUTOSAVE=16.

See also @0:716[other File... submenu] commands.GWRAP
Invoke DOS Shell ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: Shell
 Current hotkey: @<Shell>

Using this command you can temporarily quit to DOS.  IDA will
write all changes to the disk and will close all databases.
So, it is not dangerous if you computer hangs during while you
are in the DOS.

Quitting to DOS it almost the same as leaving IDA completely,
except:
        IDA will remember @0:46[keystroke macros],
        IDA will remember @0:47[anchor] position
        IDA will not display welcome screen when you return to it.

See also @0:716[other File... submenu] commands.┼WRAP
Repaint Desktop ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: Repaint
 Current hotkey: @<Repaint>

This command allows you to repaint the IDA screen.

See also @0:716[other File... submenu] commands.WRAP
Exit IDA ▄
 ▀▀▀▀▀▀▀▀▀

 Action    name: Quit
 Current hotkey: @<Quit>

This command terminates the current IDA session. IDA will
write all changes to the disk and will close all databases.
It will remember all information about the screen, cursor
position, jumps stack, etc. The following information
will be lost:

        @0:46[keystroke macros],
        @0:47[anchor] position

Next time you can @0:785[call] IDA simply:

        >ida

without any additional parameters.

See also @0:716[other File... submenu] commands.WRAP
IDA command line switches ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

IDA is started with the following command line:

        ida [switches] file     -- first time
        ida                     -- after

  where switches:

 -a     disable @0:742[auto analysis]
 -i#### program entry point (hex)
 -b#### loading address (hex)
 -c     disassemble a new file
 -p#### @0:673[processor type]:
          8086,80286r,80286p,
          80386r,80386p,
          8085
 -R     don't load MS Windows resources
 -W###  specify MS Windows directory
 -x     don't create segmentation
        (used in pair with @0:707[Unload] command)w
        This switch doesn't affect NE format files.
 -n     don't load New Executable Format
 -d     debug
 -f     disable FPP instructions
 -h     this screenWRAP
Database Is Empty ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Although the database exists, it is empty.
Delete it and start again.

If you have previously saved your database into a text file,
you can load it. See @0:707[Unload] command for explanations.

See also @0:785[IDA usage help]Window refreshed...
8085OffⁿWRAP
Illegal Usage of the Switch ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Not all switches can be used when you
start IDA the second or more times.
Below are valid switches:

 -a     disable @0:742[auto analysis]
 -d     debug

See also @0:785[IDA usage help]