HF^NGUasÅ╝î┼hºatìƒ▓╩⌠0St₧╟°Gt¥╠²2Ztù½└╨Φ°0auî»╠Γ·%HcüÅ└σ√>M▒╙τ⌡'Nq│╔Θ#Lnƒ▄A~₧╙/╒
4?Jmî├µ 3 q | ç ╝ #*#e,æ-φ0V1╕3┘4a5g6L8Æ9ⁿ;å<è>f?=@╕A\B0C║CæDsE[F@HöLKOQ¿SZTqTëTóT┼TURUcUÇU╟U≥UV6VIVQVYVaViVpV|VÉVÜV░V╕V└V╔V╥V█VΣVεV∙VW
WW"W1W@WNW]WwWúWΓW·WXIXbX¥X╞XΩXY<Y\Y┤Y▌YZ(Z_ZåZ¡Z≥Z[=[m[¬[▄[╩\d]⌡^║_≥_$`M`è`ª`─`Ω`aa7aYa{a¬a╙abIbwbæbÑb╓b÷bcOcÇc▒cΣcdAdLd[düd╜d⌠d1eneöe╕efofsf|fÑf⌠fgég⌐g╦gΘgh2hnh₧h╔hivi╔ijAjoj¢jÑj¼j╗j⌡j!kJkykÑk╪k%lXläl▓lαlmHm|mªm═m≈mn"n1n<nUngnwnènán╕n╬n╒nΣnoo)oBooo┐o┌o∙o(pCpLpYpcpop{pâpÉp£p½p║p╚p╫pΓp²p+qBq\qxqéqîqöq£q¬q║q╠q▐q≤qrr*r8rHrSrerprxràr¼r├r╧rßr∙rss[sÄs╒stKtìt╨tuCuëu┴u*vCv[vwvÉv┘v!xHxdz╤zâ|K~}ügéâÇïßîIìFÄ¡Ä∞ÅÆªÆ:ö╧ò═ûÖ·Ö¢∙¢ε¥f₧íΓó±úσñ║ª═ºñ¿I¬√¬@¼▒f▓]╕Ä╕¥╕▀╕!╣M╣v╣Ñ╣╤╣║Q║ä║╣║Φ║╗?╗t╗É╗á╗░╗╞╗▄╗δ╗╝╝)╝8╝T╝i╝~╝╬╝╜o╜î╜½╜▌╜⌡╜╛
╛╛'╛6╛@╛P╛`╛y╛î╛ÿ╛│╛╦╛┘╛α╛±╛┐1┐q┐|┐ê┐ô┐ó┐┤┐┬┐═┐°┐└└$└4└G└S└`└Ö└╟└ ┴q┴Å┴°┴(┬n┬ï┬┬┬≤┬.├╢─╙─ì╞⌐╞╩╞
╟«╟╬╟■╟2╚ô╚»╚═╚ε╚·╚╔-╔u╔╔╔⌠╔╩?╩_╩ü╩░╩╦╩⌠╩╦J╦Ä╦╞╦Ω╦╠0╠\╠╕╠±╠S═a╙╘&╘ï╒ú╒╩╒)╫I╪	┌┌▌8▌4▐αΓÜσ■σVµDΘrδÅδºδ┴δF∞ë∞º∞¼∞▓∞╧∞kφíφ«φ╖φ├φ╠φ╪φßφεφ≈φεε#ε3ε<εIεRε\εeεqε}εW∩v∩ü∩í∩╙∩∙∩w≡ö≡╩≡∩≡'±Ö±░±▐±√±%≤)⌠D⌠S⌠Å⌠└⌠∩⌠⌡U⌡û⌡┼⌡÷J÷k÷ÿ÷╚≈s°╞·(√│√°√Cⁿlⁿ║²┌²Θ²■■)■:■M■]■u■ì■Ñ■╜■╒■∞■ 
 , D [ | ô ╢ ╟ ▐ ∩ · 4IYguâù⌐║═┘τ√#1?H_ivâæú«└█≤*F\rèÑ┴▐⌠8Naüñ╤■(R]gsüæ₧¬╚µ⌡2Kmù╝╫∙+<Z|ò½╛α°Ss&>o╦ P#t(Q)C*~+..Å1Z4¥5778÷:²<&?└B┤D╗GíIùJåKµL2OV0VGVpVuVφXⁿYBZ\ZqZàZ║Z▌Z⌠Zü[ì_╨_√_,`V`Ç`áa═cYdµdveîe¡e╪efLfxfóf╤fg9gvgÄg╗g▀gµgKh₧h⌐h⌠hîiºl¼råuwKy£zê{}J╜Ç▄Ç√Çü9ü[ü}ü£ü┐ü∩üéhéùé╣é█éεé■é"âCâ▐â	ä4äYäkäôä╗äσäà4àëVÄoÉüÆñö_ÿ;Ü╬¢∩¥náeóú)úKú~ú╢ú▐úKñxñªNº⌐⌐╫⌐¬@¬p¬£¬∙¬£½τ¼I»╘░&│╫│╢▌╖╛║╬╝ä└¢┬▓─░╟≈╚Θ╔0╦╢╠╫═v╧÷╙┼╒¬╫ö┘9▄zπ-≡O±»┬╫
├º4nîQ~█#╩%╪'»)µ*δ+╥,ç/\2╒3╞5∩8ß9╠:K=]>~?╡@╧A▀B8DfEGsI¥M?O∩PCRJT/VgX╛YW[]∞^c`
bªcêe≡iHlφröt²w∩z╛{%}n#ÇTüìé1ä_à╝å▄çbë╥èÖï╫Ä:É═ôαö▐òµ¥Já┴íGª╙ºQ⌐σ½¡¿» ▒H▓╫│√┤ÿ╡"╖╕╕░╣4╗_╝x╜m╛─N╞o╚B╩∩╦k═í╬ ╧╥╤!╥9╥c╥¬╥┬╥∩╥╙╪╙╘V╘ì╘º╘═╘≈╘!╒K╒ä╒╖╒δ╒╓9╓W╓z╓ú╓╔╓≡╓╫1╫X╫}╫«╫█╫╪5╪^╪ê╪╕╪τ╪┘F┘^┘à┘⌐┘╧┘≥┘7┌u┌│┌±┌█e█ì█┐█±█▄,▄7▄@▄J▄U▄`▄h▄p▄x▄▄î▄ù▄ó▄⌐▄│▄╝▄╩▄╓▄σ▄⌡▄▌▌ ▌,▌8▌S▌o▌ï▌º▌─▌ß▌■▌&▐F▐a▐é▐HFÄΦ¿í«¬ ¡ÑΓ.
ÄΦ¿í¬á ÄæÅÑαÑ»«½¡Ñ¡ ñ¿ß¬ÄΦ¿í¬á »α¿ τΓÑ¡¿¿ ß ñ¿ß¬á+@0:5[]
File %s is not a virtual array file╬WRAP
Not a virtual array file ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

The most probable error is the you tried to use incompatible version
of IDA. Starting from IDA 2.0 beta2 the format of virtual files was changed.7@0:7[]
Virtual Array %s: Accessing illegal address %lXíWRAP
Virtual Array: Accessing illegal address ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Normally this is an internal error of IDA. Please inform the author.=@0:9[]
Virtual Array %s: Maximum number of chunks is reached╕WRAP
Virtual Array: Maximum number of chunks is reached ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Virtual array can have up to ~ 170 chunks. You have reached this limit.can't close filecan't position in filefile read errorfile write errorpage is not in memory(attempt to write but declared read onlyfatal error? unknown error ?Virtual Memory '%s': %s!Lexical analyser: bad digit '%c'Lexical analyser: no Separator(Lexical analyser: non-terminated string'Lexical analyser: too long string '%s'/Lexical analyser: non-terminated char constant%Lexical analyser: bad character '%c'&Lexical analyser: too long ident '%s'+Lexical analyser: bad preprocessor command'Lexical analyser: bad 'include' syntax-Lexical analyser: max depth of includes is 8/Lexical analyser: can't open include file '%s'3Lexical analyser: getstr() function is not defined&Lexical analyser: end of file reachedCompiling file '%s'...
!Missing while statement for a doMissing semicolonMissing braket '['Missing colonSyntax error near: %sMissing brace6Function '%s' is too large (max compiled size is 64k)/You've reached the maximum number of functionsMisplaced 'break'Misplaced 'continue'!Variable '%s' is already definedVariable '%s' is undefinedToo complex programInternal parser error)Bad number of arguments for the function!Extra symbols at the end of fileToo many local variablesExecuting function '%s'...
Zero divide/Attempt to call non-existent external function#Attempt to call undefined functionIDC stack overflow!Undefined code0Runtime error at '%s' 0x%04X: %s, arg: '%s'(%u)
Not IDL file0Internal error: extra pop() from operands stack0Internal error: extra top() from operands stack Internal error: too many purgesbad local var #%dbad arg #%dF1 for HelpOKCancelErrorInformation%Enter - select default, Esc - cancel!@0:121[]
No memory for module %s@@0:114[]
Disk Positioning error: %s
Handler: %d. Position: %ld.Command cancelled.
@0:113[]
Disk Write error: %s.@0:125[]
You've entered bad identificator: %sWarning'@0:110[]
Can't open for read file '%s' @0:108[]
Can't create file '%s'/@0:112[]
Can't open file '%s' for modification;@0:115[]
Not Enough Disk Space. Needed: %ld Available: %ldcThere is a possibility that IDA will run out of disk space.
Needed %ld, Available %d.
Continue ?;@0:116[]
Disk Space is Low !!!
Press F1 for explanations.@0:109[]
Can't close file: %s3@0:111[]
Disk Read error: %s
(file position %lXh),@0:127[]
You've entered an invalid address.,@0:123[]
You've entered invalid segment: %sñFatal Internal Error ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

       This is an internal error.
   Please, inform the author about it.

Look at 'readme' file to find the address.3

















































	@0:128[]@0:106[]
File '%s' not found	@0:107[]	@0:103[]!Please press a key for macro...
Macro definition cancelled.
5@0:119[]
You can't redefine the keys Alt-- and Alt-=!Defining macro for the key '%s'
-@0:120[]
Already recording a macro for '%s'!Macro for '%s' is defined.
<@0:117[]
Not enough memory available to complete operation.	@0:118[]	@0:129[]3@0:122[]
Enter string to search (case-insensitive)aWRAP
How to use the help subsystem ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

You can use the following keys:
  F1            this screen
  @0:720[Shift-F1]      help index
  Tab           next highlighted phrase
  Shift-Tab     prev highlighted phrase
  Enter         follow a link
  Backspace     previous help screen
  F5            zoom help window
  Esc           close help window

  arrows        one step movement
  PgUp          Page Up
  PgDn          Page Down
  Ctrl-PgUp     top of the window
  Ctrl-PgDn     bottom of the window
  Home          start of the line
  End           logical end of the line	@0:101[]9	WRAP
Main Help Screen ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

F1 is context sensitive help. Use it when you want to know
more about IDA. If you want to know more about
@0:101[help subsystem], press now Enter.

When you don't know which command to use, try to find out it
through menus. For @0:896[menus], press F10.
When you are in the menu,
F1 will explain what the current command does.
Exception: @0:104[keyboard macros] are not available through menus.

To @0:956[exit] IDA, press @<Quit>.

General Notes ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀

0. With IDA you can achieve 3 goals:
     A. get a compilable source code
     B. learn a programming tricks of an interesting program
     C. patch a file when you have no access to the source code.

 The goal A is the toughest and hardest job to do. Most of the
people try to achive goals B and C.
With IDA you can perform all 3 kinds of the job.

1. IDA is not an automatical analyser of programs. 
Normally it is expected that you and IDA work together.
IDA will hint you of suspicious instructions, unsolved
problems etc. It is your job to inform IDA how to proceed.

2. If your goal is to get a fully compilable source code
of the file (goal A) then don't forget:
    - to use correct @0:866[segment register values]
    - to get rid of @0:945[unexplored bytes]
    - to get rid of @0:909[void] marks @0:926[converting]
      their operands to numbers or offsets.

3. There is no documentation on IDA. I think that built-in
help is sufficient in the most of cases. So, use frequently
help system and you will learn IDA quickly.

3. Keep in mind that usually it is enough to learn a program
and patch it (if you are authorized to do so).
IDA does these jobs perfectly.

   Have fun !

You can move around using:

        arrows          one step movement
        PgUp            Page Up
        PgDn            Page Down
        Ctrl-Left       word left
        Ctrl-Right      word right
        Ctrl-PgUp       top of the file
        Ctrl-PgDn       bottom of the file
        Ctrl-Home       top of the window
        Ctrl-End        bottom of the window
        Home            start of the line
        End             logical end of the line

You can use mouse to move too.

Use Shift-<arrows> or Alt-L to drop @0:105[anchor].
If you have a mouse, you can drop anchor with it too.

Double click of the mouse is equvalent to <Enter> key.
*WRAP
Keyboard Macros ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

You can define as many macros as you want.
They are defined in the same manner as in the Borland IDE:
        - Press Alt--
        - Press <key> - macro name
        - Enter macro body
        - Press Alt-=

All macros are lost when you @0:956[exit] IDA.ZWRAP
Anchor  ▄
 ▀▀▀▀▀▀▀▀

Various IDA commands use an anchor. For example to select a portion
of file to output or to specify a segment to move... you need an anchor.
To drop the anchor, you can use Alt-L command. Or, more convinient way is
Shift-<arrow> combination. You can drop the anchor with the mouse also:
simply click and drag.

To raise (clear) the anchor:
          press Alt-L
       or click the mouse anywhere in the window

After you've dropped the anchor, you can move freely using arrows, etc.
Any command that uses the anchor, raises it.

The anchor is used by certain commands to point the
exact place or area to work with. Below is the list:

        @0:870[Generate ASM file]
        @0:922[Make ASCII string]
        @0:939[Move Segment]

The anchored area is displayed with another color.

When you exit from IDA, anchor value is lost.gWRAP
File Not Found ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

IDA can't find the specified file.
May be you've mistyped it ?`WRAP
File Viewer ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀

Here you can see text file.

You can move around using:

        arrows          one step movement
        PgUp            Page Up
        PgDn            Page Down
        Ctrl-Left       word left
        Ctrl-Right      word right
        Ctrl-PgUp       top of the file
        Ctrl-PgDn       bottom of the file
        Home            start of the line
        End             logical end of the line

You can use mouse to move too.

You can edit small files using @0:963[EditFile]
command.

To close this window, use 'WindowClose' command.
Hot key is @<WindowClose>.WRAP
Cannot Create File ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Probably this file exists and has
read-only attribute.  Try to delete it
or clear this attribute.

Another reason is that you have too few
number in FILES= statement of your
CONFIG.SYS file. IDA requires about 10
file handlers to be free.åWRAP
Can't close file ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Probably this happens due to IDA internal error.
Could you inform the author about this ?WRAP
Can't Open File ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Probably the file doesn't exist.  Or,
may be it resides at the other place ?

Another reason is that you have too few
number in FILES= statement of your
CONFIG.SYS file. IDA requires about 10
file handlers to be free.πWRAP
Disk Read Error ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This error occurs when IDA tries to read past end of file. If it happened
when you try to disassemble a new file, the new file has bad structure.

Probably your disk contains unmarked BAD
SECTORS. This is very dangerous.  I
recommend you to re-format your disk or
to mark somehow these sectors.

Now I cannot guarantee that IDA
database is in a good shape. If it is
not a big job, the best solution is to
start disassembling from a scratch.DWRAP
Can't Open File ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Probably the file doesn't exist or has
read-only attribute set.  Or, may be it
resides at the other place ?

Another reason is that you have too few
number in FILES= statement of your
CONFIG.SYS file. IDA requires about 10
file handlers to be free.

May be, memory is not enough ?!hWRAP
Disk Write Error ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Probably your disk contains unmarked BAD
SECTORS. This is very dangerous.  I
recommend you to re-format your disk or
to mark somehow these sectors.

Another reason is that your DISK IS
FULL.  Try to delete some unnessesary
files. It is a good style to have at
least 1MB of free disk space when you
work with IDA.

As you analyse the program, the IDA
database grows. You can compress the
file '0.ida' using 'compress' utility.

Now I cannot guarantee that IDA
database is in a good shape. If it is
not a big job, the best solution is to
start disassembling from a scratch.êWRAP
Disk Positioning Error ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Something is wrong, I can't tell you exactly the reason.
May be, disk is full ?WRAP
Not Enough Disk Space ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

IDA requires lot of disk memory to
disassemble files. Try to delete some
unnessesary files.

It is a good style to have at least
3-4MB when you start to disassemble and
1MB of free disk space when you work
with IDA.  Below is very rough formula 
for the disk space:

  SizeOfProgram * 5 + 100K

As you analyse the program, the IDA
database grows. You can compress the
file '0.ida' using 'btc' utility.

You should give more space for IDA to continue its work.┌WRAP
Disk Space is Low ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

VERY DANGEROUS situation!

Normally when you work with IDA you should have at least 1 MB (or more)
of free disk space.
Please @0:956[exit] now and provide more disk space.╒WRAP
Not enough memory available to complete operation. ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Try to close some windows.
If this doesn't help, try to unload TSRs, etc.
Shortly, make more memory.yWRAP
How to move/resize windows ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Keyboard:

Arrows,Home,End,PgUp,PgDn move the window.
All keys with Shift resize the window.
Ctrl key in the combination with other keys
move/resize the window faster.

Mouse:

To move: point to title of the window and drag to the new location.

To resize: point to the right lower corner of the window and drag.óWRAP
Bad Macro ▄
 ▀▀▀▀▀▀▀▀▀▀

You can't redefine the keys Alt-- and Alt-=
because they are used to define other macros.

Please choose another key for the macro.╥WRAP
Already recording a macro for... ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

You can't define 2 macros at the same time.
Please finish definition of the first macro
(press Alt-=) and after define the other one.êWRAP
No Memory ▄
 ▀▀▀▀▀▀▀▀▀▀

There is not enough memory
to initialize IDA.
Please free some memory unloading TSRs,device drivers, etc.╒WRAP
Entering String for Search ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

You can enter any string to search.

Search will be case-insensitive
Search direction: forward

If the substring is not found,
cursor will not move.αWRAP
How to Enter a Segment Value ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

You must enter segment in hexadecimal format or segment name.  If you
enter invalid segment, IDA will warn you.

You may enter a segment register name too.µWRAP
How to Enter a Number ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

You can enter any 'C' expression with constants. Long arithmetic will
be used for calculations.

In these expressions you can use all names which you created in your
program.
πWRAP
How to Enter an Identifier ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

An identifier is a name which starts with a letter and contains
only letters and digits. Characters _$?@
considered as letters. All names are case-sensitive.

Maximal length of a name is specified in the @0:725[configuration]
file:

        MAX_NAME_LENGTH=120     // Maximal length of new names

Default is 120.

Some assemblers have lower name length limit, beware!

If you enter an illegal name, IDA will warn you.
RWRAP
How to use The Notepad ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 You can use the following keys in the notepad:

 Ctrl-Enter     starts new line
 Enter          finishes the input
 Esc            cancels the input
 F1             gives some help

                                        Shift-<arrow>  Select
 Ctrl-L         Search Again            Shift-Ins       Paste
 Ctrl-O         Indent Mode             Shift-Del       Cut
 Ctrl-T         Delete Word             Ctrl-Ins        Copy
 Ctrl-U         Undo                    Ctrl-Del        Clear
 Ctrl-Y         Delete Line             Ctrl-K B        Start Select
 Ctrl-Left      Word Left               Ctrl-K H        Hide Select
 Ctrl-Right     Word Right              
 Ctrl-PgUp      Text Start              Ctrl-Q A        Replace
 Ctrl-PgDn      Text End                Ctrl-Q F        Find
                                        Ctrl-Q H        Delete Line Start
                                        Ctrl-Q Y        Delete Line End
 
Input containing only whitespaces is equal to an empty input. 

Don't forget that you can use the clipboard.╡WRAP
How to Enter an Address ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

You must enter address in the hexadecimal format or a location name.  When
you enter address in the hexadecimal format, you can omit the segment
part of the address - the current segment will be used. If you enter an
invalid address, IDA will warn you.  Addresses beyond the program
limits are invalid.

Special addresses:
        $ - current location

Examples:
        456             current segment, offset 0x456
        5E              current segment, offset 0x5E
        3000:34         segment 0x3000,  offset 0x34
        ds:67           segment pointed by ds, offset 0x67
        start           a location with name 'start'═WRAP
Messages Window  ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

In this window you see various IDA messages. You can use arrow keys,
their combinations with Ctrl key, PgUp,PgDn keys to walk through this
window. IDA will keep the most recent messages only.

You can't close this window.

        arrows    - one step movements
        PgUp      - Page Up
        PgDn      - Page Down
        Ctrl-PgUp - top (the most ancient message)
        Ctrl-PgDn - bottom (the last message)îWRAP
How To Use List Viewer ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

1. You can use all movement keys: PgUp,PgDn,Home,End and arrows.

2. You can position to a line simply by typing in the desired line number.

3. You can find a line typing in the beginning of it.

4. ?             search for a substring (case-insensitive)

5. If the list is not in dialog mode you can use the following keys:
   Enter         jump to the selected item in the last IDA View window
   Ctrl-E        edit the current item
   Del           delete the current item
   Ins           insert a new item
   Ctrl-U        refresh information in the window

Esc or Enter closes the window.░@0:731[]
Manual operand

Enter alternate string for the %D operand

  Original operand: %A
  <~O~perand:A:100:40::>

  <~C~heck operand:C>
  <~A~llow not matched operand:C>>

Can't read file '%s'Can't write file '%s'Can't create file '%s'!Save the current window as '%s'?GThe current window '%s' is modified. Do you want to save its contents?BThe current window is modified. Do you want to save its contents?Search failed.Enter file name to save toEReplace a string

<Pattern    :A:79:32::>
<Replace to :A:79:32::>


)Find a string

<Pattern    :A:79:50::>

Replace occurence at (%d,%d)?"Name '%s' at %08lX is deleted...
Unexplored byte Code Data Tail Proc Ret 
Analysed With extra lines Flowed With immediate arg Byte Word Dword Qword Tbyte Ascii Offset 	Segment 
Variable Void Char Number:%d 
Forced_arg1 
Forced_arg2 Referenced 

Comment: %s
Repeatable Comment: %s*@0:85[]
CORE INIT: Unknown file type (%d)=Loading file '%s' into database...
Detected file format: %s
Loading registers...
Creating segments...
5File '%s' is successfully loaded into IDA database.
Stack segment at %04X
9Checking that segments for all addresses are created...
'Creating additional segment for %08lX
"Seaching for the data segment...
1@0:365[]
May be packed file, you decode it firstReading relocation table...
@0:366[]
Bad relocation tableV@0:367[]
Warning: This file has extra information at the end (tail %lXh, loaded %lXh)'@0:368[]
File has overlays. Load them?#Marking typical code sequences...
$@0:371[]
Can't find input file '%s'5@0:372[]
Can't generate this type of executable file%; File Name                       %s%; Format                          %sC; Base Address: %04Xh Range: %04lXh - %04lXh Loaded length: %04lXh; Entry point : %04X:%04lX,@0:373[]
Bad hex input file format, line %d.@0:373[]
Bad hex input file checksum, line %d;Can't read input file, only part of file will be loaded...0Using description file '%s' for module '%s'...
∞@0:402[]
Load EXE file

  File name: %A

  Load as
  <~E~XE file:R>
  <~B~inary file:R>>
  
  <~L~oading segment:N:16:10::> (in paragraphs)
  <Loading  ~o~ffset:N:16:10::> (only for binary)

  <~C~reate segments:C>> (only for binary)

ÿ@0:402[]
Load Binary file

  File name: %A

  <~L~oading segment:N:16:10::> (in paragraphs)
  <Loading  ~o~ffset:N:16:10::>

  <~C~reate segments:C>>

Å@0:402[]
Load File of New Format

  File name: %A

  Load as
  <~N~ew format:R>  %A
  <~E~XE file:R>
  <~B~inary file:R>>
  
  <~L~oading segment:N:16:10::> (in paragraphs)
  <Loading  ~o~ffset:N:16:10::> (only for binary)

  <~D~LL directory:A:64:20::>

  <~C~reate segments:C>    (only for binary)
  <Load ~r~esources:C>
  <Rename DLL en~t~ries:C>
  <~M~anual load:C>
  <~F~ill segment gaps:C>>

├@0:402[]
Load file

  File name: %A

  Load as
  <~D~etected format:R> (%A)
  <~B~inary file:R>>
  
  <Loading ~o~ffset:N:16:10::> (only for binary)

  <~C~reate segments:C>> (only for binary)

6@0:374[]
FLOW: NextHead %08lX of %08lX in data base !0@0:375[]
BIOS comments base is open. Close it ?'@0:376[]
Can't use BIOS comments base.;@0:377[]
BIOS comments internal error: database is corrupt@0:378[]
Input string: %s@0:378[]
Syntax error: '%s'$@0:378[]
Register '%s' is not valid[ **** New Line **** ]Choose line to edit@0:379[]
Choose mark number @0:380[]
Enter mark description @0:381[]
Choose marked location-Can't find offset base (hint: delete offset)'Can't find name (hint: use forced arg)HCan't find alternative string for an operand (hint: delete alt. string)*Can't find comment (hint: delete comment),Can't find references (hint: redo analisys)Indirect execution flowCan't disassemble/Already data or code (hint: make 'unexplored')Execution flows beyond limits!Too many lines (hint: divide it)4@0:85[]
SEGMENT: Can't create 'Segments' structure./@0:383[]
SEGMENT: Can't find file segmentation/%3d. Creating a new segment  (%08lX-%08lX) ...1
     Additional segment      (%08lX-%08lX) ...
*       Undefining bytes (%08lX-%08lX) .../     Request for reanalysing (%08lX-%08lX) ...	 ... OK

 ... FAILED
$Deleting segment (%08lX-%08lX) ...
:@0:384[]
Can't create segment (%08lX-%08lX) selector %04X5    Name    Start     End   Base Align Type Cls  32 ;@0:385[]
Instructions/data can't cross segment boundaries.;@0:386[]
The segment would have bytes with negative offset$@0:85[]
Can't set segreg area start"@0:85[]
Can't set segreg area end[@0:387[]
Addresses (%08lX->%08lX) contain instructions/data.
Do you want to discard them?X@0:388[]
Can't move segment start address (%08lX->%08lX): would overlap another segment-~F~ile'@0:389[]
Fatal: Can't create database.M@0:390[]
Database for file '%s' isn't closed. Do you want IDA to repair it ?@0:391[]
bTree error: %sq@0:401[]
IDA has found old database files for '%s'. Do you want IDA to rename old database files into new names?%Can't rename file '%s' into '%s': %s File '%s' is not IDA database.
Unpacking database '%s'...
Packing database...
0The IDA database is packed with unknown method.:Please use MS DOS version of IDA to unpack this database..Only MS DOS version of IDA can pack database.)Not enough disk space to unpack databaseF@0:392[]
Fatal: Database has obsolete format. Use old version of IDA.c@0:394[]
You database has obsolete format (%d). Now IDA will upgrade it into format %d. Continue ?Q@0:395[]
Fatal: Database format is newer than expected. Use new version of IDA.
;@0:85[]
Lines Array: Attempt to display tail byte at %08lX9@0:85[]
Fatal internal error: Too many lines generated !,Reordering generated names, please wait...
*@0:382[]
Can't rename byte %08lX as '%s'
AddressName
; Title '%s'8; Format                          New Executable Format*; Target operating system         unknown'; Target operating system         OS/2-; Target operating system         MS Windows*; Target operating system         DOS 4.x1; Target operating system         MS Windows 386K; Target operating system         Borland Operating System Services (BOSS)1; Target operating system         unknown (%04X)*; File Load CRC                   0%08lXh,; Program Entry Point   (CS:IP)   %04X:%04X,; Initial Stack Pointer (SS:SP)   %04X:%04X2; Auto Data Segment Index         %04Xh  ( %5u. )2; Initial Local Heap Size         %04Xh  ( %5u. )2; Initial Stack Size              %04Xh  ( %5u. )(; Linker Version                  %d.%d%; Minimum code swap area size     %d(; Expected Windows Version        %d.%d; Program Flags (%04X): Multiple data
 Single data	 No data Global initialization Protected mode Self loading Errors in image Uses windowing API Incompatible with PM Compatible with PM DLL
 Application; Other EXE Flags (%04X): Long file names 2.X protected mode 2.X proportional font+ Fastload area (start: %08lX, size: %08lX)N;----------------------------------------------------------------------------; Segment Number    : %d; Alloc Size        : %04lXh-; Offset in the file: %04lXh  Length: %04lXh; Attributes  (%04X): %s Use32 Allocated Loaded
 Moveable
 Iterated Pure Preloaded
 Readonly
 Executeonly
 Relocations Conforming
 Discardable	 DPL: %d; Resource, type (%04X):,; File offset      : %04lXh  Length: %04lXh; Attributes (%04X):; Resource ID      : %d; Resource ID      : '%s' Cursor Bitmap Icon Menu Dialog box String table Font directory Font component Accelerator table Resource data Cursor directory Icon directory Name table Version info	 Unknown User defined '	 Movable Pure Preloaded%; External Entry #%d into the Module; Attributes (%04X):
 Exported Shared dataseg Ring transactions %d Fixed
 MoveableKI don't know what to do with relocation type OS FIXUP (segment %d,rel #%d)1Unknown relocation type %Xh (segment %d,rel #%d)EUnknown relocation address type %Xh (segment %d,rel #%d,target: %lX)?Target of relocation entry is illegal (segment %d, target %lX)3Bad target of relocation for segment %d (entry %d)@Bad target of relocation for segment %d (segment %d, offset %d)ABad target of relocation for segment %d (module %d, function %d)ABad target of relocation for segment %d (module %d, function %s).Creating imported module '%s', %lXh bytes...
DModule '%s' is found on the disk, applying symbolic entry names...
6File is self loading, relocation table is skipped...
g@0:400[]
Module '%s' is not found (in current and %s directories), imported entries are not commented.(negative value added)Loading resources...
Renaming entry points...
Fixing relocations...
GFile read error %d bytes at %08lX (may be bad NE structure), continue?FNE File Manual Loading

        Segment : %A
        Size    : %N

 <Start ~a~ddress :N:120:12::>
 <~S~elector      :N:120:12::> (0 means that selector
                                  will be chosen by IDA)

 <STOP LOADING ~F~ILE:C>>

  Note that IDA won't warn you if segments overlap!
  (this is a feature, not a bug ;)

%@0:396[]
Unknown LX format level %ldWRAP
Packed Files ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀

Sometimes, executable files are shipped in a packed form.  It means
that to disassemble these files you need to unpack them.  I hope that
you have a good collection of packers/unpackers.
If you don't have them, try to hunt for programs named: UNP, CUP, TSUP or TRON.
And I can't miss the opportunity to mention the very first universal EXE
unpacker - our program UUP. It was the originator of all other
universal unpackers.

IDA says that the file is packed when Relocation Table of exe-file is
empty.kWRAP
Bad Relocation Table ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Relocation table has references beyond program limits.░WRAP
Additional information at the end of file ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

The file being loaded is not completely loaded to memory by the 
operating system. This may be because:
        - the file is overlaid; IDA doesn't know this type of overlays
        - the file has debugging information attached to its end
        - the file has other type of information at the end

Anyway, IDA won't load these bytes.
╞WRAP
Overlaid files ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Some EXE files are built with overlays.
This means that not the whole file is
loaded into the memory at the start of
the program, but only a part of the file. Other
parts are loaded by the program itself
into the dynamic memory or over some
subroutines of the program.  This fact
leads to many difficulties when you
disassemble such program.

For the moment IDA knows about overlays created by Borland C compiler.0WRAP
Error loading overlays ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

  One of the following occured:

        - overlay stub is not found
        - overlay relocation data is incorrect

  i.e. the input file structure is bad. If you are sure that the input
  file structure is ok, please inform the author about it.
îWRAP
Maximal number of segments is reached ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

When IDA tried to delete bytes outside of any segment, the maximal number
of contigious chunks is reached. This is NOT a fatal error.

Some bytes outside of any segment will be present => the output text
won't be correct because of these bytes. But you can delete them in the
output text using a text editor.
ZWRAP
Can't Find Input File ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

IDA've tried to find file with the following extensions:

        .com    .bin    .ov4
        .exe    .ovr    .ov5
        .dll    .ov0    .ov6
        .ovl    .ov1    .ov7
        .drv    .ov2    .ov8
        .sys    .ov3    .nlm

No such files were found.

See also @0:958[IDA usage help]│WRAP
Can't generate executable file ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

IDA produces executable files only for:
  - MS DOS .exe
  - MS DOS .com
  - MS DOS .drv
  - general binarybWRAP
Bad input file format ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 The input file doesn't conform to the following definitions:

Intel Hex Object Format
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
This is the default format.  This format is
line  oriented  and  uses only printable ASCII characters except for
the carriage return/line feed at the end of each line.  Each line in
the file assumes the following format:

 :NNAAAARRHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCTT

Where:

All fields marked 'hex' consist of two  or  four  ASCII  hexadecimal
digits  (0-9,  A-F).  A maximum of 24 data bytes will be represented
on each line.

 :      = Record Start Character
 NN     = Byte Count (hex)
 AAAA   = Address of first byte (hex)
 RR     = Record Type (hex, 00 except for last record which is 01)
 HH     = Data Bytes (hex)
 CC     = Check Sum (hex)
 TT     = Line Terminator (carriage return, line feed)

The last line of the file will be a record conforming to  the  above
format with a byte count of zero (':00000001FF').

The checksum is defined as:

        sum      =  byte_count + address_hi + address_lo +
                        record_type + (sum of all data bytes)
        checksum =  ((-sum) & ffh)

MOS  Technology  Hex Object Format
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
This format is line oriented and
uses  only  printable  ASCII  characters  except  for  the  carriage
return/line  feed  at  the  end of each line.  Each line in the file
assumes the following format:

 ;NNAAAAHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHCCCCTT

Where:

All fields marked 'hex' consist of two  or  four  ASCII  hexadecimal
digits  (0-9,  A-F).  A maximum of 24 data bytes will be represented
on each line.

 ;      = Record Start Character
 NN     = Byte Count (hex)
 AAAA   = Address of first byte (hex)
 HH     = Data Bytes (hex)
 CCCC   = Check Sum (hex)
 TT     = Line Terminator (carriage return, line feed)

The last line of the file will be a record with a byte count of zero
(';00').

The checksum is defined as:

        sum      =  byte_count + address_hi + address_lo +
                        (sum of all data bytes)
        checksum =  (sum & ffffh)
_WRAP
FLOW: Bad Next Flow ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This means that IDA database is corrupt.
Try to re-analyse the program.  (you can
force IDA to re-analyse the program by
changing processor type to the current
processor type).

If you have previously saved your database into a text file,
you can load it. See @0:869[Unload] command for explanations.fWRAP
BIOS Comments Base Open ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Very strange situation. Let IDA correct it.√WRAP
Bad BIOS & DOS Comments Base ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

IDA can't use this base due to:
        - it doesn't exist or
        - it is corrupt

IDA won't generate new automatic
comments on DOS and BIOS interrupts and
port I/O instructions.eWRAP
Internal Error ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Comments database is corrupt. IDA won't
generate comment(s).=WRAP
Bad Syntax for Comments Retrieval ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

The correct syntax is:

  Reg=Number ....

where reg is register name (e.g. AX,BX,CX)
          or Op1 - for first operand
          or Op2 - for second operand
      number is its value (in C-notation)

For example:

  Op1=0x21 AX=0x4C01+WRAP
Choose mark number ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This command allows you to mark a location so that afterwards you can
jump to the marked location immediately. Select any line from the list.
The selected line will be used for mark description.
Afterwards you will be able to jump to the marked location using <Alt-J> key.

You can use <Up>, <Down>, <PgUp>, <PgDn>, <Home>, <End> keys. If you
select the first line of the list, nothing will be selected.

Press <Enter> to select line, <Esc> to cancel.

See also:
 @0:381[How to jump to the marked location]ïWRAP
Enter mark description ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Mark description is any text line. The description is
solely for your information.ÆWRAP
Choose marked location ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This command allows you to jump to the previously marked location.
Select any line. You will jump to the selected location.

You can use <Up>, <Down>, <PgUp>, <PgDn>, <Home>, <End> keys. If you
select the first line of the list, nothing will be selected.

Press <Enter> to select line, <Esc> to cancel.

See also:
 @0:379[How to mark a location]ôWRAP
Can't Rename a Byte ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Probably this name is already used in
the program. Try to use another @0:125[name].

NOTE: IDA doesn't allow to use register names as byte names.

Please note also, that IDA refuses to rename tail bytes (i.e.
the second, third... bytes of instruction/data).

To know where it is used you can
try to jump to it using 
 @0:953[Jump to the Named Location]ⁿWRAP
Can't find file segmentation ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀


The database is empty or corrupt. All information is lost.

If you have previously saved your database into a text file,
you can load it. See @0:869[Unload] command for explanations.EWRAP
Segment Creation Failure ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Reason: Bad value for segment base. If this value
        was specified by you, try an allowed value.
        (segment must fit into program address space)
        You can't specify segment base address higher
        than cursor location address base.

Another reason: The database is corrupt.
                Result of disassembling may be surprising,
                nothing can be guaranteed.

If you have previously saved your database into a text file,
you can load it. See @0:869[Unload] command for explanations.ΣWRAP
Segment Boundaries Fault ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

A attempt to change/add a segment failed.
This happened because a segment can't contain a part of
instruction or data. It can contian only a whole
instruction or data.WRAP
Negative Offsets ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

A segment can't have bytes with negative offset from the segment base.
Example:
        if segment base is 0x3000, this segment can have
        start address above or equal to 0x30000, but it can't
        have start address 0x2FFFF.ΣWRAP
Can't move segment start address ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

IDA can't change the segment start address if some instructions/data would occur outside
of the segment. @0:918[Undefine] this instructions/data first.≤WRAP
Can't move segment start address ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

IDA can't change the segment start address because this segment with the
new start address would overlap another adjacent segment. For example,
the following situation:

  seg_a  starts at 0x0000 ends at 0x1000
  seg_b  starts at 0x1000 ends at 0x2000
  seg_c  starts at 0x2000 ends at 0x3000

If you ask to change seg_c so that it starts at 0x500, you'll see this
error message, because the new seg_c would overlap seg_b.vWRAP
Can't Create Database ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Most probably your disk is full or some
disk I/O error occured.₧WRAP
DataBase isn't closed ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

The database was not closed after last IDA session. Most probably
this happened due to power fault, unexpected reboot of the computer,
generally, any abnormal session termination. Try to repair database.

No guarantee that the repairing will restore the database.

If you have previously saved your database into a text file,
may be the best solution is to load it now.
See @0:869[Unload] command for explanations.

If there is not enough memory, IDA can't repair database automatically.
In this case you should repair it yourself:
        - quit IDA now
        - run 'idacheck program.id0'
        - run IDA again┌WRAP
bTree Error ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀

If memory is low, you may get the error 'no memory for...'.
Try to free some memory and start again.

Other errors should not happen. If you have got another error message,
please inform the author about this error.
Don't forget to keep all IDA files and to describe the events occured
immediately before the error.

If you have previously saved your database into a text file,
you can load it. See @0:869[Unload] command for explanations.
WRAP
Obsolete Database Format ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Please, use old version of IDA. This
version of IDA doesn't support this
format.

If you have previously saved your database into a text file,
now you can load it. See @0:869[Unload] command for explanations.≥WRAP
No User Defined Names Yet ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This command allows you to select a name from USER DEFINED names.
No such names are defined now. To give a name to the location,
use @0:737[Rename] or @0:738[Rename any] commands.╙WRAP
Upgrading IDA database ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

If IDA finds out that your database has old format, it will try to upgrade
the database to new format. 
The upgrade process is fully automatic, no user intervention
is needed. However, after upgrading your database you will not be able to
work with it using old versions of IDA. That is why IDA asks your
confirmation before upgrading the database.

This feature works only for databases from IDA
version 2.05.WRAP
Unexpected Database Format ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Database format is newer than expected.
That is because you use old version of IDA. The only thing you can do
is to get somewhere a new version of IDA (may be from the same source where
you got the database?)╒WRAP
Unknown Linear Executable Header Format ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

IDA handles only LX header format level 0. The file you attempted
to disassemble has newer format and IDA doesn't know it.úWRAP
Unsupported Byte Order ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

IDA doesn't support byte & word orderings other that Intel order:
        Byte Ordering: Little Endian Byte Ordering
        Word Ordering: Little Endian Word Ordering

Sorry.

If you send me a file with another format, I'll try to make a new version
of IDA which supports the new format.
-------------------------------------------------------------------------░WRAP
Zero length segments ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

A segment in IDA can't have length equal to zero.
-------------------------------------------------------------------------CWRAP
Relocating objects ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Some other object has been loaded at the specified address, so IDA will try to
relocate the current object to another address. If the object hasn't internal
fixup records, the result may be incorrect.
-------------------------------------------------------------------------┬WRAP
Imported module is not found ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

  IDA didn't find the specified module in:
    - the current directory
    - the operating system directory (see switch @0:958[-W])
        (for MS Windows - c:\windows)

Entries imported by ordinal will not be commented. If IDA finds a module,
all imported by ordinal entries are commented like this:

  KERNEL_91:                    
                retf            ; INITTASK
                                  ^^^^^^^^^
                                  comment

This comment will be propagated (@0:736[repeated]) to all
locations which call this
entry:

                call    far ptr KERNEL_91 ; INITTASK


IDA searches all files named "modulename.*" for the module.
If you know that the imported module resides in another directory,
copy it the your current directory. And if the module file name is different
from "modulename.*",
rename it. After the database is loaded, you can
delete the copied module.

Also IDA looks for file "modulename.ids"
  in the current directory
  in the directory where IDA.EXE resides
  in the PATHed directories

You can yourself create such file. For an example look at DOSCALLS.IDS
in the IDA.EXE directory.
`WRAP
Renaming old database files ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

IDA has found its old database in the current directory. It asks your
permission to rename them so that IDA can use the old database.

Starting from version 3.01 IDA can disassemble several files in one directory.
In order to allow this the names of the IDA database files are changed.⌡WRAP
Load file dialog ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Below is description of dialog box fields:

 Load address - paragraph to load the file
 Load offset  - meaningful only for binary files.
                specifies offset of the first byte from the start of
                the first segment. For example, if load offset=0x2700 and
                load address=0x1000, the first byte of the file will
                be at 1000:2700.
 DLL directory - path where IDA will look up referenced DLL files.
                Note that if IDA finds .IDS file, it doesn't look for
                .DLL file.
 Create segments        - meaningful for binary files.
                          If not checked, IDA doesn't create segments.
 Load resources         - if not checked, IDA doesn't load resources from
                          NE file.
 Rename DLL entries     - If not checked, IDA makes repeatable comments
                          for entries imported by ordinal.
 Manual load            - meaningful only for NE,LE,LX files.
                          If checked, IDA will ask loading addresses
                          and selectors for each object of the file.
                          For experienced users only!
 Fill segment gaps      - meaningful only for NE files.
                          If checked, IDA will fill gaps between
                          segments, creating one big chunk.
                          Use it if loading a new file you
                          get a message "Maximum number of chunks reached"/@0:397[]
IDA supports Intel byte ordering only
; Title '%s'@; Format                          Linear Executable Format (LX)@; Format                          Linear Executable Format (LE)*; Target operating system         unknown'; Target operating system         OS/2-; Target operating system         MS Windows*; Target operating system         DOS 4.x1; Target operating system         MS Windows 386K; Target operating system         Borland Operating System Services (BOSS)1; Target operating system         unknown (%04X)3; Module Version                  %08lXh ( %5lu. )-; Program Entry Point   (CS:EIP)  %lu:%08lXh-; Initial Stack Pointer (SS:ESP)  %lu:%08lXh&; DS Object                       %lu3; Heap Size                       %08lXh ( %5lu. ); Program Flags (%08lXh): Library init Library term No internal fixups No external fixups
 Uses PM API Incompatible with PM Compatible with PM Not loadable
 Application Protected memory library Phys. Dev. Driver Virt. Dev. DriverN;----------------------------------------------------------------------------?@0:398[]
Object %lu has zero length, object length is set to 1^@0:399[]
Object %lu has virtual address %lXh which is already occupied, relocating it to %lXh; Object Number     : %lu.; Virtual Size      : %08lXh0; Number of Pages   : %lu (present in the file); Attributes (%08lX):
 Readable
 Writable Executable
 Resource
 Discardable Shared PreloadPages InvalidPages Resident & Contiguous ZeroFilledPages
 Resident Resident & LongLockable 16:16 Alias Required Privileged Big Conforms CODE; Page              : %lu.!; Page Attributes   : %04X (%s )>; Offset in the file: %08lXh, Size in the file: %04Xh ( %u. )	 Regular
 Iterated	 Invalid
 Zero Filled Range of Pages Iterated 2	 Unknown); External Entry #%lu into the Module %s; Attributes: 16-bit entry
 286-gate 32-bit entry forwarder entry
 Exported  Args: %d7Can't forward entry %lu for (module %s, proc off %lXh),Unknown relocation source type %Xh at %08lXWCan't apply 16-bit offset fixup at %08lX, target offset %08lX, truncating to 16-bit...OTarget of relocation entry is illegal (target %lXh,fixup record file off %lXh)<additive relocation: %lXh>g@0:400[]
Module '%s' is not found (in current and %s directories), imported entries are not commented..Creating imported module '%s', %lXh bytes...
DModule '%s' is found on the disk, applying symbolic entry names...
Applying fixup records...
5File read error (may be bad LX structure), continue?/I don't know what to do with pages type %Xh :(9Can't unpack page type ITERATE 2, the input file is bad.åLX/LE File Manual Loading

        Segment : %A
        Size    : %N
        Use32   : %D

 <Start ~a~ddress :N:120:12::>
 <~S~elector      :N:120:12::> (0 means that selector
                                  will be chosen by IDA)
 <Segment ~b~ase  :N:120:12::> (in paragraphs)

 <STOP LOADING ~F~ILE:C>>

  IDA doesn't check values specified by you!
  (this is a feature, not a bug ;)

Loading resource table...
╕?
Mouse pointer shape
Bitmap
Menu template
Dialog template
String tables
Font directory
Font
Accelerator tables
Binary data
Error message tables
Dialog include file name
Key to vkey tables
Key to UGL tables
Glyph to character tables
Screen display information
Function key area short form
Function key area long form
Help table for Cary Help manager
Help subtable for Cary Help manager
DBCS uniq/font driver directory
DBCS uniq/font driver; Resource       ID: %04X; Resource     Type: %04X (%s)>; Resource Location: obj=%d. offset=%08lXh size=%08lXh (%ld.)óIDA - The Interactive Disassembler

Version 3.05 patch level B (%s)

Copyright (c) 1990-96 by Ilfak Guilfanov
E-mail: ig@estar.msk.su Fidonet: 2:5020/209
!! Can't find IDA.KEY file !!.@0:369[]
Fatal error during loading overlays.2; Overlays: base=%08lX, size=%08lX, EXEinfo=%08lX_<EXTRA BYTE>
(the segment was empty)
IDA doesn't allow empty segments
so this byte appeared...Overlay manager interruptRuntime memory swap addressOffset in the file to the code
Code sizeRelocation area sizeNumber of overlay entriesFDeleting bytes at %08lX..%08lX (they don't belong to any segment)...
R@0:370[]
Maximal number of segments is reached, some bytes are without a segment.)Overlay stub at %08lX, code at %08lX...

; Title '%s':; Format                          Netware Loadable Module; Original File        : '%s' ; Program Flags        : %08lXh-; Custom data          : off=%08lX len=%08lX; Autoload libraries   :'; Virtual Init Address : %08lX (start)); Virtual Term Address : %08lX (end_nlm)); Virtual Aux? Address : %08lX (aux_nlm)B; SEGMENT DATA         : offset in the file: %08lX, length: %08lX6File read error (may be bad NLM structure), continue?"Creating imported names (%ld)...
"Applying exported names (%ld)...
 Applying public names (%ld)...
*Applying internal fixup records (%ld)...
Z!! BEWARE !!
COFF format is not supported fully yet.
(relocation table is not analysed)7File read error (may be bad COFF structure), continue?`@0:399[]
Section '%s' has virtual address %lXh which is already occupied, relocating it to %lXh0210 Motorola 68000 w/o TV
0211 Motorola 68000 with TV
0222 TMS320C5
0401 pdp11 UNIX-rt ldp
0405 pdp11 overlay
0407 pdp11/pre System V vax executable
0410 pdp11/pre System V vax pure executable
0411 pdp11 seperate I&D
0437 pdp11 kernel overlay
0502 Basic-16 w/o TV
0503 Basic-16 with TV
0504 Intel iAPX 16 w/o TV
0505 Intel iAPX 16 with TV
0506 Intel iAPX 20 w/o TV
0507 Intel iAPX 20 with TV
0510 x86 w/o TV
0511 x86 with TV
0512 Intel 286
0514 reserved for Intel (0514)
0515 Intel 860
0516 reserved for Intel (0516)
0517 reserved for Intel (0517)
0520 Motorola 68000 writeable text segments
0521 Motorola 68000 readonly shareable text segments
0522 Motorola 68000 demand paged text segments
0524 reserved for NSC (0524)
0525 reserved for NSC (0525)
0530 IBM 370 writeble text segments
0531 Amdahl 470/580 writable text segments
0532 reserved for u370 (0532)
0533 reserved for u370 (0533)
0534 Amdahl 470/580 readonly sharable text segments
0535 IBM 370 readonly sharable text segments
0540 xl
0544 reserved for Zilog (0544)
0545 reserved for Zilog (0545)
0550 3B20 executable, no TV
0551 3B20 executable with TV
0560 WE 32000, no TV
0561 WE 32000 with TV
0562 reserved for WE 32000
0570 VAX 11/780 and VAX 11/750 writeable text segments
0575 VAX 11/780 and VAX 11/750 readonly sharable text segments
0630 IBM RT writeable text segments
0635 IBM RT readonly sharable text segments
0637 IBM RT readonly text segments and TOC
0730 IBM R2 writeable text segments
0735 IBM R2 readonly sharable text segments
0737 IBM R2 readonly text segments and TOC│; Machine (0%o): %s
; Number of sections      : %d
; Time & date stamp       : %s
; File pointer to symtab  : %08lX
; Number of symtab entries: %ld
; Sizeof(optional hdr)    : %d; Flags %04X:c0x0001 Relocation info stripped
0x0002 Executable
0x0004 Line numbers stripped
0x0008 Local symbols stripped
0x0010 Minimal obj file
0x0020 Fully bound update file
0x0040 Bytes swapped
0x0080 16-bit, LSB first (PDP 11/70)
0x0100 32-bit, LSB first (Intel)
0x0200 32-bit, MSB first (Motorola)
0x1000 Dynamically loadable and executable
0x2000 Shared objectContains "patch" list%No decision funcs for replaced funcs]0410 RO text segment, data segment follows
0407 text and data squashed together
0370 public library created by ldp
0371 data library created by ldp
0401 ldp created kernel process
0402 ldp created supervisor process
0403 ldp created user process
0400 sgen created boot process
0413 segments are aligned and can be paged
any  Unknown execution magic; AOUT Header: (this info is not used by IDA)
; Exec flags 0%o: %s
;       Version stamp: %d
;       .text size   : %08lX (%ld)
;       .data size   : %08lX (%ld)
;       .bss  size   : %08lX (%ld)
;       entry point  : %08lX
;       .text base   : %08lX
;       .data base   : %08lX
╛; *** Section %8.8s
;              physical address              : %08lX
;              virtual address               : %08lX
;              section size                  : %08lX (%ld)
;              offset to raw data for section: %08lX
;              offset to relocation          : %08lX
;              offset to line numbers        : %08lX
;              number of relocation entries  : %ld
;              number of line number entries : %ld; Flags %08lX:≤0x0000 Regular section: allocated, relocated, loaded
0x0001 Dummy section: not allocated, relocated, not loaded
0x0002 Noload section: allocated, relocated, not loaded
0x0004 Grouped section: formed of input sections
0x0008 Padding section: not allocated, not relocated, loaded
0x0010 Copy section: not allocated, not relocated, loaded; reloc & lineno entries processed normally
0x0020 Text only
0x0040 Data only
0x0080 Bss only
0x0100 Exception section
0x0200 Comment section: not allocated, not relocated, not loaded
0x0400 Overlay section: not allocated, relocated, not loaded
0x0800 .Lib section: not allocated, not relocated, not loaded
0x1000 Loader section
0x2000 Debug section
0x4000 Type check section
0x8000 RLD and line number overflow section'Not enough disk space to pack database·1  function argument
2  character
3  short integer
4  integer
5  long integer
6  floating point
7  double word
8  structure
9  union
10 enumeration
11 member of enumeration
12 unsigned character
13 unsigned short
14 unsigned integer
15 unsigned long¬@0:967[]
Text representation
 ┌<Line ~p~refixes:C>> ┌───────────────────────────────┐
┌┴──────┐ ┌──────────┴─┐  <~B~inary line prefix bytes :D:2:2::>
1000:0FE4               ;--------------------------- \<─┐
1000:0FE4                                          \<──┐│ 
1000:0FE4               loc_0_FE4:                    ││
1000:0FE4 90                         nop     ; ...... ││
└┬─┘                                 │       ; \<void\> ││ <Mar~g~in:D:3:3::>
 │  <~U~se segment names:C>           │       │ └┬───┘ ││ (length of
 └──<~S~egment addresses:C>>           │       │  │     ││ arguments of
<I~n~structions indention :D:3:3::> ─────┘       │  │     ││ data directives)
<Co~m~ments indention     :D:3:3::> ─────────────┘  │     ││
<Display '~v~oid' marks:C>     ──────────────────┘     ││
<Display ~r~epeatable comments:C>                      ││
<Display ~a~uto comments      :C>                      ││
<Display ~e~mpty lines:C>      ────────────────────────┘│
<Display b~o~rders between data/code:C>  ───────────────┘
<Display bad ~i~nstructions <BAD> marks:C> <void's ~l~ow  limit:N:10:7:@0:983[]>
<Use ~t~abulations in output:C>>            <void's ~h~igh limit:N:10:7:@0:983[]>

╕@0:965[]
Cross-references representation

<Display xref ~t~ype mark:C>> ────────────────────┐
                                               ┌┴──┐
1000:0FE4 90                         nop     ; CREF: 1000:0FE0       |
                                               │     └┬─┘    │       │
                                               └───┬──┼──────┘       │
<Display ~c~ross references:C> ─────────────────────┘  │              │
<Display se~g~ments in xrefs:C>>────────────────────────┘              │
                                                                     │
<Right ~m~argin            :D:3:4::> (max length of line with xrefs) ───┘
<Cross references' ~d~epth :N:5:5:@0:984[]>

b@0:966[]
Assembler directives
    Generate
  <~A~SSUME directives:C>
  <.~O~RG   directives:C>>

V@0:924[]
Background analysis

   <~A~nalysis enabled:C>
   <~I~ndicator enabled:C>>

∞@0:961[]
Names

Dummy names representation:
<loc_0_1234    :R> segbase relative to prog base & offset from segbase
<loc_1000_1234 :R> segment base address & offset from the segment base
<loc_dseg_1234 :R> (*) segment name & offset from the segment base
<loc_0_11234   :R> segment relative to base address & full address
<loc_1000_11234:R> segment base address & full address
<loc_dseg_11234:R> segment name & full address
<loc_12        :R> full address (no leading zeroes)
<loc_0012      :R> full address (at least 4 digits)
<loc_00000012  :R> full address (at least 8 digits)
<dseg_1234     :R> the same as (*) without data type specifier
<loc_1         :R>> enumerated names (1,2,3...) <~R~enumber:C>>

<~M~aximal length of new names:D:3:4::>

,@0:985[]
ASCII string options

 <~C~-style strings     :R>    <~g~enerate names:C>>
 <~P~ascal style strings:R>>     │   <names pre~f~ix  :A:15:15::>
                               │   <generate ~s~erial names:C>>
                               │   │    <serial ~n~umber :D:6:6::>
                               └───┴────<serial ~w~idth  :D:2:3::>

 <ASCII string ~b~reak char :N:4:4::> (terminates ASCII string)
                                    ('\\0' and '$' are handled internally)
 <ASCII next ~l~ine char    :N:4:4::> (forces start of next line)

@0:745[]
Enter a file nameSearch direction: up
Search direction: down
â@0:746[]
Evaluate expression

  <Expression :A:250:50::>

%A  Hex      : %N %A
  Decimal  : %D
  Binary   : %A
  Character: '%A'

A@0:746[]
Evaluate expression

  <Expression :A:250:50::>

  %A

%s = %ld. %lXh %s %sb '%c'
OnOffDefault DS register: %04X
Ü@0:797[]
Delete Segment

CAUTION: ALL INFORMATION ABOUT THE SEGMENT WILL BE LOST!
Segment %A (%N-%N)

<~C~ONFIRM DELETION:C>>

<~D~isable addresses:C>>

4@0:393[]
The program has no user-defined names yet.~N~avigate~E~dit
~W~indows~V~iew
~O~ptions~H~elp~A~nalysis~T~ext~R~egisters~S~egments~E~dit file...~R~esize/move~Z~oom~P~revious~N~ext~C~lose~T~ile
C~a~scade
~J~ump to╪1 %s: No such file
2 %s: Not IDP file
3 %s: Can't load: bad segments
4 %s: No linkage info
5 %s: Bad relocation type
6 %s: Bad imported ordinal
7 %s: Bad relocation atype
8 %s: Invalid DLL data offset
%s: Can't loadCan't initialize IDP module.	@0:958[]@0:958[]
Unknown switch '-%c'0@0:958[]
Do you want to disassemble file '%s' ?$@0:958[]
Select file to disassemble|@0:747[]
Unknown processor type '%s' Please check if IDA.CFG file is correct and the corresponding processor module exists.@0:959[]
Database is empty4@0:960[]
Can't use these switches with the old file#Database for file '%s' is loaded.
6@0:587[]
Can't create segment registers area at %08lXp@0:588[]
Can't assign to Segment Register at %08lX (%s=%04X). Trying to recover (please repeat your command)...Looking for '%s'...
,@0:85[]
Can't create segment register areas@0:742[]
Segment Registers(WRAP
Can't create segment registers area

Happened due to the database. The
database is corrupt.  Try to finish
your work as soon as possible and get
the text source file.

If you have previously saved your database into a text file,
you can load it. See @0:869[Unload] command for explanations.WRAP
Can't assign to Segment Register

The database is corrupt.
Result of disassembling may be surprising,
nothing can be guaranteed.

If you have previously saved your database into a text file,
you can load it. See @0:869[Unload] command for explanations.You are kidding me ! %lx
Good bye...
:@0:85[]
Internal error: Attempt to use UNDEFINED register/@0:85[]
Internal error: output operand type %x-;             External Entry into Subroutine";             S u b r o u t i n e@@0:85[]
Internal error: loading void operand at %08lX, work: %s?@0:85[]
Internal error: saving void operand at %08lX, work: %s-@0:85[]
Internal error (PC_EMU): %s at %08lX=@0:85[]
Internal error (PC_ANA): Illegal addressing at %08lXD@0:85[]
Internal error (PC_ANA): Illegal immediate type %x at %08lX; End of subroutine **********+Loading IDP module %s for processor %s...
.WRAP
Table Driven Assembler (TASM) by Speech Technology Inc.

Z80 mode: Beware! This assembler produces incorrect results for commands like
        RL (IY+-2)

It doesn't recognize
        RST 0
        RST 8

and accepts
        RST 00h
        RST 08h

IDA will substitute them with 'db' directives.⌐WRAP
ASxxxx by Alan R. Baldwin v1.5

Beware! This assembler produces incorrect results for

        SUB ??

  instruction.

IDA will substitute them it 'db' directives.Q@0:794[]
Change segment attributes

                                 Combination:
<Segment ~n~ame    :A:8:12::> <P~r~ivate:R>
<Segment ~c~lass   :A:8:12::> <~P~ublic:R>
<~S~tart address   :N:120:12::><C~o~mmon:R>
<~E~nd   address   :N:120:12::><S~t~ack:R>>

<~1~6-bit segment:R>              Alignment:
<~3~2-bit segment:R>>             <~A~bsolute:R>
                                  <~B~yte:R>
<~M~ove adjacent segments:C>      <~W~ord:R>
<~D~isable addresses:C>>          <Paragrap~h~:R>   
                                  <Pa~g~e:R>
                                  <Dword(~4~):R>>


`@0:796[]
You are up to change the segment '%s' bounds (%08lX-%08lX) to (%08lX-%08lX). Continue?ë@0:800[]
The segment '%s' addressing mode will be changed to %d-bit. ALL INFORMATION about instructions/data WILL BE LOST! Are you sure?C@0:793[]
Segment end address is invalid or less than start addressI@0:793[]
Bad segment base: segment would have bytes with negative offset'@0:793[]
Invalid segment start addressL@0:793[]
Create a new segment

 Start address and end address should be valid.
         End address > Start address

<~S~tart address   :N:120:12::> C-notation:
<~E~nd   address   :N:120:12::>   hex is 0x...
<~B~ase            :N:120:12::> in paragraphs
<~C~lass           :A:9 :12::> (class is any text)

<~3~2-bit segment  :C>>

@0:743[]
Program Segmentation
~S~earch for@0:798[]
Choose segment@0:732[]
Enter line~O~pen window~L~oad file...IDC ~c~ommand...~I~DC file...~P~roduce output fileProduce ~M~AP file...Produce ~A~SM file...Produce ~L~ST file...Produce ~E~XE file...~U~nload database...~R~epaint desktopAbo~u~t...~A~bort - don't save changes~Q~uit - save changes~A~sk for address...Choose from ~l~ist of names...Ask for ~s~egment...!Choose from list of se~g~regs...~N~ext problemMarked ~p~osition...Jump immediate	~R~eturn~U~ndo last return~E~mpty stackSearch ~d~irectionMark ~p~osition...next '~v~oid'next ~c~odenext ~d~atanext p~r~ocnext ~u~nexplorednext ~e~xplored~i~mmediate...next i~m~mediate
~t~ext...next te~x~ttext in c~o~re...next text in co~r~e~J~ump table...Add xref...Del xref...~C~ode~D~ata(byte,word...)~A~SCIIArra~y~...~U~ndefineRe~n~ame...~P~atch program	Comments~O~perand types~T~ext representation...~C~ross references...Assembler d~i~rectives...ASCII strings ~s~tyle...~N~ames representation...~D~ump/normal view ~P~rocessor type...Target ~a~ssembler...~B~ackground analysis...(Re)name an~y~ address...Set '~p~roc' near/far/noneSet '~e~ndp' / none Enter ~1~st operand manually... Enter ~2~nd operand manually...Drop/Raise ~a~nchorEnter comment...Enter ~r~epeatable comment...!Retrieve ~p~redefined comment...+Edit extra lines (~b~efore gen-d lines)...+Edit extra lines (~a~fter  gen-d lines)...(Delete last e~x~tra line (before lines)(Delete last ex~t~ra line (after  lines)	~B~inaryOcta~l~
~D~ecimalCha~r~acter~H~exadecimal~V~ariable
~S~egment~O~ffset by data segment/NoOffset by ~c~urrent segment
~A~ny offset~N~ew segment...~D~elete segment...~E~dit segment...~M~ove current segment Change segment ~t~ranslation...(Set ~d~efault segment register value...#Change se~g~ment register value...~S~how general registers ~O~pen segment registers windowChange ~b~yte...Change ~w~ord...
~F~ile...~C~alculate...C~u~rrent segment registers Open segment ~r~egisters windowOpen ~s~egments windowOpen ~n~ames window~I~nternal flags No hot key is defined for '%s'!Target Assembler: %s
Current Processor: %s
@@0:832[]
Enter segment translation list (list of segment names)Segment translation list: %s
▒Help Index ▄
 ▀▀▀▀▀▀▀▀▀▀▀

  @0:722[Main Idea]
  @0:723[Russian: Äß¡«ó¡á∩ ¿ñÑ∩]

Basics

  @0:725[Configuration file]
  @0:104[Keyboard Macros]
  @0:746[Calculator]
  @0:836[Segment Register Change Points]
  @0:838[Problems List]
  @0:105[Anchor]
  @0:724[Background Analysis]
  @0:958[IDA command line switches]
  @0:721[Menu system]

Windows

  @0:103[Main IDA window]
  @0:128[Messages window]
  @0:107[File viewer]

How to...

  @0:129[How To Use List Viewer]
  @0:126[How to use the Notepad]
  @0:125[How to Enter an Identifier]
  @0:123[How to Enter a Segment Value]
  @0:127[How to Enter an Address]
  @0:124[How to Enter a Number]

@0:878[IDC language]
  @0:879[Expressions]
  @0:880[Statements]
  @0:882[Variables]
  @0:881[Functions]
    @0:883[Built-in functions:]
      @0:884[A. Utility functions]
      @0:885[B. Functions that change program representation]
      @0:886[C. Functions that produce output files]
      @0:887[D. Informational functions]
      @0:888[E. Functions that change global settings]
      @0:889[F. Functions that interact with the user]
      @0:890[G. Functions that work with segments]
        @0:891[Segment alignments]
        @0:892[Segment combinations]

@0:896[Main Menu Bar]
  @0:895[File]
    @0:898[Open window]
    @0:897[Load file]
    @0:873[IDA command]
    @0:954[Produce output file]
      @0:868[Generate MAP file]
      @0:870[Generate ASM file]
      @0:871[Generate LST file]
      @0:872[Generate EXE file]
      @0:869[Unload database]
    @0:955[Repaint desktop]
    @0:957[Abort]
    @0:956[Quit]
  @0:945[Edit]
    @0:920[instruction]
    @0:921[data]
    @0:922[ascii]
    @0:728[array]
    @0:918[undefine]
    @0:863[jump table...]
    @0:865[Links]
    @0:737[Rename]
    @0:925[Comments]
      @0:735[Regular comments]
      @0:736[Repeatable comments]
      @0:929[Predefined comments]
      @0:732[Additional comment lines]
    @0:926[Operand types]
      @0:930[Convert to decimal number]
      @0:933[Convert to character]
      @0:934[Convert to hex number]
      @0:936[Convert to segment]
      @0:937[Convert to offset (DS)]
      @0:938[Convert to offset (CS)]
      @0:729[Convert to offset (any)]
      @0:935[Mark as variable]
    @0:949[Text]
      @0:738[Rename any address]
      @0:927[Make procedure]
      @0:928[Make end of procedure]
      @0:731[User-defined operand]
    @0:950[Registers]
      @0:867[Set default segment register value]
      @0:866[Change segment register value]
      @0:940[Show general register]
      @0:742[Open segment registers window]
    @0:951[Segments]
      @0:793[How to create a new segment]
      @0:795[How to delete a segment]
      @0:794[How to change segment attributes]
      @0:939[How to move a segment start]
      @0:832[How to change segment translation]
    @0:952[Patch core]
      @0:875[Patch core]
      @0:872[Produce EXE file]
    @0:963[Edit file]
  @0:944[Navigate]
    @0:905[Jump to...]
      @0:834[Jump to the Specified Address]
      @0:953[Jump to the Named Location]
      @0:833[Jump to the Specified Segment Start]
      @0:899[Jump to the Previously Marked Position]
      @0:835[Jump to the Specified Segment Register Change Point]
      @0:837[Jump to the Next Address from the Problems List]
      @0:908[How to Mark a Location]
    @0:906[Search for...]
      @0:741[substring in the text representation]
      @0:739[substring in the binary image of the file]
      @0:913[unexplored bytes]
      @0:914[explored bytes]
      @0:910[instruction bytes]
      @0:911[data bytes]
      @0:740[immediate operand values]
      @0:909[void operands]
      @0:912[start of procedures]
    @0:901[Jump]
    @0:902[Return]
    @0:903[Undo Return]
    @0:904[Empty stack]
  @0:947[View]
    @0:745[View File]
    @0:746[Calculator]
    @0:940[View general registers]
    @0:742[Open segment registers window]
    @0:743[Open segments window]
    @0:744[Open names window]
    @0:943[View internal flags]
  @0:948[Options]
    @0:967[Text representation...]
    @0:965[Cross references representation...]
    @0:966[Assembler directives...]
    @0:961[Names representation...]
    @0:942[Dump/Normal View]
    @0:747[Processor type...]
    @0:923[Target assembler...]
    @0:924[Auto analysis...]
    @0:907[Search direction]
  @0:946[Windows]/WRAP
Main Idea ▄
 ▀▀▀▀▀▀▀▀▀▀

Russian: ìáª¼¿ΓÑ @0:723[Enter] ñ½∩ »«½πτÑ¡¿∩ »«¼«Θ¿ ¡á απßß¬«¼ ∩ºδ¬Ñ.

▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
 1. IDA is not an automatic analyser of programs.
Normally it is expected that you and IDA work together.
IDA will hint you of suspicious instructions, unsolved
problems etc. It is your job to inform IDA how to proceed.

 2. There is no documentation on IDA. I think that built-in
@0:101[help] is sufficient in the most of cases. So, use frequently
help system and you will learn IDA quickly.

 3. If you started IDA the very first time, there are commands
you will find useful:
  - convert to @0:920[instruction] : the hotkey is @<MakeCode>
  - convert to @0:921[data] : the hotkey is @<MakeData>

 4. All changes made by you are saved to disk. When you start IDA again
all the information about the file being disassembled is read from disk
and  you can continue your work. You can disassemble one file in a directory.

For other commands please refer to the @0:896[menu] system and the help.ZWRAP
Äß¡«ó¡á∩ ¿ñÑ∩ ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 1. IDA ¡Ñ ∩ó½∩ÑΓß∩ áóΓ«¼áΓ¿τÑß¬¿¼ ñ¿ºáßßÑ¼í½Ñα«¼ Γ¿»á Sourcer'á.
ÅαÑñ»«½áúáÑΓß∩, τΓ« »«½∞º«óáΓÑ½∞ ¿ »α«úαá¼¼á αáí«ΓáεΓ ó¼ÑßΓÑ, ó¿ñ«¿º¼Ñ¡∩∩
ñ¿ºáßßÑ¼í½¿απÑ¼πε »α«úαá¼¼π. IDA íπñÑΓ »αÑñπ»αÑªñáΓ∞ óáß « ¡Ñπñáτ¡δσ »«»δΓ¬áσ
ñ¿ºáßßÑ¼í½¿α«óá¡¿∩, ºá¼ÑτÑ¡¡δσ ßΓαá¡¡«ßΓ∩σ ¿ Γ.ñ. éáΦá ºáñáτá - »«ñß¬áºáΓ∞ »α«úαá¼¼Ñ,
¡Ñ«íσ«ñ¿¼δÑ ñÑ⌐ßΓó¿∩,
¬«úñá «¡á ¡Ñ ¼«ªÑΓ áóΓ«¼áΓ¿τÑß¬¿ ñ¿ºáßßÑ¼í½¿α«óáΓ∞.

 2. ä«¬π¼Ñ¡Γáµ¿¿ »« IDA ¡ÑΓ. ƒ ¡áñÑεß∞ τΓ« óßΓα«Ñ¡¡«⌐ ß¿ßΓÑ¼δ
@0:101[»«¼«Θ¿] íπñÑΓ ñ«ßΓáΓ«τ¡«. Æá¬ τΓ« »«τáΘÑ ¡áª¿¼á⌐ΓÑ ¡á F1 ¿ óδ íδßΓα«
¡áπτ¿ΓÑß∞ »«½∞º«óáΓ∞ß∩ IDA. éß∩ »«¼«Θ∞ ¡á á¡ú½¿⌐ß¬«¼ ∩ºδ¬Ñ.

 3. àß½¿ óδ ºá»πßΓ¿½¿ IDA ó »Ñαóδ⌐ αáº, ºá»«¼¡¿ΓÑ ß½ÑñπεΘ¿Ñ ¬«¼á¡ñδ:
  - »αÑóαáΓ¿Γ∞ ó @0:920[¿¡ßΓαπ¬µ¿ε] : ¬½áó¿Φá @<MakeCode>
  - »αÑóαáΓ¿Γ∞ ó @0:921[ñá¡¡δÑ] : ¬½áó¿Φá @<MakeData>

 4. éßÑ ¿º¼Ñ¡Ñ¡¿∩, ó¡ÑßÑ¡¡δÑ óá¼¿, ºá»«¼¿¡áεΓß∩ ¡á ñ¿ß¬Ñ.
Åα¿ ß½ÑñπεΘÑ¼ ºá»πß¬Ñ IDA φΓ¿ ñá¡¡δÑ ßτ¿ΓδóáεΓß∩ ß ñ¿ß¬á ¿ óδ ¼«ªÑΓÑ
»α«ñ«½ª¿Γ∞ αáí«Γπ ß Σá⌐½«¼. é «ñ¡«⌐ ñ¿αÑ¬Γ«α¿¿ ¼«ª¡« ñ¿ºáßßÑ¼í½¿α«óáΓ∞
«ñ¿¡ Σá⌐½.

ä½∩ »«½πτÑ¡¿∩ ¿¡Σ«α¼áµ¿¿ »« ñαπú¿¼ ¬«¼á¡ñá¼ «íαáΘá⌐ΓÑß∞ ¬ ß¿ßΓÑ¼Ñ
@0:896[¼Ñ¡ε] ¿ »«½∞ºπ⌐ΓÑß∞ ¬½áó¿ΦÑ⌐ F1.âWRAP
Background Analysis ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

IDA can analyse the program when it is not occupied performing
an action asked by you. Thus IDA and you disassemble the program
together, but your requests have priority.

The state of background analysis is shown on the right upper corner
of the screen. See @0:941[details] of this indicator for
further explanations.

You can @0:924[disable] autoanalysis, but in this case
some functions of IDA will produce strange results (e.g. if you try to
convert data to instructions, IDA will NOT trace all threads of
control flow and the data will be converted to instructions only on
the screen...)"WRAP
Configuration file ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Configuration file 'ida.cfg' is searched in PATH.
If it is not found, IDA uses default values.
In the configuration file you can use C,C++ style comments and include files.
Configuration file syntax is:

        KeyWord = Value
        "ActionName" = Value

  where value may be:

        a string:       "Ctrl-F5"
        a char:         'F'
        a scancode:     0x4900
        zero:           0

  Zero scancode disables the hotkey.

Below is the list of allowed keywords:

 ASCII_GENNAMES      ENABLE_ANALYSIS            SHOW_LINEPREFIXES
 ASCII_LINEBREAK     INDENTION                  SHOW_ORIGINS
 ASCII_LINEEND       MAX_DATALINE_LENGTH        SHOW_REPEATABLE_COMMENTS
 ASCII_PASCAL        MAX_NAMES_LENGTH           SHOW_SEGXREFS
 ASCII_PREFIX        MAX_TAIL                   SHOW_VOIDS
 ASCII_SERIAL        MAX_XREF_LENGTH            SHOW_XREFS
 ASCII_SERNUM        PACK_DATABASE              SWAP_EXPANDED
 ASCII_ZEROES        SHOW_ASSUMES               SWAP_EXTENDED
 AUTOSAVE            SHOW_AUTOCOMMENTS          USE_FPP
 BINARY_PREFIX_SIZE  SHOW_BAD_INSTRUCTIONS      USE_SEGMENT_NAMES
 COMMENTS_INDENTION  SHOW_BORDERS               USE_TABULATION
 DEFAULT_PROCESSOR   SHOW_EMPTYLINES            SHOW_SEGMENTS
 DUMMY_NAMES_TYPE    SHOW_INDICATOR█WRAP
No Segment for the current byte ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Some commands can't be applied to the addresses without a segment.

Create a segment first. You can do this using
@0:793[CreateSegment] command.≡WRAP
Window is in Dumping Mode ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Some commands don't work in the windows in dumping mode.
If you want to apply this command, please turn @0:942[dumping] mode off.
Another way is to @0:898[open] another window.
9WRAP
Array Size ▄
 ▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeArray
 Current hotkey: @<MakeArray>

Enter array size in current array elements (not bytes).
IDA proposes maximal possible array size by default.

You can use this command for ASCII strings also.

See also
 @0:945[Edit] submenu
 @0:124[How to Enter a Number].àWRAP
Immediate Operand -> Offset (specified base) ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeAnyOffset
 Current hotkey: @<MakeAnyOffset>

This command converts immediate operand(s) type of the
current instruction/data to an offset by specified segment base.

See also: @0:937[offset by data segment/no]
          @0:938[offset by current segment]
          @0:926[Edit|Text|Operand types] submenu.

If this command affects boths operands of the instruction, IDA automatically creates a manual
operand for one of the operands so that only one operand will be affected.
See @0:731[Enter #th operand manually] commands.@0:735[]
Enter commentoWRAP
Alternate String For Operand ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: Alter1Operand, Alter2Operand
 Current hotkey: @<Alter1Operand>, @<Alter2Operand>

You may use Alternate String for operand when IDA doesn't represent
operand in the needed form. In this case IDA will simply show the
specified string instead of the operand. No offset references are
generated.

You can use this not only with the code instructions but with data
instructions also.

IDA proposes the previous Alternate String as default.

If you want to delete the Alternate String, specify empty string.

If "Check operand" checkbox is on, IDA will try to check operand and
if the new operand value differs from its original value, will warn
you.

IDA automatically deletes the manually entered operands when you
delete @0:937[offset definition] of operand.

See also @0:949[Edit|Text] submenu.╔WRAP
Extra Lines ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀

 Action         Name             Hotkey
 ------         ----             ------
 add before     MakeExtraLineA   @<MakeExtraLineA>
 add after      MakeExtraLineB   @<MakeExtraLineB>
 del before     DeleteExtraLineA @<DeleteExtraLineA>
 del after      DeleteExtraLineB @<DeleteExtraLineB>

If you want to enter multi-line comments or additional instructions,
you can use this feature of IDA.

There are two kinds of Extra Lines: generated before instruction line
and generated after instruction line.

You can add new lines, edit existing lines and delete the last line.

Don't forget that maximal number of lines for an item is 100.

See also @0:925[Edit|Text|Comments] submenu.AWRAP
Command Type ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀

This command allows you to get predefined comment for the current
instruction. Like:
        ; INT 21,Fn 4C00h - DOS - Quit

Enter an instruction name to get comment about.
For example:
        int
        add
        movzx
        in

See @0:929[Retrieve predefined comment] command.gWRAP
Comment Index for the Command ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

The correct syntax is:

  Reg=Number ....

where reg is register name (e.g. AX,BX,CX)
          or Op1 - for first operand
          or Op2 - for second operand
      number is its value (in C-notation)

For example:

  Op1=0x21 AX=0x4C01

See @0:929[Retrieve predefined comment] command./WRAP
Enter a comment ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeComment
 Current hotkey: @<MakeComment>

This command allows to enter a normal indented comment for
the current item.

See also @0:925[Edit|Text|Comments] submenu
         @0:736[Repeatable comments]
         @0:126[How to use the notepad]╜WRAP
Enter a repeatable comment ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeRptCmt
 Current hotkey: @<MakeRptCmt>

This command allows to enter a repeatable comment for
the current item.

All items that refer to the current item will have this comment by default.
However, you can override this by entering a normal @0:735[comment].

This type of comments may be used to describe subroutines, data items etc.,
because all calls to the subroutine will have the repeatable comment.

You can show and hide repeatable comments using
@0:976[Toggle repeatable comments] command.

See also @0:925[Edit|Text|Comments] submenu
         @0:735[Regular comments]
         @0:126[How to use the notepad]WRAP
Give Name to the Location ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeName
 Current hotkey: @<MakeName>

This command gives name/renames/deletes @0:125[name] for the current
item.

To delete a name, simply give an empty name.

If the current item is referenced, you can't delete its name. Even if you
try, IDA will generate a @0:961[dummy] name.

See also @0:738[Rename any] command.
         @0:949[Edit|Text] submenu.
         @0:125[How to Enter an Identifier].
         @0:961[Names representation].'WRAP
Give Name to the Any Address ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeAnyName
 Current hotkey: @<MakeAnyName>

This command gives name/renames/deletes @0:125[name] for the
specified address.

To delete a name, simply give an empty name.

If the specified address is referenced, you can't delete its name. Even if you
try, IDA will generate a @0:961[dummy] name.

See also @0:737[Rename current address] command.
         @0:949[Edit|Text] submenu.
         @0:125[How to Enter an Identifier].
         @0:961[Names representation].ÿWRAP
Search for substring in the file ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: AskBinaryText
 Current hotkey: @<AskBinaryText>

This command searches for the specified substring in the file being
disassembled. This command can be used for fast lookups of text
strings in the executable file or even to find references to a data.
You can interrupt it pressing Ctrl-Break.

If an area is selected using @0:105[anchor], IDA will search
for the specified substring in the area.

You can:
  - enter sequence of numbers in C notation
  - enter string constants

Example:

  0xCD 0x21    - to search bytes CD 21 (int 21)
  "Hello", 0   - to search string "Hello"

For example, if you want to find a reference to the following string:

 35F2:106A      db 'Hello',0

you could search for the string '0x6A, 16' in the file.

See also @0:741[search for text] command.
         @0:906[Navigate|Search for...] submenu.≥WRAP
Search for next instruction/data with the specified operand ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: AskNextImmediate
 Current hotkey: @<AskNextImmediate>

This command searches for the first instruction or data byte
that contains the specified immediate operand. This command is
relatively slow, because it disassembles each instruction to
find operand values.

See also @0:906[Navigate|Search for...] submenu.
         @0:124[How to Enter a Number].WRAP
Search for substring in the text representation ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: AskNextText
 Current hotkey: @<AskNextText>

This command searches for the specified substring in the text
representation. This command is a slow command, because it
disassembles each instruction to get the text representation.
IDA will show its progress on the @0:941[indicator].
You can interrupt this command pressing Ctrl-Break.

If an area is selected using @0:105[anchor], IDA will search
for the specified substring in the area.

Note that this command searches the same what you see on your
screen (not in binary image !).

For binary search look at
 @0:739[Search for substring in the file]

See also @0:906[Navigate|Search for...] submenu.ΣWRAP
Open Segment Registers Window▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ShowSegmentRegisters
 Current hotkey: @<ShowSegmentRegisters>

This command opens the segment registers window.
The window will contain segment register
@0:836[change points]
list.

You can use @0:129[list viewer] commands in this window.

Depending on the current processor type, you will see
DS,CS,SS with or without FS,GS.

See also @0:950[Edit|Registers] submenu.
         @0:947[View] submenu.⌠WRAP
Open Segments Window▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ShowSegments
 Current hotkey: @<ShowSegments>

This command opens the segments window.

You can use @0:129[list viewer] commands in this window.

See also @0:947[View] submenu.φWRAP
Open Names Window▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ShowNames
 Current hotkey: @<ShowNames>

This command opens the @0:737[names] window.

You can use @0:129[list viewer] commands in this window.

See also @0:947[View] submenu.^WRAP
File Viewer ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ViewFile
 Current hotkey: @<ViewFile>

You can create an additional window to look at the file contents.
Using this command you can look at files of any size.
To close the opened window, press @<WindowClose>.

You can edit small files using @0:963[EditFile]
command.

See also @0:947[View] submenu.JWRAP
Calculator ▄
 ▀▀▀▀▀▀▀▀▀▀▀

 Action    name: Calculate
 Current hotkey: @<Calculate>

A simple calculator is provided. You can enter constant C-style
expressions. Syntax of the expressions is the same is the syntax of
IDC @0:879[expressions].
Result is displayed in the message window in three
forms: hexadecimal,decimal and character.

In these expressions you can use all names which you created in your
program.

Also, IDA tries to extract a name or a number under the cursor and stores
it into input line.

See also @0:947[View] submenu.
         @0:124[How to Enter a Number].╬WRAP
Processor Type ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: SetProcessor
 Current hotkey: @<SetProcessor>

Changing the processor type leads to reanalysis of all program.
Sometimes this is useful.

Valid processor types are:

  8086    - Intel 8086                   ┐
  80286r  - Intel 80286 real mode        │
  80286p  - Intel 80286 protected mode   │
  80386r  - Intel 80386 real mode        │
  80386p  - Intel 80386 protected mode   │  (IBM PC line)
  80486r  - Intel 80486 real mode        │
  80486p  - Intel 80486 protected mode   │
  80586r  - Intel Pentium real mode      │
  80586p  - Intel Pentium protected mode ┘
  8085    - Intel 8085                   ┐
  z80     - Zilog 80                     │ (Zilog 80 line)
  64180   - Hitachi HD64180              ┘
  860xr   - Intel 860 XR                 ┐ (Intel 860 line)
  860xp   - Intel 860 XP                 ┘
  8051    - Intel 8051                     (Intel 51 line)
  m6502   - Motorola 6502                  (Motorola 65xx line)

You can change processor type only within the current line. If you have
selected IBM PC line, you can't select Zilog 80 line
and vice versa.

Please note that when you change the processor type, IDA may change the
@0:923[target assembler], so check it out.

Intel 8051 and Motorola processors are not included in the shareware version.

You may get a message telling that IDA doesn't know the specified
processor if IDA fails to load corresponding processor module.

        16 bit IDA uses .IDP modules
        32 bit IDA uses .D32 modules
        OS/2   IDA uses .DLL modules

IMPORTANT NOTE: If you specify IBM PC protected mode processor
(80x86p), all new
@0:800[segments] will be created in use32 mode!!!

See also @0:948[Options] submenu.,Error occured during opening file '%s' : %sCan't find file '%s''Please enter a number or an expression%svASCII_GENNAMES
ASCII_LINEBREAK
ASCII_LINEEND
ASCII_PASCAL
ASCII_PREFIX
ASCII_SERIAL
ASCII_SERNUM
ASCII_ZEROES
AUTOSAVE
BINARY_PREFIX_SIZE
COMMENTS_INDENTION
DEFAULT_PROCESSOR
DUMMY_NAMES_TYPE
ENABLE_ANALYSIS
INDENTION
LOOKBACK
MAX_NAMES_LENGTH
MAX_TAIL
MAX_XREF_LENGTH
MAX_DATALINE_LENGTH
NO
OFF
ON
OS2DIR
PACK_DATABASE
SCREEN_MODE
SCREEN_PALETTE
SHOW_SEGMENTS
SHOW_ASSUMES
SHOW_AUTOCOMMENTS
SHOW_BAD_INSTRUCTIONS
SHOW_BORDERS
SHOW_EMPTYLINES
SHOW_INDICATOR
SHOW_LINEPREFIXES
SHOW_ORIGINS
SHOW_REPEATABLE_COMMENTS
SHOW_SEGXREFS
SHOW_VOIDS
SHOW_XREFS
SWAP_EXPANDED
SWAP_EXTENDED
USE_FPP
USE_SEGMENT_NAMES
USE_TABULATION
YES
WINDIR
Bad keyboard assignment

Keyboard definition syntax is:

        "ActionName" = Value

  where value may be:

        a string:       "Ctrl-F5"
        a char:         'F'
        a scancode:     0x4900
        zero:           0

  Zero scancode disables the hot key.
D'=' not found

By configuration file syntax here must be '=' sign.
Expected a string valueString is too longExpected a number3The specified value isn't within the allowed range!Expected YES/NO or ON/OFF valuesIllegal action name
ïIllegal key code

You've mistyped key code. Below are some examples:

        "Alt-F1"
        "Shift-F10"
        "Tab"
        "Ctrl-D"

Syntax error

Configuration file syntax is:

        KeyWord = Value

You can use C,C++ style comments and include files.
Below is the list of allowed keywords:

 ASCII_GENNAMES      INDENTION                  SHOW_INDICATOR
 ASCII_LINEBREAK     MAX_DATALINE_LENGTH        SHOW_LINEPREFIXES
 ASCII_LINEEND       MAX_NAMES_LENGTH           SHOW_ORIGINS
 ASCII_PASCAL        MAX_TAIL                   SHOW_REPEATABLE_COMMENTS
 ASCII_PREFIX        MAX_XREF_LENGTH            SHOW_SEGMENTS
 ASCII_SERIAL        PACK_DATABASE              SHOW_SEGXREFS
 ASCII_SERNUM        OS2DIR                     SHOW_VOIDS
 ASCII_ZEROES        SCREEN_MODE                SHOW_XREFS
 AUTOSAVE            SCREEN_PALETTE             SWAP_EXPANDED
 BINARY_PREFIX_SIZE  SHOW_ASSUMES               SWAP_EXTENDED   
 COMMENTS_INDENTION  SHOW_AUTOCOMMENTS          USE_FPP
 DEFAULT_PROCESSOR   SHOW_BAD_INSTRUCTIONS      USE_SEGMENT_NAMES
 DUMMY_NAMES_TYPE    SHOW_BORDERS               USE_TABULATION
 ENABLE_ANALYSIS     SHOW_EMPTYLINES            WINDIRA@0:85[]
GL internal error: item size = 0 at %08lX, Flags = %08lX) .ERROR 'too many lines (more than 100)'/  Knowledge is power.
                F. Bacon(
  Address         Publics by Value
  
(@0:877[]
Can't open for write file '%s';
; ╔═════════════════════════════════════════════════════════════════╗
; ║ This file is generated by Interactive DisAssembler (IDA)        ║
; ║ Copyright (c) 1990-96 by Ilfak Guilfanov. (2:5020/209@fidonet)  ║
; ╚═════════════════════════════════════════════════════════════════╝
;

+//
// ╔═════════════════════════════════════════════════════════════════╗
// ║ This file is generated by Interactive DisAssembler (IDA)        ║
// ║ Copyright (c) 1990-96 by Ilfak Guilfanov. (2:5020/209@fidonet)  ║
// ╚═════════════════════════════════════════════════════════════════╝
//

static main(void) {
        GenInfo();
        Segments();
        Bytes();
        SegRegs();
}

//------------------------------------------------------------------------
// General information

static GenInfo(void) {

        DeleteAll();    // purge database
è}

//------------------------------------------------------------------------
// Information about segmentation

static Segments(void) {
ï}

//------------------------------------------------------------------------
// Information about bytes

static Bytes(void) {
  auto x;

Ä}

//------------------------------------------------------------------------
// Information about segment registers

static SegRegs(void) {
}

// End of file.

// Partial file is produced.
)@0:894[]
Write error, may be disk full ?9Writing assembler file %s,
address range %08lX-%08lX...
7Writing listing file %s,
address range %08lX-%08lX...
*Assembler file created, total %ld lines.
(Listing file created, total %ld lines.
-Unloading information about segmentation...
2Unloading information about instructions/data...
2Unloading information about segment registers...
;Unload information to file '%s' (Ctrl-Break to cancel)...
Unloading completed.
+Output file '%s' already exists, continue?"Flushing buffers, please wait ... Ok
c@0:726[]
This command can't be applied to the addresses without a segment. Create a segment first.Q@0:727[]
This command doesn't work in dump mode windows. Turn dumping off first.	@0:964[]I@0:957[]
You are about to discard all changes and quit to DOS. Continue?û@0:956[]
QUIT IDA

  IDA will save all changes to disk.

  <~D~on't pack database:R>
  <Pack database (~S~tore):R>
  <Pack database (~I~mplode):R>>

WRAP
Create a New Segment ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: CreateSegment
 Current hotkey: @<CreateSegment>

This command allows to create a new segment.

If you select an area using the @0:105[anchor], IDA will propose the start
address and the end address of the selection as defaults for the segment bounds.

If another segment already exists at the specified addresses,
the existing segment is truncated and the new segment lasts from the
specified start address to the next segment
(or specified end address, whatever is lower). An additional segment
may be created to cover the area after end of the new segment.

Please note that segments have so called @0:800[addressing mode].
The addressing mode is effective only for PC processors.

See also @0:951[Edit|Segments] submenu.WRAP
Change Segment Attributes ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
 Action    name: EditSegment
 Current hotkey: @<EditSegment>

This command allows to change segment attributes.
You can change all attributes except the segment base. To change the segment
base you should delete segment and create it again.

      @0:799[How to change segment name]
      @0:801[How to change segment class]
      @0:800[How to change segment addressing mode (16/32)]
      @0:802[How to change segment alignment]
      @0:831[How to change segment combination]

MOVE ADJACENT SEGMENTS: means that previous and next segments will
be shrinked or expanded filling appearing gaps between segments when
you change the current segment.

DISABLE ADDRESSES: when you shrink the segment, completely removes
all information about bytes going out of the segment.
Otherwise IDA will discard information about instruction/data,
comments etc, but retain byte values so that you will be able to create
another segment afterwards. This checkbox is not meaningful you have checked
'move adjacent segments' checkbox.

Sometimes IDA creates 2 segments where only
one segment should exist. In this case you may try
the following sequence:
        - @0:795[delete] one segment. Choose one with
          bad segment base value. Don't disable addresses occupied
          by the segment being deleted.
        - change bounds of another segment.

Note that @0:793[create] segment command changes bounds of
overlapping segment automatically.

See also @0:951[Edit|Segments] submenu.╪WRAP
Delete a Segment ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: KillSegment
 Current hotkey: @<KillSegment>

This command allows to delete a segment.

IDA will ask your permission to disable addresses occupied by the segment.
If you give your permission, ALL information about the segment will be
deleted, otherwise IDA will discard information about instruction/data,
comments etc, but retain byte values so that you will be able to create
another segment afterwards.

To disassemble the addresses occupied by the segment you need to create a
new segment again (i.e. you can't disassemble bytes without a segment).
Also, you can @0:794[expand] another adjacent segment to
these addresses.

See also @0:951[Edit|Segments] submenu.äWRAP
Moving Segment ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

If you are sure, please confirm (press Enter).
Otherwise, press Esc.

 Caution: moving the first segment of the program will
delete all information about the bytes between the old start of the segment
and the new start of the segment!

See also another command that changes segment bounds:
 @0:794[Edit Segment]
and
 @0:951[Edit|Segments] submenu.=WRAP
Deleting a Segment ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

If you want to delete the segment, please mark 'CONFIRM DELETION' checkbox

Disable addresses checkbox ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

        CAUTION: ALL INFORMATION ABOUT THE SEGMENT WILL BE LOST!

If you disable the addresses occupied by the segment, all information
about these addresses will be lost. You won't see them on the screen anymore.

Otherwise, the segment will be deleted, but its data will rest unchanged.
You shall create another segment(s) for these addresses using
@0:793[Create a New Segment] command.
OWRAP
Choose segment ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Select any line. By default, the cursor
is on the current segment.

You can use <Up>, <Down>, <PgUp>,
<PgDn>, <Home>, <End> keys. If you
select the first line of the list,
nothing will be selected.

Press <Enter> to select line, <Esc> to cancel.

See also @0:951[other segment related commands]ΩWRAP
Change Segment Name ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Enter new name for the segment.
Segment name is up to 8 characters long.
IDA does check it for good shape now.
Try to give mnemonic names.

See also other @0:794[SegEdit] form fields.òWRAP
Change Segment Addressing ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

You can choose between 16-bit and 32-bit segment addressing.
This is meaningful only for 80386 processors.

All previous information about the segment will be lost!

Never do it if you are not sure. It may have irreversible consequences,
all instructions/data will be converted to undefined bytes.

See also other @0:794[SegEdit] form fields.)WRAP
Segment Class Name ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

The Segment Class Name identifies the segment with a class name
(such as CODE, FAR_DATA, or STACK). The linker places segments with
the same class name into a contiguous area of memory in the run-time
memory map.

Changing the segment class changes only the segment definition
on the screen. Nothing else will happen.

!!! Attention !!! Segment class names are not deleted. Once you
define a segment class name, you can't reuse it as a name of another object.

See also other @0:794[SegEdit] form fields.qWRAP
Change Segment Alignment ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Alignment:  select between abs,byte,word,dword,para,page

You can specify the segment alignment for the selected
segment. By default, IDA assumes 'byte' alignment.
Changing the alignment changes only the segment definition
on the screen. Nothing else will happen.

See also other @0:794[SegEdit] form fields.@0:868[]
Enter MAP file name@0:870[]
Enter ASM file name@0:871[]
Enter LST file name@0:872[]
Enter EXE file name @0:869[]
Enter unload file name @0:873[]
Enter IDC statement(s)@0:873[]
Enter IDC file name!@0:963[]
Enter file name to edit.@0:875[]
Enter new value for the current byte.@0:875[]
Enter new value for the current wordG@0:876[]
Auto analysis is not completed, the result may be inaccurate!-@0:834[]
Enter address to jump (hex or name) @0:833[]
Choose segment to jump @0:835[]
Choose address to jump@0:837[]
%lX: %sChoose a name"@0:740[]
Enter value to search %sSearching %s for value %lX...
Ö@0:741[]
Text search (slow!)

<~S~tring:A:80:50::>

<~C~ase sensitive:C>>           <Search ~D~own:R>
                                <Search ~U~p:R>>

)@0:739[]
Enter binary search (%s) string)@0:739[]
Bad binary search string format#Search completed. Found at %08lX.
Search failed.
&Searching %s for binary string %s...
&Searching %s for text string "%s"...
(@0:728[]
Enter array size (in elements) @0:729[]
Choose base for offset+@0:729[]
Enter base address for the offset╩WRAP
Change Segment Combination ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Combination

A field that describes how the linker can combine the
segment with other segments. Under MS-DOS, segments with
the same name and class can be combined in two ways: they
can be concatenated to form one logical segment, or they
can be overlapped. In the latter case, they have either the
same starting address or the same ending address, and they
describe a common area in memory. Values for the field
are:

  Private. Do not combine with any
           other program segment.
  Public.  Combine by appending at
           an offset that meets the
           alignment requirement.

  Stack.   Combine as for Public.
           This combine type forces
           byte alignment.

  Common.  Combine by overlay using
           maximum size.


Changing segment combination changes only the segment definition
on the screen. Nothing else will happen.

See also other @0:794[SegEdit] form fields.TWRAP
Change Segment Translation ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: SegmentTranslation
 Current hotkey: @<SegmentTranslation>

  A segment translation is a sequence of another segments to use
when resolving the references to instructions from the current segment.
This command is useful only for 16-bit segmented processors.
I hope it is easier to give an example than to give a formal definition.
Suppose we have 3 segments:

                start   end
        A       0000    1000
        B       1000    2000
        C       3000    4000

 The instruction

        call    1000

 in the segment C obviously refers to the segment B while the instruction

        call    500

 refers to the segment A.

 But IDA doesn't try to link these references unless you tell to do so:
 include the segments A and B into translation list of the segment C.
 That is, you should create a translation list

        A B

 for the segment C.
 Below is a more complicated example:

                start   end
        A       0000    1000
        B       1000    2000
        C       1000    2000
        D       3000    4000
        E       3000    4000

  translations

        B:      A
        C:      A
        D:      A B
        E:      A C

  allow you to emulate overlays (the first set is A B D, the second A C E)

See also @0:951[Edit|Segments] submenu.WRAP
Jump to the Specified Segment ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpSegment
 Current hotkey: @<JumpSegment>

This command jumps to the start of the selected segment.
IDA will ask to select a segment to jump to.
After:
  The current address is saved in the 'Jumps Stack'.
  Cursor is positioned to the specified segment start.

The @0:902[Return] command (usually Esc) will return you back.

See also:
 @0:798[How to choose a segment]
 @0:951[Other segment related commands]
 @0:905[Navigate|Jump to...] submenu.WRAP
Jump to the Specified address ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpAsk
 Current hotkey: @<JumpAsk>

IDA will ask an address to jump to.
You can enter name or address in hexadecimal format
with or without segment.
If you enter a valid address, then:
  The current address is saved in the 'Jumps Stack'.
  Cursor is positioned to the specified address.

The @0:902[Return] command (usually Esc) will return you back.

See also @0:905[Navigate|Jump to...] submenu.
         @0:127[How to Enter an Address].!WRAP
Jump to the Specified Segment Register Change Point ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpSegmentRegister
 Current hotkey: @<JumpSegmentRegister>

This command jumps to the selected
@0:836[Segment Register Change Point].
IDA will ask to select a change point to jump to.
And after:
  The current address is saved in the 'Jumps Stack'.
  Cursor is positioned to the specified change point.

The @0:902[Return] command (usually Esc) will return you back.

See also @0:905[Navigate|Jump to...] submenu.╣WRAP
Segment Register Change Points ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

When IDA encounters an instruction which changes a segment
register, it creates a change point. So, mostly change points
are maintained by IDA itself. IDA assumes that between change
points the segment registers don't change their values. If you
find out that IDA failed to locate a segment register changing,
or you want to change a register value,
you can create a change point using @0:866[Change Segment Register]
command. You can change value of a segment register
using @0:867[Set default segment register value] command.

IDA classifies the change points. In the change points list
you can see the following postfixes after register values:

 a (auto)     - Created by IDA. May be
                changed by IDA afterwards.
 u (by user)  - Created by user. IDA will
                not change it.

IDA generates the appropriate 'assume' instructions for the
change points.
┌WRAP
Jump to the Next Address from the Problems List ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpQ
 Current hotkey: @<JumpQ>

This command jumps to the next address from the
@0:838[Problems List].
If the Problems List is empty, you will hear a beep.
Otherwise, IDA will display a brief description of the problem
and will jump to it.
The @0:902[Return] command (usually Esc) will return you back.

See also @0:905[Navigate|Jump to...] submenu.æWRAP
Problems List ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀

The following problems exist:
  @0:839[Can't find offset base]
  @0:840[Can't find name]
  @0:841[Can't find alternative string for an operand]
  @0:842[Can't find comment]
  @0:850[Can't find references]
  @0:851[Indirect execution flow]
  @0:852[Can't disassemble]
  @0:860[Already data or code]
  @0:861[Execution flows beyond limits]
  @0:862[Too many lines]WRAP
Problem: Can't find offset base ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Description:
        The current item has an operand marked as an offset,
        but IDA can't find the offset base in the database.

 Possible reason(s):
        Probably, IDA base is corrupt.
        This may occur after database repairing.

 What to do:
        Mark the operand again as an offset. Use one of the following
        commands:
         @0:937[Convert to offset (DS)]
         @0:938[Convert to offset (CS)]
         @0:729[Convert to offset (any)]
}WRAP
Problem: Can't find name ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Description:
        Two reasons can cause this problem:
          1.Reference to an illegal address is made in the program being
            disassembled;
          2.IDA couldn't find a name for the address but
            it should exist.
 What to do:
        1. If this problem is caused by a reference to an illegal address
            - try to enter the operand @0:731[manually]
            - or make the illegal address legal @0:793[creating] a new segment.
        2. Otherwise, database is corrupt, the best thing to do is
           to @0:869[reload] the database.
⌡WRAP
Problem: Can't find alternative string for an operand ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Description:
        The current item has an operand marked as entered manually,
        but IDA can't find the manually entered string in the database.

 Possible reason(s):
        IDA base is corrupt. This may occur after database repairing.

 What to do:
        Enter the operand manually again. Use one of the following
        commands:
         @0:731[User-defined operand]₧WRAP
Problem: Can't find comment ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

        Should not happen!
        Please inform the author if you encounter this problem.
"@0:736[]
Enter repeatable comment @0:733[]
Enter instruction name1@0:734[]
Enter comment index for the instruction6@0:976[]
Repeatable comments are hidden, unhide them.&@0:737[]
Enter name for address %08lXkstartitem 1
@0:738[]
Rename address

  <~O~ld name :A:120:32::> (or address)

  <~N~ew name :I:120:32::>

+@0:738[]
Please enter a valid old address.ÑWRAP
Problem: Can't find references ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Description:
        The current item is marked as referenced from other place(s) in the
        program, but IDA can't find any reference to it.

 Possible reason(s):
        IDA base is corrupt. This may occur after database repairing.

 What to do:
        Database is corrupt, the best thing to do is
           to @0:869[reload] the database.-WRAP
Problem: Indirect execution flow ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Description:
        Actually, this is not a problem. IDA warns you,
        that here it encountered an indirect jump and
        can't follow the execution.

 What to do:
        Nothing, that is only for your informationYWRAP
Problem: Can't disassemble ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Description:
        IDA can't disassemble the specified bytes as an instruction.
        Probably, you should choose another processor type.

 Possible reason(s):
        1. The specified bytes don't contain instruction.
        2. The current @0:747[processor] type is not correct.

 What to do:
        If you are sure that the specified bytes contain an instruction,
        you can try to change @0:747[processor] type and
        mark this bytes as instruction using the following command:
         @0:920[Convert to instruction],@0:863[]
Enter Indirect Jumps Table Address)@0:863[]
Enter Indirect Jumps Table Size<@0:864[]
Can't create Indirect Jumps Table at %08lX size %d.@0:865[]
Link: Enter address to be referenced*@0:865[]
UnLink: Enter referenced address[@0:866[]
Segment Register Value

<Segment Register :A:2:::>

<Value            :S:10:::>

í@0:867[]
Segment Default Register Value

<Segment Register :A:2:::>

<Default Value    :S:10:::>

This value will be used when the
register value is not known.
IWRAP
Problem: Already data or code ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Description:
        IDA can't convert this byte(s) to an @0:920[instruction]
        or @0:921[data] because it would overlap another instruction.

 What to do:
        Make following instruction or data 'unexplored'
        using @0:918[undefine] command.`WRAP
Problem: Execution flows beyond limits ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Description:
        IDA encountered a jump or call instruction to an illegal address.
        Namely:
          - jump/call beyond program segments
          - near jump/call beyond the current segment
 What to do:
        1. Enter the operand @0:731[manually]
        2. or Create a new @0:793[segment] making the illegal address legal
        3. or Change the current segment bounds using one of the following:
              @0:794[How to change segment attributes]
              @0:939[How to move a segment start]ëWRAP
Problem: Too many lines ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Description:
        The current item (instruction or data) can't be
        represented in the text form using 100 lines.

 What to do:
        1. If the current item is an @0:728[array] or @0:922[ASCII] string, try to divide it.
        2. Delete @0:732[Additional comment lines]
        3. Disable @0:972[cross-references] displayPWRAP
Indirect Jumps Table ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeJumpTable
 Current hotkey: @<MakeJumpTable>

When you find indirect jumps by table you can inform IDA
about address and size of this table. In this case IDA will
continue analysing of the program using the table. For example,
it will convert to code all addresses referenced by the table.

You should stand on the instruction which uses the jump
table and you should specify address and size of this table.

See also @0:945[Edit] submenu
         @0:124[How to Enter a Number]
         @0:127[How to Enter an Address].»WRAP
Bad Indirect Jumps Table ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

The specified table is overlapped with some other object
(any data,code instructions) or table address is invalid.6WRAP
Cross References control ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: Link, Unlink
 Current hotkey: @<Link>, @<Unlink>

Sometimes you want to add/delete some cross-references,
because IDA fails to follow cross-references or misplaces them.
Usually this happens due to bad segment register values.
First check segment register values and if it doesn't help,
then apply this command as a last resort.

You can disable displaying of xrefs using
  @0:965[toggle display of xrefs] command.

See also @0:945[Edit] submenu.
         @0:127[How to Enter an Address].╠WRAP
Change Segment Register Value ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: SetSegmentRegister
 Current hotkey: @<SetSegmentRegister>

Meaningful only for Intel 80x86 processors.

This command creates or updates a segment register
@0:836[change point].

See @0:835[jump to segment register change point] for more info.

 See also @0:950[Edit|Registers] submenu.
 See also @0:123[How to enter segment value].
 See also @0:124[How to Enter a Number].▀WRAP
Set Default Segment Register Value ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: SetSegmentRegisterDefault
 Current hotkey: @<SetSegmentRegisterDefault>

Meaningful only for Intel 80x86 processors.

You can specify a default value of a segment register for the current segment.
When you change the default value, IDA will reanalyze the segment,
taking the default value when it can't determine the actual value
of the register. This takes time, so don't be surprised if references
are not corrected immediately.

To specify other than default value of a segment register you can
use @0:866[change segment register value] command.

 See also @0:950[Edit|Registers] submenu.
 See also @0:123[How to enter segment value].WRAP
Create MAP File ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ProduceMap
 Current hotkey: @<ProduceMap>

Enter a file name for the map. IDA will write the following
information to this file:
  current segmentation
  list of names sorted by values
    (automatically generated names are not listed)

You can use this map file for your information and you can
use it for debugging (for example, Periscope from Periscope
Company or Borland's Turbo Debugger can read this file).

See also other @0:954[Produce output file] commands.┤WRAP
Unload database ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: Unload
 Current hotkey: @<Unload>

This command saves current IDA database into a text file.

You can use it as a safety command:
  - to protect your work from disasters
  - to migrate information
    into new database formats of IDA.

The 'Unload' command is used when you want to switch to a new version
of IDA. Usually each new version of IDA has its own database
format. To create a new format database, you need:
  - to issue the  'Unload' command for the old
    database (using old version of IDA). You will
    get an IDC file containing all information
    from your old database.
  - to reload your database using new IDA with switch
    -x.
  - to compile and execute the IDC file with command
    'Execute IDC file' (usually F2)

To load the saved information, use the following
@0:873[IDC] command:

  dofile "filename";

See also other
 @0:954[Produce output file] commands.WRAP
Create ASM File ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ProduceAsm
 Current hotkey: @<ProduceAsm>

Enter a file name for the assembler text file. IDA will write
the disassembled text to this file.

If you've selected an area on the screen using @0:105[Drop Anchor]
command, IDA will write only the selected area (from the
current address to the anchor).

If some I/O problem (e.g. disk full) occurs during writing
to this file, IDA will stop - a partial file will be created.

See also other @0:954[Produce output file] commands.WRAP
Create LST File ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ProduceLst
 Current hotkey: @<ProduceLst>

Enter a file name for the assembler text file. IDA will write
the disassembled text to this file.

If you've selected an area on the screen using @0:105[Drop Anchor]
command, IDA will write only the selected area (from the
current address to the anchor).

If some I/O problem (e.g. disk full) occurs during writing
to this file, IDA will stop - a partial file will be created.

See also other @0:954[Produce output file] commands.ⁿWRAP
Create Executable File ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ProduceExe
 Current hotkey: @<ProduceExe>

Enter a file name for the new executable file. Usually this
command is used after patching (see commands @0:875[Patch byte] and
@0:875[Patch word]) to obtain a patched version of the file.


NOTE: only @0:875[Patch byte/word] commands affect the executable
file contents, other commands
(including @0:731[Alternate String for the #th Operand]) don't affect it.

 EXE files:
 ----------
 IDA will reproduce the same EXE-header, relocation table as before
and fill with zero unused areas of the EXE file (e.g. between
relocation table and loadable pages).

See also @0:954[File|Produce output file] submenu,
         @0:952[Edit|Patch core] submenu.EWRAP
IDC Command ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ExecuteLine
 Current hotkey: @<ExecuteLine>

    You can enter and execute a small script written
    in the built-in language named @0:878[IDC].

See also Execute @0:874[IDC file] command
         @0:895[other File... submenu] commands
         How to use @0:126[notepad].≡WRAP
IDC File ▄
 ▀▀▀▀▀▀▀▀▀

 Action    name: Execute
 Current hotkey: @<Execute>

    You can select and run an @0:878[IDC] script file.

See also @0:873[Immediate execution] of IDC commands
         @0:895[other File... submenu] commands.EWRAP
Patching the Image ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: PatchByte, PatchWord
 Current hotkey: @<PatchByte>, @<PatchWord>

You can modify executable file and
@0:872[generate a new] file.  You can modify
@0:918[unexplored] items only.

See also @0:952[Edit|Patch core] submenu.
See also @0:124[How to Enter a Number].äWRAP
Auto analysis is not completed ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Till auto analysis is not completed, the IDA database is not consistent:
  - not all @0:972[cross-references] are found
  - not all @0:920[instructions] are disassembled
  - not all @0:921[data] items are explored

See also:
  @0:724[auto analysis]
  @0:924[setup auto analysis]
  @0:919[wait until end of analysis]WRAP
Cannot Create File ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Probably this file exists and has
read-only attribute.  Try to delete it
or clear this attribute.

Another reason is that you have too few
number in FILES= statement of your
CONFIG.SYS file. IDA requires about 10
file handlers to be free.¥WRAP
IDC language ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀

IDC language is a C-like language. It has the same lexical tokens as C does:
character set,constants,identifiers,keywords, etc.
A program in IDC consists of function declarations. By default, execution
starts from a function named 'main'.
Select a topic to read:

  @0:882[Variables]
  @0:881[Functions]
  @0:880[Statements]
  @0:879[Expressions]
  @0:883[Built-in functions]
~WRAP
IDC: Expressions ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
                                        See also @0:883[Built-in functions]

In expressions you can use almost all C operations except:
  ++,--
  complex assigment operations as '+='
  , (comma operation)

You can use the following construct in the expressions:

  [ s, o ]

This means to calculate linear (effective) address for segment 's' offset 'o'.
The calculation is made using the following formula:

  (s << 4) + o

If a string constant is specified as 's', it denotes a segment by its name.

There are 2 type conversion operations:

  long( expr )
  char( expr )

However, all type conversions are made automatically:
  - operand(s) are converted to 'long'
  - the operation is performed.

Exceptions:
 1. binary '+' operation. If the first
    operand is string type, the second
    operand is converted to a string and
    the operands are concatenated. Converting a long to a string doesn't
    mean format conversions.
 2. relational operations
    (such as ==,!=, etc.) If both operands
    are strings, the string comparision
    is performed, otherwise - they are
    converted to numbers.
═WRAP
IDC: Statements ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

In IDC there are the following statements:
  @0:879[expression];        (expression-statement)
  if (expression) statement
  if (expression) statement else statement
  for ( expr1; expr2; expr3 ) statement
  while (expression) statement
  do statement while (expression);
  break;
  continue;
  return <expr>;
  return;              the same as 'return 0;'
  { statements... }
  ;                    (empty statement)
πWRAP
IDC: Functions ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

A function in IDC returns a value. There are 2 kinds of functions:
  - @0:883[built-in] functions
  - user-defined functions

A user-defined function is declared in this way:

  static func(arg1,arg2,arg3) {

    @0:880[statements] ...

  }

where arg1,arg2,arg3 are the function parameters,'func' is the function name.
It is not nesessary to specify the types of the parameters
because any @0:882[variable] can contain a string or a number.
ΦWRAP
IDC: variables ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

All variables in IDC are
automatic local variables (sic!). A variable can contain:
  - a 32-bit signed long integer
  - a character string
    (max 255 characters long)

A variable is declared in this way:

  auto var;

This declaration introduces a variable named 'var'. It can contain a string
or a number. All C and C++ keywords are reserved and cannot be used as
a variable name. The variable is defined up
to the end of the @0:881[function].
úWRAP
IDC: Built-in functions ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

The following conventions are used in this list:
  'ea' is a linear address
  'success' is 0 if a function failed, 1 otherwise
  'void' means that function returns no meaningful value (always 0)

All function parameter conversions are made automatically.

 @0:884[A.] Utility functions
 @0:885[B.] Functions that change program representation
 @0:886[C.] Functions that produce output files
 @0:887[D.] Informational functions
 @0:888[E.] Functions that change global settings
 @0:889[F.] Functions that interact with the user
 @0:890[G.] Functions that work with segments
 @0:893[H.] Functions that work with files
?A. Utility functions ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

long    MK_FP    (long seg,long off);   // the same as [ seg, off ]
long    _lpoke   (long RAMea,long value); // poke a long integer into RAM
                                        // returns old value
long    _poke    (long RAMea,long value);// poke a byte into RAM
                                        // returns old value
long    _peek    (long RAMea);          // get a byte from RAM
char    form     (char format,long value); // works as sprintf, takes only
                                        // 1 parameter. Specifying %f as a
                                        // parameter will lead to abnormal
                                        // program termination with bad
                                        // consequences.
                                        // The resulting string should
                                        // be less than 255 characters.
long    strstr  (char str,char substr); // find a substring, -1 - not found
                                        // if x2 == -1, then till end of line
long    strlen  (char str);             // calculate length
long    xtol    (char str);             // ascii hex -> number
                                        // (use long() for atol)
success AssignKey(char action,long key);// assign a key to an action
                                        // meaningful only before the main
                                        // menu is constructed
success Jump     (long ea);             // move cursor to ea
                                        // screen is refreshed at the end
                                        // of IDC execution
void    Wait     ();                    // Wait for the end of
                                        // autoanalysis
void    Exit     (long code);           // Exit to DOS
▒B. Functions that change program representation ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

void    DeleteAll();                    // delete ALL information
                                        // about the program
long    MakeCode (long ea);             // convert to instruction
                                        // returns number of bytes
                                        // occupied by the instruuction
long    AnalyseArea(long sEA,long eEA); // analyse area and try to
                                        // convert to code all bytes
                                        // Returns 1-ok,0-CtrlBreak pressed
success MakeName (long ea,char name);   // assign a name to a location
success MakeComm (long ea,char comment);// give a comment
success MakeRptCmt(long ea,char comment);// give a repeatable comment
success MakeArray(long ea,long nitems); // convert to an array
success MakeStr  (long ea,long size);   // convert to ASCII string
success MakeByte (long ea);             // convert to byte
success MakeWord (long ea);             // convert to word
success MakeDword(long ea);             // convert to double-word
success MakeQword(long ea);             // convert to quadro-word
success MakeTbyte(long ea);             // convert to 10 bytes (tbyte)
void    MakeUnkn (long ea,long expand); // convert to 'unknown'
                                        // expand==1 => undefine consequent
                                        // instructions too
success OpDec    (long ea);             // operands are decimal
success OpChar   (long ea);             // operands are characters
success OpOffset (long ea,long segbase);// operands are offsets
                                        // if segbase==-1, then operands
                                        // aren't offsets
success OpSegment(long ea);             // operands are segments
success OpNum    (long ea);             // operands are numbers
success OpAlt1   (long ea,char opnd);   // manually enter 1st operand
success OpAlt2   (long ea,char opnd);   // manually enter 2nd operand
void    MakeVar  (long ea);             // the location is 'variable'
success MakeProc (long ea,long fl);     // fl=0: no proc, fl=1: near proc,
                                        // fl=2: far proc
success MakeEndp (long ea,long fl);     // fl=0: no endp,1: endp
void    ExtLinA  (long ea,long n,char line); // insert an additional line
                                        // before the generated ones
void    ExtLinB  (long ea,long n,char line); // insert an additional line
                                        // after the generated ones
void    DelExtLnA(long ea,long n);      // delete an additional line
                                        // before the generated ones
void    DelExtLnB(long ea,long n);      // delete an additional line
                                        // after the generated ones
success JmpTable (long jmpea,long tableea,long nitems); // define jump table
void    PatchByte(long ea,long value);  // change a byte
void    SetFlags (long ea,long flags);  // change internal flags for ea
success SetReg   (long ea,char reg,long value); // set value of
                                        // segment register
 C. Functions that produce output files ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

void    WriteMap(char file);            // produce a .map file
void    WriteTxt(char file,long ea1,long ea2); // produce an .asm file
void    WriteExe(char file);            // produce an executable file
^D. Informational functions

long    GetFlags (long ea);             // get internal flags for ea
long    Byte     (long ea);             // get a byte at ea
long    Word     (long ea);             // get a word at ea
long    Dword    (long ea);             // get a double-word at ea
long    LocByName(char name);           // -1 - no such name
long    SegByBase(long base);           // -1 - no such segment
long    MinEA    ();                    // the minimal address defined
                                        // in the program
long    MaxEA    ();                    // the maximal address defined
                                        // in the program
long    BeginEA  ();                    // where execution starts
long    ScreenEA ();                    // the current screen ea
long    SelStart ();                    // the selected area start ea
                                        // -1 - no selected area
long    SelEnd   ();                    // the selected area end ea
                                        // -1 - no selected area
long    GetReg   (long ea,char reg);    // get segment register value
                                        // -1 - undefined or error
long    SegStart (long ea);             // returns start of the segment
                                        // -1 if bad address passed
long    SegEnd   (long ea);             // return end of the segment
                                        // this address doesn't belong
                                        // to the segment
                                        // -1 if bad address passed
char    SegName  (long ea);             // returns name of the segment
                                        // "" if bad address passed
long    NextAddr (long ea);             // returns next defined address
                                        // -1 if no such address exists
long    PrevAddr (long ea);             // returns prev defined address
                                        // -1 if no such address exists
long    NextHead (long ea);             // returns next defined item address
                                        // -1 if no such address exists
long    PrevHead (long ea);             // returns prev defined item address
                                        // -1 if no such address exists
long    NextNotTail(long ea);           // returns next not tail address
                                        // -1 if no such address exists
long    PrevNotTail(long ea);           // returns prev not tail address
                                        // -1 if no such address exists
long    ItemEnd  (long ea);             // returns address past end of
                                        // the item
long    ItemSize (long ea);             // returns item size, min answer=1
char    Name     (long ea);             // get name of the byte
char    GetMnem  (long ea);             // get instruction name
char    GetOpnd  (long ea,long n);      // get instruction operand
                                        // n=0 - first operand
long    GetOpType(long ea,long n);      // get operand type
                                // n=0 - first operand
                                // Returns:
                                // -1   bad operand number passed
                                // 0    None
                                // 1    General Register (al,ax,es,ds...)
                                // 2    Memory Reference
                                // 3    Base + Index
                                // 4    Base + Index + Displacement
                                // 5    Immediate
                                // 6    Immediate Far Address
                                // 7    Immediate Near Address
                                // 8    FPP register
                                // 9    386 control register
                                // 10   386 debug register
                                // 11   386 trace register
                                // 12   Condition (for Z80)
                                // 13   bit (8051)
                                // 14   bitnot (8051)
char    LineA    (long ea,long num);    // get additional line before
                                        // generated ones
char    LineB    (long ea,long num);    // get additional line after
                                        // generated ones
char    Comment  (long ea);             // get comment
char    RptCmt   (long ea);             // get repeatable comment
char    AltOp1   (long ea);             // get manually entered 1st operand
char    AltOp2   (long ea);             // get manually entered 2nd operandE. Functions that change global settings ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

long    StringEnd(long asciiendchar);   // set current ASCII end character
                                        // returns old value
long    StringStp(long asciistopchar);  // set current ASCII break character
                                        // returns old value
long    LowVoids (long lowlimit);       // set current low limit for voids
                                        // returns old value
long    HighVoids(long highlimit);      // set current high limit for voids
                                        // returns old value
long    TailDepth(long taildepth);      // set current tail depth
                                        // returns old value
long    Direction(long direction);      // set current search direction
                                        // returns old value
long    Analysis (long analysis);       // enable/disable auto analysis
                                        // returns old value
long    Tabs     (long tabulations);    // enable/disable tabulations in
                                        // output file. returns old value
long    Comments (long comments);       // enable/disable automatic comments
                                        // returns old value
long    Voids    (long voids);          // enable/disable void marks display
                                        // returns old value
long    XrefShow (long xrefshow);       // enable/disable cross-references
                                        // display. returns old value
long    Indent   (long indent);         // set indention for instruntions
                                        // returns old value
long    CmtIndent(long cmtindent);      // set indention for comments
                                        // returns old value
long    AutoShow (long autoshow);       // enable/disable autoanalysis
                                        // display. returns old value
success SetPrcsr (char processor);      // set processor type
F. Functions that interact with the user ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

char    AskStr  (char defval,char prompt); // ask a string
long    AskAddr (long defval,char prompt); // -1 - no or bad input
long    AskSeg  (long defval,char prompt); // -1 - no or bad input
char    AskIdent(char defval,char prompt);
void    Message (char str);     // show a message in messages window
void    Warning (char str);     // show a warning in a dialog box
void    Fatal   (char str);     // show a message, exit IDA immediately
ΩG. Functions that work with segments ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

success SegCreate(long startea,long endea,long base,long use32,
                  long @0:891[alignment],long @0:892[combination]);
success SegDelete(long segea,long @0:797[disable]);
success SegBounds(long segea,long startea,long endea);
success SegRename(long segea,char name);
success SegClass (long segea,char class);
success SegAlign (long segea,long @0:891[alignment]);
success SegComb  (long segea,long @0:892[combination]);
success SegAddrng(long segea,long addrng);
long    SegByName(char segname);        // returns segment base
success SegDefRef(long segea,char reg,long value);
                                        // set default value for segment regΓSegment aligments ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

#define saAbs      0 // Absolute segment.
#define saRelByte  1 // Relocatable, byte aligned.
#define saRelWord  2 // Relocatable, word (2-byte, 16-bit) aligned.
#define saRelPara  3 // Relocatable, paragraph (16-byte) aligned.
#define saRelPage  4 // Relocatable, aligned on 256-byte boundary (a "page"
                     // in the original Intel specification).
#define saRelDble  5 // Relocatable, aligned on a double word (4-byte)
                     // boundary. This value is used by the PharLap OMF for
                     // the same alignment.
#define saRel4K    6 // This value is used by the PharLap OMF for page (4K)
                     // alignment. It is not supported by LINK.
ïSegment combinations ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

#define scPriv     0    // Private. Do not combine with any other program
                        // segment.
#define scPub      2    // Public. Combine by appending at an offset that
                        // meets the @0:891[alignment] requirement.
#define scPub2     4    // As defined by Microsoft, same as C=2 (public).
#define scStack    5    // Stack. Combine as for C=2. This combine type
                        // forces byte @0:891[alignment].
#define scCommon   6    // Common. Combine by overlay using maximum size.
#define scPub3     7    // As defined by Microsoft, same as C=2 (public).8H. Functions that word with files ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

long    fopen      (char file,char mode);// open a file
void    fclose     (long fp);           // close a file
long    filelength (long fp);           // get file length
long    fseek(long fp,long off,long org);// set cursor position in the file
long    ftell      (long fp);           // get cursor position in the file
success loadfile(long fp,long fpos,long ea,long size);// load from file
success savefile(long fp,long fpos,long ea,long size);// save to file
long    fgetc      (long fp);           // read one byte from file
long    fputc      (long byte,long fp); // write one byte to file
long    readshort(long fp,long msb);    // read 2 bytes from file
long    readlong (long fp,long msb);    // read 4 bytes from file
long    writeshort(long fp,long word,long msb);// write 2 bytes to file
long    writelong(long fp,long dword,long msb);// write 4 bytes to file
char    readstr    (long fp);           // read a string from file
long    writestr   (long fp,char str);  // write a string to file
WRAP
Disk Write Error ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

May be your DISK IS FULL?  Try to
delete some unnecessary files.

Probably your disk contains unmarked BAD
SECTORS. This is very dangerous.  I
recommend you to re-format your disk or
to mark somehow these sectors.

Partial file is created.├WRAP
File submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀

In this submenu you can:

  @0:898[Open]               Open a window
  @0:897[Load file]          Load additional file
  @0:873[IDA command]        Execute an IDC command
  @0:954[Produce output file] Generate output file
  @0:955[Repaint desktop]    Repaint screen
  @0:957[Abort]              Abort - don't save changes
  @0:956[Quit]               Quit to DOS - save changes

See also @0:896[Menu Bar] submenus.└WRAP
Main Menu Bar ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀

All IDA commands are available from the followings menus:

 @0:895[File]
 @0:945[Edit]
 @0:944[Navigate]
 @0:947[View]
 @0:948[Options]
 @0:946[Windows]
iWRAP
Load additional file ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: LoadFile
 Current hotkey: @<LoadFile>

This command loads an additional file into the IDA database.
The new file is appended to the database so that all information in the
database is retained.

This command allows to load binary files only.

See also @0:895[other File... submenu] commands.[WRAP
Open a window ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: WindowOpen
 Current hotkey: @<WindowOpen>

Opens a new window with disassembled text.
IDA automatically opens one big window
at the start. If you want, you can open other windows.

In IDA there are the following types of windows:

  IDAview window                The main window type in IDA.
                                is opened using this command.
  Messages window               is opened automatically at the start of
                                work, displays various information
  Segments window               Displays program @0:743[segmentation]
  Segment registers             Displays @0:742[segment registers]
  Names window                  Displays all @0:744[names] in the program
  File Viewer                   allows to @0:745[view] files of any size
  File Editor                   allows to @0:963[edit] small files (in memory)

There are dialog boxes of various types too...

When you are in the IDAview type of window, you can switch between normal
mode and @0:942[dumping] mode.

See also @0:895[other File... submenu] commands.φWRAP
Jump to the Previously Marked Position ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpPosition
 Current hotkey: @<JumpPosition>

This command jumps to the selected position.
IDA will ask to select a position to jump to.
After:
  The current address is saved
  in the @0:900[Jumps Stack].
  Cursor is positioned to the
  specified segment start.

The @0:902[Return] command (usually Esc) will return you back.

You can mark position using @0:908[Mark Position] command.
WRAP
Jumps Stack ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀

Each IDA Window has its own jumps stack. This stack keeps cursor locations.
Many IDA commands use jumps stack, i.e. they save old cursor position to
the stack. For example, when you are at the address 3000:0100 and press
key Ctrl-C (find instruction), the 3000:0100 is saved into the jumps stack
and the search is started. Afterwards, you can return to the old position
using @0:902[Return] command.

You can make the jumps stack empty using the @0:904[Navigate|Empty stack]
menu command.
╒WRAP
'Jump' Command ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpEnter
 Current hotkey: @<JumpEnter>

This command takes a name or address under the cursor and jumps:
  The current address is saved in the @0:900[jumps stack].
  Cursor is positioned to the address under the cursor.

The @0:902[Return] command (usually Esc) will return you back.

This is the easiest way to navigate in the program.

See also @0:944[Navigate] submenu.
         @0:904[Empty Stack] command.5WRAP
'Return' Command ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: Return
 Current hotkey: @<Return>

This command returns you back to the previous position.
It takes positions from @0:900[Jumps Stack].

See also @0:944[Navigate] submenu.
         @0:903[Undo Return] command.
         @0:904[Empty Stack] command.WRAP
Undo the last 'Return' Command ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: UndoReturn
 Current hotkey: @<UndoReturn>

This command undoes the last @0:902[Return] command.

See also @0:944[Navigate] submenu.
         @0:904[Empty Stack] command.σWRAP
Empty Stack Command ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: EmptyStack
 Current hotkey: @<EmptyStack>

This command makes the @0:900[jumps stack] empty.

See also @0:944[Navigate] submenu.
         @0:902[Return] command.│WRAP
Navigate|Jump to   submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

In this menu you can select a command to jump to the specified
location in the file.  Jumps are very fast and your previous
position is saved. This submenu contains the following items:

 @0:834[Jump to the Specified Address]
 @0:953[Jump to the Named Location]
 @0:833[Jump to the Specified Segment Start]
 @0:899[Jump to the Previously Marked Position]
 @0:835[Jump to the Specified Segment Register Change Point]
 @0:837[Jump to the Next Address from the Problems List]
 @0:908[How to Mark a Location]

Look also @0:906[Search for...] menu for fast navigating.
See @0:900[Jumps Stack] concept.
See @0:944[Navigate] submenu.╙WRAP
Navigate|Search for   submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

In this menu you can select a command to search for something
in the file.  Searches are relatively slow and your previous
position is saved in @0:900[Jumps Stack].

You can search for:
   @0:741[substring in the text representation]
   @0:739[substring in the binary image of the file]
   @0:913[unexplored bytes]
   @0:914[explored bytes]
   @0:910[instruction bytes]
   @0:911[data bytes]
   @0:740[immediate operand values]
 * @0:909[instructions that need your ATTENTION] (voids)
   @0:912[start of procedures]

 in both @0:907[directions] (up and down).

Look also @0:905[Jump to...] menu for fast navigating.

See also @0:944[Navigate] submenu.
wWRAP
Set Direction for Searches ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: SetDirection
 Current hotkey: @<SetDirection>

The current direction for searches is displayed in the right
upper corner of the screen. Using this command you can toggle
it.

See also @0:906[Navigate|Search for...] submenu,
         @0:944[Navigate] submenu,
         @0:948[Options] submenu.
∩WRAP
Mark Position ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MarkPosition
 Current hotkey: @<MarkPosition>

You can mark certain locations of the file to be able to @0:899[jump] to
them quickly. Text description of the location may help to find
a desired location easily.

First you select a slot for the mark, after you enter a
description for the location.

If you enter an empty description line, the slot is freed.

See also @0:944[Navigate] submenu,
         @0:905[Navigate|Jump to...] submenu.'WRAP
Search for next void ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpVoid
 Current hotkey: @<JumpVoid>

'void' instructions are instructions that need your attention
because they contain an immediate operand that could be a
number or offset. IDA doesn't know about it, so it marks these
instructions as 'void'.  You can change 'void' operands
definition using @0:983[set lower limit of voids] and
@0:983[set upper limit of voids] commands.

You can also disable display of the 'void' marks using
@0:974[toggle voids display] command.

NOTE ▄
 ▀▀▀▀▀

I strongly recommend that before producing an ASM file you go
through 'void' marks and get rid of them.  After this you have
a certain level of confidence that the file have been
disassembled correctly.

See also @0:906[Navigate|Search for...] submenu.≡WRAP
Search for next code ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpCode
 Current hotkey: @<JumpCode>

This command searches for the first instruction in the
@0:907[current direction].

See also @0:906[Navigate|Search for...] submenu.ΘWRAP
Search for next data ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpData
 Current hotkey: @<JumpData>

This command searches for the first data in the
@0:907[current direction].

See also @0:906[Navigate|Search for...] submenu.}WRAP
Search for next procedure ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpProc
 Current hotkey: @<JumpProc>

This command searches for the first procedure in the
@0:907[current direction].

IDA doesn't use the concept of procedures. It simply allows
you to create prcedure headings (assembler 'proc' instruction)
and endings ('endp' command).
You can create them using appropriate commands. IDA won't
check this.

 NOTE ▄
 ▀▀▀▀▀▀
 Never create a procedure ending without procedure heading.
This can cause IDA to spend a great lot of time in searching
for the procedure heading.

See also @0:906[Navigate|Search for...] submenu.WRAP
Search for next unexplored byte ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpUnknown
 Current hotkey: @<JumpUnknown>

This command searches for the first unexplored byte in the
@0:907[current direction].

See also @0:906[Navigate|Search for...] submenu.WRAP
Search for next explored byte ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpDefined
 Current hotkey: @<JumpDefined>

This command searches for the first defined byte
(instruction or data) in the
@0:907[current direction].

See also @0:906[Navigate|Search for...] submenu.5WRAP
Repeat search for instruction/data with the specified operand ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpImmediate
 Current hotkey: @<JumpImmediate>

This command repeats @0:740[search for immediate] command.

See also @0:906[Navigate|Search for...] submenu.WRAP
Repeat search for substring in the text representation ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpText
 Current hotkey: @<JumpText>

This command repeats @0:741[search for text] command.

See also @0:906[Navigate|Search for...] submenu.WRAP
Repeat search for substring in the file ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpBinaryText
 Current hotkey: @<JumpBinaryText>

This command repeats @0:739[search for text in core] command.

See also @0:906[Navigate|Search for...] submenu.WWRAP
Undefine a byte ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeUnknown
 Current hotkey: @<MakeUnknown>

This command deletes the current instruction or data converting
it to 'unexplored' bytes.

If you've selected an area using the @0:105[anchor], all bytes in the area
will be converted to
'unexplored' bytes.

See also
 @0:945[Edit] submenu,WRAP
Wait for end of auto analysis ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: Wait
 Current hotkey: @<Wait>

This command suspends execution of @0:104[macro] until auto
analysis in ended,
i.e. the auto analysis @0:941[indicator] is 'Ready'.

See also @0:895[other File... submenu] commands.┤WRAP
Convert to instruction ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeCode
 Current hotkey: @<MakeCode>

This command converts the current unexplored bytes to instruction(s).
If it is not possible, IDA will warn you.

If you've selected an area using the @0:105[anchor], all bytes in the area
will be converted to instructions.

If you apply this command to an instruction, it will be reanalyzed.

See also
 @0:945[Edit] submenuUWRAP
Convert to data ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeData
 Current hotkey: @<MakeData>

This command converts the current unexplored bytes to data.
If it is not possible, IDA will warn you.
Multiple using of this command will change data type:

        db -> dw -> dd -> dq -> dt -        ^                           |
        `---------------------------'

If the @0:923[target assembler] doesn't support double words or another
data type, it will be skipped.
To convert back, use @0:918[Undefine] command.
To create an array, use @0:728[Array] command.

See also
 @0:945[Edit] submenu(WRAP
Convert to ASCII string ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeAscii
 Current hotkey: @<MakeAscii>

This command converts the current unexplored bytes to a string.  IDA
will add characters to the string until '\0' or '$' or
@0:987[ASCII end symbol] is not encountered.
You can change ASCII end symbol using appropriate
command.  If the @0:105[anchor] was dropped, then IDA takes for the string
all characters between the current cursor position and the anchor.

IDA allows the following characters in the ASCII string:
  all printable characters (from ' ' to 0xFE inclusive)
  \n \r \t \b \a \v
  escape character

If the current @0:923[assembler] doesn't allow ASCII characters with high bit set,
characters with high bit set are not allowed.

This command also generates a @0:125[name] for the string.

You can change ASCII string length using @0:728[Array] command.

Pascal Strings ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
 To create Pascal style strings (with first byte indicating string
length) use @0:989[Set Ascii Style] command.

See also
 @0:945[Edit] submenuáWRAP
Specify Target Assembler ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: SetAssembler
 Current hotkey: @<SetAssembler>

This command allows you to change the target assembler, i.e. the assembler
the output is generated for. You select the target assembler from
a menu. The menu items depend on the current @0:747[processor type].

NOTE: For the moment IDA supports only a generic assembler
for 80x86 processors.«WRAP
Setup Auto Analysis ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: SetAuto
 Current hotkey: @<SetAuto>

 IDA displays a form and asks you to enable or disable auto analysis
and its @0:941[indicator].

Usually, auto analysis is enabled.
Disable it if you are sure that this will help you.

Mainly this command is for debugging purposes only.

See also @0:948[Options] submenu.
         @0:724[auto analysis explanation].
         RWRAP
Edit|Text|Comments   submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Here you can manipulate with different kinds of comments.
Use them to make disassembled text more understandable.

 @0:735[Regular comments]
 @0:736[Repeatable comments]
 @0:929[Predefined comments]
 @0:732[Additional comment lines]

See also @0:949[Edit|Text] submenu.WRAP
Edit|Operand types submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Here you can change operand types to offset,number,chars, etc.
Use them to make disassembled text more understandable.

Use this commands to delete @0:909[void] marks.

 @0:930[Convert to decimal number]
 @0:933[Convert to character]
 @0:934[Convert to hex number]
 @0:936[Convert to segment]
 @0:937[Convert to offset (DS)]
 @0:938[Convert to offset (CS)]
 @0:729[Convert to offset (any)]
 @0:935[Mark as variable]

See also @0:949[Edit|Text] submenu.πWRAP
Make Procedure Heading ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeProcedure
 Current hotkey: @<MakeProcedure>

IDA doesn't use the concept of procedures. It simply allows
you to create prcedure headings (assembler 'proc' instruction)
and endings ('endp' command).

With this command you can create procedure heading:

        sub_45          proc near

Multiple using of this command toggles:

        proc near -> proc far -> no proc

See also @0:949[Edit|Text] submenu.6WRAP
Make Procedure Ending ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeEndOfProcedure
 Current hotkey: @<MakeEndOfProcedure>

IDA doesn't use the concept of procedures. It simply allows
you to create procedure headings (assembler 'proc' instruction)
and endings ('endp' command).

With this command you can create procedure ending:

        sub_45          endp

 NOTE:
 -----
 Never create a procedure ending without procedure heading.
This can cause IDA to spend a great lot of time in searching
for the procedure heading.

See also @0:949[Edit|Text] submenu.UWRAP
Retrieve predefined comment ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakePredefinedComment
 Current hotkey: @<MakePredefinedComment>

You can retrieve predefined comment for instructions.

For this, you should specify the @0:733[instruction name]
and so-called @0:734[help index].

See also @0:925[Edit|Text|Comments] submenu.ùWRAP
Immediate Operand -> Decimal ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeDecimal
 Current hotkey: @<MakeDecimal>

This command converts immediate operand(s) type of the
current instruction/data to decimal. Therefore, it
becomes a 'number'.

If this command affects another operand, try to use
 @0:731[Enter #th operand manually] commands.

See also
 @0:926[Edit|Text|Operand types] submenu.┼WRAP
Immediate Operand -> Octal ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeOctal
 Current hotkey: @<MakeOctal>

This command makes the current instruction or data operand type octal.
IDA always uses 123o notation for octal numbers even if the current
assembler doesn't support octal numbers.

If this command affects another operand, try to use
 @0:731[Enter #th operand manually] commands.

See also
 @0:926[Edit|Text|Operand types] submenu.╠WRAP
Immediate Operand -> Binary ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeBinary
 Current hotkey: @<Makebinary>

This command makes the current instruction or data operand type binary.
IDA always uses 123b notation for binary numbers even if the current
assembler doesn't support binary numbers.

If this command affects another operand, try to use
 @0:731[Enter #th operand manually] commands.

See also
 @0:926[Edit|Text|Operand types] submenu.uWRAP
Immediate Operand -> Character ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeChar
 Current hotkey: @<MakeChar>

This command converts immediate operand(s) type of the
current instruction/data to character.

If this command affects another operand, try to use
 @0:731[Enter #th operand manually] commands.

See also
 @0:926[Edit|Text|Operand types] submenu.ÑWRAP
Immediate Operand -> Number ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeNumber
 Current hotkey: @<MakeNumber>

This command converts immediate operand(s) type of the
current instruction/data to hex number. So you can
delete @0:909[void] mark of the item.

If this command affects another operand, try to use
 @0:731[Enter #th operand manually] commands.

See also
 @0:926[Edit|Text|Operand types] submenu.ÜWRAP
Make Current Byte as a Variable ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeVariable
 Current hotkey: @<MakeVariable>

This command mark/unmarks the current byte as variable.
Variable bytes have asterisk (*) in the beginning
of the line.

Use it only for your purposes only. IDA ignores
these marks, but creates them for your convenience.

See also
 @0:926[Edit|Text|Operand types] submenu.αWRAP
Immediate Operand -> Segment ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeSegment
 Current hotkey: @<MakeSegment>

This command converts immediate operand(s) type of the
current instruction/data to segment base.

If IDA can't find a segment with the immediate operand's
value, it simply displays it as hex number.

If this command affects another operand, try to use
 @0:731[Enter #th operand manually] commands.

See also
 @0:926[Edit|Text|Operand types] submenu.fWRAP
Immediate Operand -> Offset (base DS) ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeOffset
 Current hotkey: @<MakeOffset>

This command converts immediate operand(s) type of the
current instruction/data to offset by DS.

If current DS value is unknown (or equal 0xFFFF) IDA
will warn you -- beep at you. In this case you should
define DS register value for the current byte. The
best way to do it:
  - @0:835[jump to segment register change point]
  - @0:866[change value of DS]
  - @0:902[return]

or you can @0:867[change default value] of DS for the current
segment.

If you want to delete offset definition, you can use
this command again - it works as trigger. When you delete offset, IDA also
deletes @0:731[manually] entered operands - you are warned.

See also: @0:938[offset by current segment]
          @0:729[any offset]
          @0:926[Edit|Text|Operand types] submenu.

If this command affects boths operands of the instruction, IDA automatically creates a manual
operand for one of the operands so that only one operand will be affected.
See @0:731[Enter #th operand manually] commands.VWRAP
Immediate Operand -> Offset (base CS) ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MakeOffsetCs
 Current hotkey: @<MakeOffsetCs>

This command converts immediate operand(s) type of the
current instruction/data to offset by CS.

See also: @0:937[offset by data segment/no offset]
          @0:729[any offset]
          @0:926[Edit|Text|Operand types] submenu.

If this command affects boths operands of the instruction, IDA automatically creates a manual
operand for one of the operands so that only one operand will be affected.
See @0:731[Enter #th operand manually] commands.úWRAP
Move a Segment ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: MoveSegment
 Current hotkey: @<MoveSegment>

There are 2 commands to change segment boundaries:
        - move a segment (this command)
        - @0:794[edit segment] command

The difference between them is simple: _changing_ segment bounds
doesn't affect other segments while _moving_ a segment may change
adjacent segments too.

Moving a segment means moving its beginning. So, the proper name
for this command would be 'Expand/Shrink a Segment' (due to
historical reasons the name is 'move segment'). First you
choose a segment by dropping the @0:105[anchor] anywhere in the segment.
After you go to the desired new beginning of the segment and
call this command. IDA will try to shrink/expand previous
segment in order to move the beginning of the selected segment.
Of course you can't move start of the segment 'too far':
  - the segment should have at least 1 byte
  - start address of the segment should be less than end of segment
  - no other segments can be killed during moving
  - segment can't have bytes with negative offset

You cannot shrink a segment to 0 bytes. A segment must have
at least 1 byte. You can use this instead of deleting segments.

Mainly this command is used when IDA doesn't detect boundary
between segments correctly.

Sometimes
IDA creates 2 segments where only
one segment should exist. In this case you shouldn't use this command.
Use the following sequence instead:
        - @0:795[delete] one segment. Choose one with bad segment base value.
          Don't disable addresses occupied by the segment being deleted.
        - change bounds of another segment.

See also @0:951[Edit|Segments] submenu.ÑWRAP
Show Registers ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ShowRegisters
 Current hotkey: @<ShowRegisters>

This command displays segment register contents in the messages window.
If the messages window is hidden beyond other windows, the screen will
not change.

Usually I use this command for screen refreshes, because
it is fast and does no harm.

See also @0:950[Edit|Registers] submenu.
         @0:947[View] submenu.gWRAP
Disable/Enable AutoAnalysis Display ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ToggleAutoShow
 Current hotkey: @<ToggleAutoShow>

This command enables or disables auto @0:724[analysis] display.
The display
is located in the upper right corner of the screen, near the timer.

 AU:??????    AutoAnalysis indicator. This indicator represents
              the state of AutoAnalysis. Possible values of
              this indicator are presented below:
"           "  the indicator is turned off. This command turns
               on/off this indicator.
 AU:▒░idle░▒   AutoAnalysis is finished.
 AU:disable    AutoAnalysis is disabled.
 AC:<address> the code analysis goes through the noted address
 PL:<address> the code analysis is planned through the noted address
 ??:<address> the noted address becomes unexplored

See also
 @0:948[Options] submenu.≡WRAP
Dump/normal View ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ToggleDump
 Current hotkey: @<ToggleDump>

This command switches the current window mode:
dump view and normal view. At the start, all windows are in the normal mode,
so you can see instructions and data. When you are in the dump mode, no
instructions or data is displayed. All bytes of the program will be dumped
on the screen as plain bytes and in ASCII. This command may be useful
when you want to find something in the program using your eyes.
Don't forget that
many commands continue to work. For example, you
can use binary @0:739[search] command.

A mode is a feature of a window, so you can open many windows
and in each of them set its own mode.

See also
 @0:948[Options] submenu.═WRAP
Show Internal Flags ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: ShowFlags
 Current hotkey: @<ShowFlags>

This command displays internal flag values for the current byte.

See also @0:947[View] submenu.eWRAP
Navigate submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This submenu allows fast access to desired address
or item in the file. You can search for things,
jump to specified addresses etc.

 @0:905[Jump to...] submenu
 @0:906[Search for...] submenu
 @0:902[Return] command

 @0:907[Set direction for searches]
 @0:908[Mark position]

See also @0:896[Menu Bar] submenus.GWRAP
Edit submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀

This submenu allows to modify text representation
and to patch the file.
Also, here you'll find commands to control program
analysis. There are the following commands:

 @0:920[instruction]
 @0:921[data]
 @0:922[ascii]
 @0:728[array]
 @0:918[undefine]

 @0:863[Jump Table]
 @0:865[Links]

 @0:737[Rename]

 @0:926[Operand types] submenu
 @0:925[Comments] submenu

 @0:949[Text] - affect disassembled text only
 @0:950[Registers] - Emulated registers
 @0:951[Segments]
 @0:952[Patch program]
 @0:963[Edit file]

See also @0:896[Menu Bar] submenus.│WRAP
Windows submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Here you can manipulate with windows on the screen.
I think that you don't need help on this topic?

See also @0:896[Menu Bar] submenus./WRAP
View submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀

All sorts of information.

  @0:745[View File]
  @0:746[Calculator]
  @0:940[View general registers]
  @0:742[Open segment registers window]
  @0:743[Open segments window]
  @0:744[Open names window]
  @0:943[View internal flags]

See also @0:896[Menu Bar] submenus.7WRAP
Options Submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 @0:967[Text representation]
 @0:965[Cross references representation...]
 @0:966[Assembler directives...]
 @0:961[Names representation]
 @0:985[ASCII style]

 @0:942[Dump/normal View]
 @0:747[Processor type]

 @0:924[Auto analysis]

See also @0:896[Menu Bar] submenus.óWRAP
Edit|Text Submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Here you can change text representation of the program:
add comments, set indents, set alternative strings
for operands etc.

 @0:737[Rename]
 @0:738[Rename any address]
 @0:927[Make procedure]
 @0:928[Make end of procedure]
 @0:731[User-defined operand]
 @0:987[Set Ascii break char]
 @0:979[Indention of program code]
 @0:981[Tabulation]

See also @0:945[Edit] submenu.,WRAP
Edit|Registers submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Here you can inspect and change emulated register values.

 @0:867[Set default segment register value]
 @0:866[Change segment register value]
 @0:940[Show general register]
 @0:742[Open segment registers window]

See also @0:945[Edit] submenu.[WRAP
Edit|Segments submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 @0:793[How to create a new segment]
 @0:795[How to delete a segment]
 @0:794[How to change segment attributes]
 @0:939[How to move a segment start]
 @0:832[How to change segment translation]

See also:
 @0:798[How to choose a segment]
 @0:833[How to jump to a segment]
 @0:945[Edit] submenu.WRAP
Edit|Patch core  submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This submenu gives the way of quick patching of the file.
You can easily modify executable file and get a modified version
of the executable file.

 @0:875[Patch core]
 @0:872[Produce EXE file]

See also @0:945[Edit] submenu.äWRAP
Jump to the Chosen Name ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: JumpName
 Current hotkey: @<JumpName>

You can choose a byte name to jump to.
IDA will display a list of names (sorted by addresses)
and you can choose a name to jump to.
@0:961[Dummy] names (generated by IDA) are not listed.

See also @0:905[Navigate|Jump to...] submenu.
         @0:129[How to use the lister].nWRAP
File|Produce output files  submenu ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This submenu allows you to produce ASM, MAP and EXE files.
It also allows you to unload the database.

 @0:868[Generate MAP file]
 @0:870[Generate ASM file]
 @0:871[Generate LST file]
 @0:872[Generate EXE file]
 @0:869[Unload database]

See also @0:895[other File... submenu] commands.┼WRAP
Repaint Desktop ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: Repaint
 Current hotkey: @<Repaint>

This command allows you to repaint the IDA screen.

See also @0:895[other File... submenu] commands.<WRAP
Exit IDA ▄
 ▀▀▀▀▀▀▀▀▀

 Action    name: Quit
 Current hotkey: @<Quit>

This command terminates the current IDA session. IDA will
write all changes to the disk and will close all databases.

You can enable/disable database packing. When the database is packed,
it consists of one file (with IDB extension). When the database is not
packed, it consists of several files on the disk, but IDA exits quickly.
Also, if packing is disabled, in the next session you can't @0:957[abort] IDA.

IDA will remember all information about the screen, cursor
position, jumps stack, etc.
The following information
will be lost:

        @0:104[keystroke macros],
        @0:105[anchor] position

Next time you can @0:958[call] IDA simply:

        >ida file

See also @0:895[other File... submenu] commands.
         @0:957[Abort] command.aWRAP
Abort IDA ▄
 ▀▀▀▀▀▀▀▀▀▀

 Action    name: Abort
 Current hotkey: @<Abort>

This command terminates the current IDA session.
It doesn't work if the database was not packed.

        IDA will NOT save changes to the disk.
        ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

See also @0:895[other File... submenu] commands.
         @0:956[Quit] command.æWRAP
IDA command line switches ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

IDA is started with the following command line:

        ida file

If may specify a file mask instead of file name.

  where switches:

 -h     this screen
 -a     disable @0:724[auto analysis]
 -i#### program entry point (hex)
 -b#### loading address (hex)
 -c     disassemble a new file (kill old database)
 -p#### @0:747[processor type]
 -R     load MS Windows exe file resources
 -W###  specify MS Windows directory
 -x     don't create segmentation
        (used in pair with @0:869[Unload] command)
        this switch doesn't affect NE format files.
 -n     don't load New Executable (or LX) Format files
 -d     debug
 -f     disable FPP instructions
 -P+    pack database
 -P-    don't pack database (see @0:957[Abort] command)
 -M     disable mouse
 -S###  execute IDC file. Note that IDA always executes IDA.IDC
        file if it exists.
WRAP
Database Is Empty ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Although the database exists, it is empty.
Delete it and start again.

If you have previously saved your database into a text file,
you can load it. See @0:869[Unload] command for explanations.

See also @0:958[IDA usage help]ⁿWRAP
Illegal Usage of the Switch ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Not all switches can be used when you
start IDA the second or more times.
Below are valid switches:

 -a     disable @0:724[auto analysis]
 -d     debug

See also @0:958[IDA usage help]WRAP
Names Representation ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Action    name: SetNameType
 Current hotkey: @<SetNameType>

Dummy names are automatically generated by IDA. They are used to denote
subroutines, program locations and data.

Dummy names have various prefixes depending on the item type and value:

  sub           instruction, subroutine start
  locret        'return' instruction
  loc           instruction
  off           data, contains offset value
  seg           data, contains segment address value
  asc           data, ascii string
  byte          data, byte (array)
  word          data, 16-bit (array)
  dword         data, 32-bit (array)
  qword         data, 64-bit (array)
  tbyte         data, 10-byte (array)
  unk           unexplored byte

You can change postfix of dummy names.
IDA supports several types of dummy names:

  0     loc_0_1234     segment base address relative to program base address
                       & offset from the segment base
  1     loc_1000_1234  segment base address & offset from the segment base
  2     loc_dseg_1234  segment name & offset from the segment base
  3     loc_0_11234    segment relative to base address & full address
  4     loc_1000_11234 segment base address & full address
  5     loc_dseg_11234 segment name & full address
  6     loc_12         full address
  7     loc_0012       full address (at least 4 digits)
  8     loc_00000012   full address (at least 8 digits)
  9     dseg_1234      the same as 2, but without data type specifier
 10     loc_1          enumerated names (loc_1,loc_2,loc_3...)

If you have selected names type 10 (enumerated names), you may
renumber them using a checkbox. The process is relatively fast, sirprisingly.

I think that the best representation for MS DOS programs is #0,
for 16-bit processors - #7, and for 32-bit processors - #8.
You can change dummy names type any time when you want.

Also, here you can set maximal length of new names.

See also:
  @0:737[Rename] command
  @0:738[Rename any address] command
  @0:948[Options] submenubWRAP
IDA Registration ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

WHY REGISTER?

        * all versions
                  the registration entitles you
                  to use all future versions of IDA (sic!)

        * key file
                  you'll receive a unique key file
                  which enables ALL features of IDA.

        * information
                  if you want, you will receive
                  information about new versions
                  (fidonet or internet).

        * moral
                  you will have clear conscience :)

Please see documentation for information how to register.
Thanks!uWRAP
Edit File ▄
 ▀▀▀▀▀▀▀▀▀▀

 Action    name: EditFile
 Current hotkey: @<EditFile>

Here is a built-in text editor in IDA. You may use it to edit small files.
(I never tested it on big files). All @0:964[keys] are usual...

You can view files of arbitrary size using @0:745[ViewFile]
command.

See also  @0:964[How to use the file editor]
          @0:945[Edit] submenu.äWRAP
How to use The File Editor ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 You can use the following keys in the file editor:

 Ctrl-Q F       Search                  Shift-<arrow>   Select
 Ctrl-L         Search Again            Ctrl-K B        Start Select
 Ctrl-Q A       Replace (no prompts)    Ctrl-K H        Hide Select
 Ctrl-U         Undo                    Ctrl-Ins        Copy
                                        Ctrl-Del        Clear
 Ctrl-Left      Word Left               Shift-Ins       Paste
 Ctrl-Right     Word Right              Shift-Del       Cut
 Ctrl-PgUp      Text Start
 Ctrl-PgDn      Text End                Ctrl-Y          Delete Line
                                        Ctrl-Q H        Delete Line Start
 Ctrl-O         Indent Mode             Ctrl-Q Y        Delete Line End
                                        Ctrl-T          Delete Word

When you close this window using 'WindowClose' command (hotkey @<WindowClose>),
IDA will ask you to save the file if it was modified. No backup files will
be created.

Don't forget that you can use the clipboard.

You can view files of arbitrary size using
@0:745[View File]
command.èWRAP
Cross References Dialog ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This command changes the representation of cross references.
Here you can change value of the following checkboxes/input fields:

 @0:972[Cross references display]
 @0:973[Segments in cross references display]
 @0:984[xref depth]

 Also, you can change right margin for lines with cross references.

 See also
 @0:948[Options] submenu.|WRAP
Assembler Directives Dialog ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This command enables/disables generation of some assembler directives,
namely:

        assume directive
        origin directive

Sometimes (when you don't intend to assemble the output file), you may want
to disable their generation.

You can change these settings any time.

 See also
 @0:948[Options] submenu.ÆWRAP
Text Representation Dialog ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This command changes the look of disassembled text.
Here you can change value of the following checkboxes/input fields:

 @0:968[Line prefixes display]
 @0:969[Binary line prefixes]

 @0:970[Segment names display]
 @0:971[Segment addresses display]

 @0:979[Instructions indention]
 @0:980[Comments indention]

 @0:974['void' marks display]
 @0:976[Repeatable comments display]
 @0:975[Automatic comments display]
 @0:977[Empty line display]
 @0:978[Borders display]
 @0:982[Bad instructions display]
 @0:981[Use tabulation character]

 @0:983[void limits]

 See also
 @0:948[Options] submenu.*Disable/Enable Line Prefixes Display ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This checkbox enables or disables line prefixes display.
Line prefix is the address of the current byte:

 3000:1000      mov ax, bx
 ^^^^^^^^^
See also
 @0:969[Binary line prefixes]
 @0:967[Text Representation Dialog]òWRAP
Disable/Enable Binary Line Prefixes ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Here you specify number of bytes in the binary prefix to display
on one line of the listing.
Binary line prefix is shown below:

 3000:1000 55           push    bp
           ^^^^^^^^^

The binary prefix contains the assembled code of the current instruction.
Sometimes there is not enough place to display all bytes of an item (of large
array, for example). In this case IDA will display just a few first bytes
of the item. By default IDA shows 8 bytes per line.
You can specify numbers from 0 to 16.

See also
 @0:968[Line prefixes display]
 @0:967[Text Representation Dialog]vWRAP
Disable/Enable Segment Names Display ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This checkbox enables or disables segment names display.
If enabled, IDA will use segment name in all addresses.
If disabled, IDA will use segment bases.

Example (codeseg has base 3000):

   Enabled:     codeseg:0034
   Disabled:    3000:0034

See also
 @0:967[Text Representation Dialog]&Disable/Enable Segment Addresses Display ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 Using this checkbox you can disable segment addresses in the
 listing. IDA will show only offsets.

Example:

   Enabled:     codeseg:0034
   Disabled:    0034

See also
 @0:967[Text Representation Dialog]ìWRAP
Cross-references Display ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

IDA maintains cross-references automatically. Of course, when IDA start to
disassemble a new file the cross-references will not appear immediately,
they will be collected during background @0:724[analysis].

Using Cross References @0:965[Dialog] you can
enable or disable cross-references display.

See also
      @0:865[Link] commands."WRAP
Segments Cross-references Display ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This checkbox enables or disables segments in cross references:

                ; CREF: 3000:1025       - enabled
                ; CREF: 1025            - disabled

See also
 @0:967[Text Representation Dialog]¢'void' Marks Display ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀


This command enables or disables @0:983[void] marks display.

See also
 @0:967[Text Representation Dialog]êWRAP
AutoComments Display ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

AutoComments are predefined comments for all instructions.

If you forgot meaning of a certain command, you can use
this command to get comments to all lines of the screen.

IDA doesn't give comments to very simple instructions such as
'mov' instruction
and doesn't override existing comments.

See also
 @0:967[Text Representation Dialog]öWRAP
Repeatable Comments Display ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This command enables or disables
@0:736[Repeatable comments] display.

The repeatable comment will be displayed by IDA when the current item hasn't
a @0:735[regular] comment and the current item refers to an item
with a repeatable comment or the current item itself has a repeatable comment.

See also
 @0:967[Text Representation Dialog]÷WRAP
Empty Lines Display ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This command enables or disables empty lines display.

Useful to decrease number of blank lines on the screen
increasing amount of information on it.

See also
 @0:967[Text Representation Dialog]éWRAP
Border Lines Display ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This command enables or disables border lines display.

Useful to decrease number of border lines on the screen
increasing amount of information on it.

Border line:
 ;---------------------------------------------------------

is generated automatically by IDA to separate data and code.

See also
 @0:967[Text Representation Dialog])Change Indention of Text ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

You can change indention of disassembled instructions:

                mov ax, bx
<-------------->
   indention


This can be a great help when you are going to produce
a large disassembled text.

See also @0:967[Text Representation Dialog]WRAP
Change Indention of Comments ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

You can change indention of comments:

        mov ax, bx                      ; this is a comment
<-------------------------------------->
               indention


See also @0:967[Text Representation Dialog]≤WRAP
Enable/Disable Tabulations ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

You can disable tabulation symbols (0x09) in the
output file if you don't like them.

By default, IDA produces output files with tabulations.

See also @0:949[Edit|Text] submenu.ÑWRAP
Bad Instructions Display ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

Some assemblers don't understand some instructions even if they should to.
For example, processor Z80 has several undocumented instructions and many
assemblers fail to eat them. IDA knows about this fact and tries to produce
an output that can be compiled without errors, so it replaces such instructions
with data bytes.

The problem is more severe with Intel 80x86 processors: the same instruction
can be coded differently. There are 2 operation codes for ADD instruction e t.c.
The worst thing is that the different operation codes have different lengths.
If the assembler used to compile a file and your assembler produce different
operation codes, you may obtain completely different output files.

That is why IDA marks such instructions as <BAD> and replaces them with
data bytes.

However, you can disable this feature of IDA (if you don't intend to recompile
the file these marks simply annoy you).

Example:

   Enabled:
                db 0Fh,86h,7Eh,0,0,0 ; <BAD> jbe     loc_0_205
                db 0Fh,82h,78h,0,0,0 ; <BAD> jb      loc_0_205
                db 0Fh,83h,72h,0,0,0 ; <BAD> jnb     loc_0_205
   Disabled:
                jbe     loc_0_205
                jb      loc_0_205
                jnb     loc_0_205

The Borland's TASM 4.0 was the assembler which I used to decide whether
the instruction is bad or not.

See also
 @0:967[Text Representation Dialog]8WRAP
Low & High Offset Limits ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

IDA marks some instructions with 'void' marks. Doing so IDA asks you
to pay attention to these instructions.

Two values control 'void' marks generation.  An item is 'void' if
it has an immediate value as operand or part of operand and this
immediate value is between low and high 'voids' limits. The comparison
is always unsigned, i.e. in the instruction

        mov ax,[bp-2]

  the immediate operand is 0xFFFE, not -2.

See also @0:967[Text Representation Dialog]
         @0:124[How to Enter a Number].WRAP
Maximal Depth For Tail Bytes Lookup ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This value controls @0:972[cross references] displaying.
 It means
 'how many bytes of an object to look at
        to collect cross references'.

For example we have an array:
        A       db 100 dup(0)

If some instruction refers to the 5-th element of the array:
        mov     al,A+5

 with TD=3      we'll have no xrefs displayed
 with TD=10     we'll have this xref

See also @0:967[Text Representation Dialog]
         @0:124[How to Enter a Number].╤WRAP
ASCII strings style dialog ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

 This dialog deals with ASCII string settings.
 Here you can setup:

        @0:989[strings style]
        automatically generated @0:986[serial names]

        symbol to @0:987[break] ASCII string
        symbol to @0:988[force] start of next line

 Here you specify prefix for automatically generated names.

 Also you can disable automatic generation of names.

See also:
 @0:948[Options] submenu.½WRAP
ASCII String Serial Names ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

IDA can generate serial names for ASCII strings, i.e.

        pref_001,pref_002,pref_003 etc...

You should enable serial names generation, specify
prefix for names,starting serial number and number of leading zeroes.

Each time you @0:922[create] an ASCII string, IDA generates
a new serial name and assigns it to the string.

See also @0:985[ASCII style Dialog]zWRAP
ASCII String Break Symbol ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This symbol forces IDA to stop scanning for the end of the
ASCII string when a new string is being
created.
IDA ends new string by '\0' and '$' symbols
also.

See also:
 @0:988[ASCII Next Line Symbol]
 @0:922[Convert to ASCII]
 @0:949[Edit|Text] submenu.
 @0:985[ASCII style Dialog].
 @0:124[How to Enter a Number].4WRAP
ASCII Break Symbol ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

This symbol forces IDA to start a new
line when it displays ASCII string on the
screen. By default, it equals to '\n'.

See also:
 @0:987[ASCII String Break Symbol]
 @0:922[Convert to ASCII] command
 @0:985[ASCII style Dialog].
 @0:124[How to Enter a Number].\WRAP
ASCII String Style ▄
 ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

There are 2 string styles: Pascal and C.
 C-style:
   all strings are terminated by '\0'.
 Pascal-style:
   all strings have:
     first byte - length
     other bytes - string itself.

All new strings
will br created with the chosen style.

Default is C-style.

See also @0:985[ASCII style Dialog].╤f1f33a56f38ecf2346439d5ad729f7ecf9f43ac4f9f03a8ead0c9055258194237a955650279b9525b419cd218ad0b40ecd21fec8a2c204be80008a0c32ed0bc97503e9890046e89e02e8a202720ea0c5042206c6047502eb75e98300817c013a207415817c013a0d740e803ec404007538c606c40401eb31803ec60400754fc606c604ff803ec404007505c606c404028a04e867022c413a06c2047606ba7405e90302a2c30446eb9c803ec50400751ec606c504ff8936c80446e831027307803c207402ebf38936ca044ee977ffba2106b409cd21ba7406b409cd21e9e901e8cf027306ba3005e9M@0:962[]
This feature works only in the registered version. Please register.@0:744[]
Names window(@0:897[]
Select additional file to loadEThese was no packed version of database, so changes can't be undone.Un/compression error!+Pascal style overlays file '%s' not found."Please enter pascal overlays file├@0:402[]
Load file

  File name: %A

  Load as
  <~D~etected format:R> (%A)
  <~B~inary file:R>>
  
  <Loading ~o~ffset:N:16:10::> (only for binary)

  <~C~reate segments:C>> (only for binary)

>File read error at %08lX (may be bad PE structure), continue?<Can't find translation for virtual address %08lX, continue?5; Format           : Portable Executable Format (PE); Created at       : %s$; CPU              : (%04X) unknown(; CPU              : (%04X) Intel 80386(; CPU              : (%04X) Intel 80486(; CPU              : (%04X) Intel 805867; CPU              : (%04X) MIPS Mark I (R2000, R3000)1; CPU              : (%04X) MIPS Mark II (R6000)2; CPU              : (%04X) MIPS Mark III (R4000)&; CPU              : (%04X) DEC Alpha$; Subsystem        : Unknown (%04X); Subsystem        : Native!; Subsystem        : Windows GUI'; Subsystem        : Windows Character$; Subsystem        : OS/2 Character%; Subsystem        : Posix Character; Flags (%08lXh)
+;                    Reversed bytes (Hi).
%;                    Library image.
#;                    System file.
/;                    Debugging info stripped.
+;                    32-bit word machine.
+;                    Reversed bytes (Lo).
+;                    16-bit word machine.
';                    (Update Object).
(;                    (Minimal Object).
.;                    Local symbols stripped.
-;                    Line numbers stripped.
+;                    Image is executable.
0;                    Relocation info stripped.
; DLL flags (%04Xh) :% Per-Process Library Initialization." Per-Process Library Termination.$ Per-Thread Library Initialization.! Per-Thread Library Termination.C; OS version: v%d.%d User: v%d.%d Subsystem: v%d.%d Linker: v%d.%d<; Object alignment: %08lX (%7ld.), File algn: %08lX (%7ld.)<; Stack reserved  : %08lX (%7ld.), commited : %08lX (%7ld.)<; Heap  reserved  : %08lX (%7ld.), commited : %08lX (%7ld.)"; Entry point     : %08lX (%08lX)N;----------------------------------------------------------------------------&; Section %d. (virtual address %08lX)0; Virtual size                  : %08lX (%7ld.)0; Section size in file          : %08lX (%7ld.)(; Offset to raw data for section: %08lX; Flags %08lX:	 Regular Dummy Noload	 Grouped	 Padding Copy Text Data Bss Exception	 Comment	 Overlay Lib Loader Debug Type check
 Overflow
 Discardable Not cachable Not pageable Shareable Executable
 Readable
 Writable; Alignment     : 1 byte; Alignment     : 2 bytes; Alignment     : 4 bytes; Alignment     : 8 bytes; Alignment     : 16 bytes; Alignment     : 32 bytes; Alignment     : 64 bytes&; Alignment     : 16 bytes by defaultReading exports directory...
; Exported entry %3d. %s; Unnamed exported entry %3ld.ZIDA has found unpacked version of database (%s) on the disk. Do you want to overwrite it?