IDA Pro Cheat Sheet

Navigation

Key	Action
`G`	Jump to address
`Enter`	Follow jump / call
`Esc`	Jump back
`Alt+←` / `Alt+→`	Navigate history
`Ctrl+L`	Jump to name (label)
`Ctrl+P`	Jump to function
`Ctrl+S`	Jump to segment
`Ctrl+E`	Jump to entry point
`Ctrl+G`	Jump to offset in segment
`Space`	Toggle graph ↔ text view
`Tab`	Toggle disasm ↔ decompiler

Views & Windows

Key	Action
`Alt+1`	IDA View (disassembly)
`F5`	Open pseudocode window (decompiler)
`Shift+F5`	Signatures window
`Shift+F7`	Segments window
`Shift+F8`	Selectors window
`Shift+F9`	Structures window
`Shift+F11`	Functions window
`Shift+F12`	Strings window
`Alt+F4`	Exit
`Ctrl+W`	Close window
`Ctrl+Tab`	Next window

Naming & Comments

Key	Action
`N`	Rename (address, function, variable)
`;`	Add repeatable comment
`:`	Add regular comment
`Ins`	Add anterior line
`Shift+Ins`	Add posterior line
`Alt+M`	Mark position (bookmark)
`Ctrl+M`	Jump to bookmark
`Ctrl+;`	Edit comment (decompiler)
`Ctrl+K`	Edit function comment

Code & Data Definition

Key	Action
`C`	Convert to code
`D`	Convert to data
`A`	Convert to ASCII string
`U`	Undefine
`P`	Create function
`Alt+P`	Edit function properties
`E`	Mark as function end
`H`	Hex number representation
`Q`	Octal representation
`B`	Binary representation
`R`	Character representation
`M`	Enum member representation

Cross-References (Xrefs)

Key	Action
`X`	Xrefs to current address
`Ctrl+X`	Xrefs from current address
`Alt+I`	Xrefs to operand
`Ctrl+I`	Xrefs from operand
`Ctrl+J`	Jump to xref (when one exists)

Search

Key	Action
`Alt+B`	Search binary (bytes/pattern)
`Alt+T`	Search text
`Ctrl+F`	Search in decompiler
`Alt+I`	Search immediate value
`Ctrl+Alt+B`	Search binary sequence
`Alt+↑` / `Alt+↓`	Next/prev search result

Decompiler (Hex-Rays)

Key	Action
`F5`	Decompile function
`Tab`	Toggle decompiler ↔ disasm
`N`	Rename variable / label
`Y`	Set type (prototype)
`Ctrl+;`	Add comment
`/`	Comment in pseudocode
`H`	Toggle hex/dec
`M`	Apply enum to value
`Space`	Rename label at cursor
`Ctrl+F5`	Decompile whole program
`Alt+F5`	Refresh decompiler
`Ins`	Insert user-defined line
`X`	Xrefs to variable / call

Graph View

Key	Action
`Space`	Toggle graph ↔ text
`Ctrl+scroll`	Zoom in/out
`Ctrl+Shift+E`	Fit graph to window
`G`	Jump to address
`Alt+←`	Go back
`Enter`	Follow edge
`W`	Group nodes
`Ctrl+Shift+G`	Refresh graph

Structs & Types

Key	Action
`Y`	Set type at cursor
`T`	Apply struct offset
`Ctrl+K`	Edit stack frame
`Alt+S`	Add struct type
`Shift+F9`	Structures window
`Ctrl+Z`	Undo type change
`;`	Add struct member comment
`D`	Expand struct member

Patching

Key	Action
`F2`	Patch byte at cursor
`Alt+F2`	Patch word
`Ctrl+Alt+F2`	Patch dword
via menu	Edit → Patch Program → Change Bytes
via menu	Edit → Patch Program → Apply patches

Produce a patched binary: Edit → Patch Program → Apply patches to input file

Signatures & FLIRT

Key	Action
`Shift+F5`	Signature manager
via menu	File → Load File → FLIRT Signature

Common sig packs: vc32, vc64, gnulnx_x86, gnulnx_x64, mssdk

sigmake / pelf — build custom sigs from known libs

IDAPython Quickstart

# Current address
here()           # or idc.here()

# Read / write bytes
get_byte(ea)
patch_byte(ea, val)

# Names
get_name(ea)
set_name(ea, "my_func")

# Iterate function instructions
for ea in idautils.FuncItems(here()):
    print(hex(ea), idc.print_insn_mnem(ea))

# Iterate all functions
for f in idautils.Functions():
    print(hex(f), get_func_name(f))

# Xrefs to address
for ref in idautils.CodeRefsTo(ea, 0):
    print(hex(ref))

# Get/set comment
get_cmt(ea, 0)           # regular
set_cmt(ea, "note", 0)

Useful Plugins & Resources

Tool	Purpose
IDAGraf / Diaphora	Binary diffing
idat / idat64	Headless / batch mode
findcrypt	Crypto constant detection
BinDiff	Patch analysis / diffing
IDA MINSC	Python scripting helpers
HexRays Docs	Official reference

Batch decompile:

idat64 -A -Ohexrays:outdir/ target.exe

Memory Model Quick Reference

Segment	Typical contents
`.text` / `CODE`	Executable instructions
`.data`	Initialized globals
`.bss`	Uninitialized globals
`.rdata` / `.rodata`	Read-only data, strings, vtables
`.idata` / `.plt`	Import table / PLT stubs
`.edata`	Export table
`STACK`	Local variables (per frame)
`HEAP`	Dynamic allocations (runtime)

Calling Conventions (x86-64)

Convention	Arg registers	Callee-saved	Return
System V AMD64 (Linux)	rdi, rsi, rdx, rcx, r8, r9	rbx, rbp, r12–r15	rax (rdx)
Microsoft x64 (Windows)	rcx, rdx, r8, r9	rbx, rbp, rdi, rsi, r12–r15	rax
x86 stdcall	stack (right→left)	ebx, esi, edi, ebp	eax
x86 cdecl	stack (right→left), caller cleans	ebx, esi, edi, ebp	eax
x86 fastcall	ecx, edx, then stack	ebx, esi, edi, ebp	eax

Common IDA Color Codes (graph view)

Color	Meaning
Blue	Default / unvisited block
Red	False branch (jz not taken, etc.)
Green	True branch (jz taken, etc.)
Yellow / orange	Currently selected node
Grey	No successor (ret / jmp out)