What exactly is a Netnode? What are they used for and how can I manipulate them with IDC or the SDK?

1 Answer 1


The online IDA SDK has an excellent description: https://www.hex-rays.com/products/ida/support/sdkdoc/netnode_8hpp.html

An IDA database is one large table of key/value pairs. All keys associated with a single address together form a netnode.

There are two kinds of netnodes:

  • related to addresses associated with the binary loaded in ida.
  • for internal items, these are used to store structs, stack-frames, enums, scripts, etc.

These internal items usually have addresses which start with 0xFF0.... Because of this it can be a bit of a challenge to reverse engineer binaries which happen to use that address range.

A list of items which are stored in netnodes can be found in netnode.hpp and nalt.hpp

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.