11

IDA's functions window, the window that lists all functions identified by IDA, has several columns represented by a single letter/character each. See example in attached picture.

The characters are: R, F, L, S, B, T and =

functions window example

What is the meaning of each column/character?

12

Every column value can be either a dot or the same column character. Those columns are boolean and the column character stands for "True" while the dot stands for "False".

  • R stands for "Returns" and is True (has an "R" in the column's value instead of a dot) if the function returns. Functions may not return and this requires special handling by IDA and the reverse engineer.
  • F stands for "Far" and is true for functions that are far functions, or false otherwise.
  • L stands for "Library" function, and is true for functions IDA recognised as library functions (usually using FLIRT).
  • S stands for "Static" function.
  • B stands for a E/R/BP stack frame based function. As part of IDA's analysis functions that use the xBP register for easier stack access are marked so.
  • T stands for Type and indicates whether a function has type information assigned. Either manually or automatically by IDA using FLIRT.
  • the equal sign (=) indicates the frame pointer is equal to the initial stack pointer.

All of those values can be manually accessible using the "Edit function" dialog (alt+p), like seen here:

IDA edit function dialog

This is also documented and can be found at Hex-Rays website, with a shorter explanation.

Additionally, according to Arnaud Diederen:

since 7.1, IDA also provides tooltips for those arguably cryptic single-letter columns. Just hover your mouse over the column header for a couple seconds, and the tooltip should appear.

  • 1
    shortcut is actually Alt-P, at least on Windows. – Igor Skochinsky Jun 4 '18 at 21:10
  • 4
    Since 7.1, IDA also provides tooltips for those arguably cryptic single-letter columns. Just hover your mouse over the column header for a couple seconds, and the tooltip should appear. – Arnaud Diederen Jun 5 '18 at 5:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.