State-of-the-art binary code analysis tools

List views (also called choosers or table views) are used in many places in IDA to show lists of different kind of information. For example, the Function list we’ve covered previously is an example of a list view. Many windows opened via the View > Open subviews menu are list views:

  • Exports
  • Imports
  • Names
  • Strings
  • Segments
  • Segment registers
  • Selectors
  • Signatures
  • Type libraries
  • Local types
  • Problems
  • Patched bytes

Many modal dialogs from the Jump menu (such as those for listing Cross references) are also examples of list views. Because they are often used to select or choose one entry among many, they may also be called choosers.

List view can also be part of another dialog or widget, for example the shortcut list in the Shortcut editor. These are called “embedded choosers” in the IDA SDK.

All list views share common features which we discuss below.

Searching

Text search

You can search for arbitrary text in the contents of the list view by using AltT to specify the search string and CtrlT to find the next occurrence.

Incremental search

Simply start typing to navigate to the closest item which starts with the typed text. The text will appear in the status bar. Use Backspace to erase incorrectly typed letters and CtrlEnter to jump to the next occurrence of the same prefix (if any).

Columns

Each list view has column headers at the top. In most (not all) of them, you can hide specific columns by using “Hide column” or “Columns…” from the context menu.

Similarly to the standard list views in most OSes, you can resize columns by dragging the delimiters between them or auto-size the column to fit the longest string in it by double-clicking the right delimiter.

Sorting

The list view can be sorted by clicking on a column’s header. The sorting indicator shows the direction of sorting (click it again to switch the direction). Because IDA needs to fetch the whole list of items to sort them, this can be slow in big lists so a reminder with the text “Caching <window>…” is printed in the Output window each time the list is updated and re-sorted. To improve the performance, you can disable sorting by using “Unsort” from the context menu.

Filtering

A quick filter box can be opened by pressing CtrlF. Type some text in it to only show items which include the typed substring. By default it performs case-insensitive match on all columns, however you can modify some options from the context menu, such as:

  • enable case-sensitive matching
  • match only whole words instead of any substring
  • enable fuzzy matching
  • interpret the entered string as a regular expression
  • pick a column on which to perform the matching

Instead of a quick filter, you can also use more complicated filtering (“Modify Filters” from context menu, or CtrlShiftF). In this dialog you can not only include matching items, but also exclude or simply highlight them with a custom color.

Similarly to sorting, filtering requires fetching of the whole list which can slow down IDA, especially during autoanalysis. To remove any filters, choose “Reset filters” from the context menu.

See also: How To Use List Viewers in IDA