10

IDA's functions window, the window that lists all functions identified by IDA, has several columns represented by a single letter/character each. See example in attached picture.

The characters are: R, F, L, S, B, T and =

functions window example

What is the meaning of each column/character?

NirIzr
  • 11,765
  • 1
  • 37
  • 87

1 Answers1

13

Every column value can be either a dot or the same column character. Those columns are boolean and the column character stands for "True" while the dot stands for "False".

  • R stands for "Returns" and is True (has an "R" in the column's value instead of a dot) if the function returns. Functions may not return and this requires special handling by IDA and the reverse engineer.
  • F stands for "Far" and is true for functions that are far functions, or false otherwise.
  • L stands for "Library" function, and is true for functions IDA recognised as library functions (usually using FLIRT).
  • S stands for "Static" function.
  • B stands for a E/R/BP stack frame based function. As part of IDA's analysis functions that use the xBP register for easier stack access are marked so.
  • T stands for Type and indicates whether a function has type information assigned. Either manually or automatically by IDA using FLIRT.
  • the equal sign (=) indicates the frame pointer is equal to the initial stack pointer.

All of those values can be manually accessible using the "Edit function" dialog (alt+p), like seen here:

IDA edit function dialog

This is also documented and can be found at Hex-Rays website, with a shorter explanation.

Additionally, according to Arnaud Diederen:

since 7.1, IDA also provides tooltips for those arguably cryptic single-letter columns. Just hover your mouse over the column header for a couple seconds, and the tooltip should appear.

NirIzr
  • 11,765
  • 1
  • 37
  • 87