IDA Pro > IDA Pro教程 > 技术问题 > IDA Pro Proximity view( Proximity view)

IDA Pro Proximity view( Proximity view)

发布时间:2022-10-15 10: 36: 07

  Starting from IDA v6.2,the callgraph of a program can be displayed in a graph form.

 In the proximity view,the current address,the callers and the callees are represented as a collection of nodes linked together with edges.Nodes represent functions and data references(global variables,strings,etc..)and edges represent code or data cross-references between them.

 To open the proximity view press the'-'key to zoom out and switch to the callgraph of the address under cursor.

 Only the address names(function names or data labels)are displayed in the proximity view,but not the disassembly,nonetheless,hovering the mouse over a node will display brief disassembly listing in a resizable hint window.To see the complete disassembly listing switch to text or graph mode by pressing'+'or Space respectively.

 When disassembling new files,IDA will display a dialog offering to switch to proximity view when applicable.It is possible to turn off this dialog and not show it again.

 In the proximity view there are 3 types of nodes:Function nodes,data nodes and auxiliar nodes.Function nodes are rectangular and they have a toolbar.Those nodes are used to display the callers or callees of the current central node(or any of his parents or children).Data nodes are rectangular nodes(without a toolbar)and they are used to display the data references(global variables,strings,etc...)to/from the current central node or any of his parents and children.

 Please select one of the following topic to learn more about graphs:

 Selections in graphs

 Many graph operations are applied to the selected nodes.The current node is considered to be part of the node selection for all operations.

 The graph nodes can be selected using the mouse.To select many nodes at once,press and hold the Ctrl key during the mouse operation.The Alt key removes nodes from the current selection.

 Internally,IDA keeps track of the selected nodes and edge layout points.Edge layout points are the points where edges are bent.If the current selection is moved in the graph,the selected edge layout points are moved too.

 The default color for the title of the selected nodes is light gray.Other node titles are displayed with white color.

 Zooming graphs

 The graph can be zoomed in and out.There are several ways of zooming the graph:

 -Use Ctrl-Wheel.The current mouse position will be the zoom center

 point(i.e.this point will not move during the zoom operation)

 -Use the predefined'Zoom 100%'and'Fit window'commands.They are

 available from the right-click menu or by their shortcuts:'1'and

 'W'respectively.The current mouse position is the zoom center

 point for the'zoom 100%'command.

 -Use Ctrl-KeypadPlus or Ctrl-KeypadMinus keys.The current keyboard

 cursor is the zoom center for these commands.

 -Use Ctrl-Shift-drag.This lets you draw a rectangle to which IDA

 will zoom.

 There are two options linked to the graph zooming:

 -Auto fit graph to window:will fit the current graph to the window


 -Fit window max zoom level 100%:the'fit window'command does not

 use zoom levels higher than 100%.Default:on

 The zoom level is never greater than 1000%and less than 1%.IDA remembers the current zoom level for each location in the navigation history.

 Scrolling graphs

 The user can pan(shift)the graph by clicking with the left mouse button on the graph background and dragging it.In the rare case when there is no graph background visible on the screen,the Shift-click can be used to move the graph.This can happen on very high zoom levels,when the current node occupies the whole window.

 The mouse wheel scrolls the graph vertically.If the Alt key is pressed,it will scroll the graph horizontally.

 The Page Up and Page Down keys scroll the graph vertically.The keyboard arrows can scroll the graph if they reach the node border and cannot jump to another node in the specified direction.

 Scrolling the graph does not change the keyboard cursor position.As soon as the graph is refreshed on the screen,IDA will scroll the graph so that the keyboard cursor becomes visible.

 Graph overview window

 IDA has a small graph overview window.It displays the whole graph in the zoom out form and gives the user an idea about which part of the graph is visualized on the main window.

 Clicking on the graph overview window visualizes different parts of the graph in the main window.It is also possible to click and drag the focus frame-the main window will be refreshed accordingly.

 The graph overview window is visible only in the graph view node.As soon as another non-modal window gets focus,the graph overview is closed.It automatically opens when a graph view is activated.

 The graph overview is displayed by default.To hide it,right click on the main toolbar background and select Navigation,Graph overview menu item.

 The graph overview window can be resized to accommodate really huge graphs.

 Graph colors

 Graph edges can have several colors.In graph view:

 -Blue:a normal edge

 -Green:if the jump is taken(its condition is satisfied)

 -Red:if the jump is not taken

 -Blinking:when in the debugger,the edge that will be followed blinks

 And,in proximity view:

 -Blue:Code cross-reference edge

 -Gray:Data cross-reference edge

 IDA highlights the current mouse items.If the mouse is hovered over an edge,it is highlighted.If the mouse is hovered over a node,all adjacent edges are highlighted.To turn off the highlighting,specify the'current edge'color as an undefined custom color.

 The'highlighted edge'and'foreign node'colors are not used yet.

 Graph options

 Use graph view by default

 IDA switches to graph mode for each'jump'command.

 Enable graph animation

 Animate the graph layout,movement,and group collapsing/uncollapsing.

 While animation takes time,it gives the user some idea what's going on.

 Draw node shadows

 Display shadows for each graph node.Shadows are not displayed

 for really huge or ridiculously small nodes.

 Auto fit graph into window

 Zoom the graph so that it occupies the whole window.

 Fit window max zoom level 100%

 The'fit window'command maximal zoom level is 100%.

 Re-layout graph if nodes overlap

 IDA recomputes the graph layout if a node overlap is detected.

 The presence of a custom layout(if the user has displaced

 some graph nodes)effectively turns off this option.

 Re-layout graph uopn screen refresh

 IDA recomputes the graph layout at each screen refresh.

 Turning this option off accelerates IDA but then

 a manual layout might be required after some operations.

 Truncate at the right margin

 All nodes at truncated at the right margin.The right margin

 is specified in the Options,General,Disassembly tab.

 This option narrows the graph but hides some information

 by truncating long lines.

 Lock graph layout

 Locks the graph layout by ignoring attempts to displace

 nodes.This prevents the creation of custom layouts that might lead

 to ugly graph layouts when nodes change their sizes.


 Show data references

 Show data cross-referenced items in proximity view.

 Hide library functions

 Do not show data or code cross-references to library functions,

 only show cross-referenced local functions.

 Unlimited children recursion

 Recurse until there are no more callees(children)of the currently

 selected central node and all of his children.

 Recurse into library functions

 Displays children data or code cross-references from library


 Max parents recursion

 Maximum recursion level for displaying parents of the currently

 selected central node.The value'0'disables parents recursion.

 Max children recursion

 Maximum recursion level for displaying children of the currently

 selected central node.The value'0'means no maximum recursion


 Max nodes per level

 Maximum number of nodes to show per level of children and parents.


 Proximity view是IDA v6.2引入的一个功能,可以将程序的调用图以图形形式展示出来。当前地址、调用方和被调用方被表示为一组连接在一起的节点和边缘。节点代表函数和数据引用(全局变量、字符串等),边缘代表它们之间的代码或数据交叉引用。

 在Proximity view中,只显示地址名称(函数名称或数据标签),但不显示反汇编,然而,在节点上悬停鼠标会在一个可调整大小的提示窗口中显示简要的反汇编清单。要查看完整的反汇编清单,请按"+"或空格键分别切换到文本或图形模式。

 在Proximity view中有3种类型的节点:函数节点、数据节点和辅助节点。函数节点呈矩形,它们具有工具栏。这些节点用于显示当前中心节点(或其任何父节点或子节点)的调用方或被调用方。数据节点是矩形节点(没有工具栏),它们用于显示到/从当前中心节点或其任何父节点和子节点的数据引用(全局变量、字符串等)。


















 Page Up和Page Down键可以垂直滚动图形。如果键盘箭头到达节点边界并且不能跳转到指定方向的另一个节点,则可以滚动图形。
























































邀请您进入交流群 点击扫码


IDA Pro是一款功能强大的反汇编和反编译工具,广泛应用于逆向工程和软件开发领域。在使用IDA Pro时,如果我们不习惯英文界面,可以将其改为中文界面。本文将介绍IDA Pro怎么改为中文界面。IDA Pro界面改成中文主要有两种方法,下面是详细介绍。
ida如何转伪代码 ida伪代码怎么看
IDA Pro是一款常用的反汇编和反编译工具,可以帮助我们分析二进制文件的实现细节和执行过程,以便更好地理解程序的执行过程和逻辑。在进行逆向工程的过程中,我们经常需要将反汇编结果转换为伪代码,以便更好地进行分析和修改。本文将介绍如何使用IDA Pro转换为伪代码,并简单讲解ida伪代码怎么看。
idapro如何分段处理 ida软件反汇编如何添加插件
在软件逆向工程和代码分析中,IDA Pro是一款非常重要的工具。它提供了强大的反汇编和反编译功能,使得分析二进制代码变得更加高效和准确。在使用IDA Pro时,了解如何分段处理和添加插件可以极大地提升工作效率。本文将详细探讨idapro如何分段处理 ida软件反汇编如何添加插件,并分析IDA Pro是否容易学习和使用。
ida软件如何保障网络安全 idapro如何反汇编x86
ida软件如何保障网络安全 idapro如何反汇编x86,这些问题是现代网络安全领域中备受关注的核心议题。随着网络攻击和恶意软件的不断演变,保障网络安全和有效的反汇编技术变得尤为重要。IDA软件作为一款强大的逆向工程工具,通过多种技术手段保障网络安全,而IDAPRO则以其出色的反汇编功能,特别是在x86架构下的应用,成为广大安全专家和研究人员的利器。
逆向工程师和黑客的区别 为什么逆向工程师都在用ida软件
在信息安全和软件开发领域,逆向工程师和黑客是两个备受关注的角色。尽管两者都涉及代码分析和破解,但在职业目标、方法和道德规范上存在显著差异。同时,IDA软件作为逆向工程师的首选工具,其受欢迎的原因也值得探讨。本文将详细分析“逆向工程师和黑客的区别 为什么逆向工程师都在用ida软件”这一主题,并进一步介绍常用的逆向工程软件。
在软件分析和逆向工程领域,IDA Pro作为一款强大的反编译和反汇编工具,广泛应用于程序分析、代码破解、漏洞研究等方面。对于许多逆向工程师和安全研究人员来说,使用IDA Pro提取数据和字符串信息是常见的需求。本文将详细探讨“IDA怎么提取数据?”和“如何利用IDA反编译功能提取程序中的字符串信息?”这两个问题,并分析IDA Pro是否具有AI功能。
在软件开发和安全研究中,反汇编是一个重要的技术手段,通过反汇编,可以将二进制程序转换为汇编代码,从而了解程序的内部工作原理。IDA Pro是一款广泛使用的反汇编工具,它提供了强大的功能和灵活的接口,帮助研究人员深入分析程序结构。那么,怎么反汇编一个程序?通过IDA软件反汇编后如何进一步分析程序结构?本文将详细介绍这些问题,并探讨IDA Pro是否支持苹果M系列芯片。