Version Notes

This sheet is updated against the current Hex-Rays docs and IDA 9.3 release notes. IDA shortcuts are customizable in Options -> Shortcuts..., so treat this as the default/current map and verify local changes there.

Older shortcut sheets differ in a few places. In current docs, Ctrl+S is save, Q is jump to problem or hexadecimal depending on context, and Shift+F5 opens Signatures. It is not the decompiler shortcut.

High Signal Keys

ActionShortcut
Decompile current function / open pseudocodeF5
Toggle disassembly and pseudocodeTab
Produce a C file from selected functions or whole programCtrl+F5
Open Microcode viewCtrl+Shift+F8
Command paletteCtrl+Shift+P
Jump AnywhereCtrl+Alt+G
Jump to addressG
Jump by nameCtrl+L
Jump to functionCtrl+P
Cross-references for current operand/nameX
RenameN
Set typeY
Create functionP
Stack variablesCtrl+K
StringsShift+F12
FunctionsShift+F3
NamesShift+F4
Local TypesShift+F1
SignaturesShift+F5
BreakpointF2
Start / continue debuggerF9
Step into / step overF7 / F8
Run to cursorF4

F5 Family

ShortcutMeaning
F5Decompile the current function. In pseudocode, refresh the current decompilation.
TabJump between disassembly and pseudocode.
Ctrl+F5File -> Produce file -> Create C file, for selected functions or the whole program.
Shift+F5Open the Signatures subview. This is not decompile.
Ctrl+Shift+F5No documented default decompiler shortcut in the current official shortcut docs. Check Options -> Shortcuts... if a plugin or local config uses it.
Ctrl+Shift+F8Open Microcode view. In IDA 9.3, microcode became more interactive: Tab jumps to disassembly and Del toggles delete/restore for an instruction.

Command Palette

Use Ctrl+Shift+P for Options -> Show command palette.... It lists actions available in the current UI context and lets you fuzzy-search commands without memorizing every shortcut.

Use it for commands with no obvious default shortcut:

  • Show command palette
  • Open subviews
  • Create C file
  • Jump Anywhere
  • Move to folder
  • Lumina actions
  • Plugin actions

Use Options -> Shortcuts... to inspect, add, or reset bindings.

ActionShortcut
Jump to operandEnter
Jump in new windowAlt+Enter
Jump backEsc
Jump forwardCtrl+Enter
Jump to addressG
Jump AnywhereCtrl+Alt+G
Jump by nameCtrl+L
Jump to functionCtrl+P
Previous / next functionCtrl+Shift+Up / Ctrl+Shift+Down
Jump to segmentCtrl+S
Jump to segment registerCtrl+G
Jump to problemQ
Jump to entry pointCtrl+E
Xrefs for current operand/nameX
Mark positionAlt+M
Jump to bookmarkCtrl+M
Bookmarks windowCtrl+Shift+M
Toggle graph and linear viewSpace
Zoom out to proximity/callgraph view-

Jump Anywhere was introduced in IDA 9.2 and improved in IDA 9.3. It searches across addresses, functions, names, local types, and segments. IDA can also map it to G from Options -> Feature Flags..., depending on the version/configuration.

ActionShortcut
Search textAlt+T
Search next textCtrl+T
Search sequence of bytesAlt+B
Search next sequence of bytesCtrl+B
Search immediate valueAlt+I
Search next immediate valueCtrl+I
Next codeAlt+C
Next dataCtrl+D
Next exploredCtrl+A
Next unexploredCtrl+U
Search/filter many list viewsCtrl+F

Editing And Types

ActionShortcut
RenameN
Set typeY
Repeatable comment;
Regular comment:
Begin selectionAlt+L
Make codeC
Make dataD
Make stringA
Make array*
UndefineU
Insert line beforeIns
Insert line afterShift+Ins
Offset, data segmentO
Offset, current segmentCtrl+O
Offset, any segmentAlt+R
Offset, user-definedCtrl+R
Struct/union memberT
Stack variableK
HexadecimalQ
DecimalH
BinaryB
CharacterR
Enum memberM
Change sign_
Bitwise negate~
String literal optionsAlt+A
Setup data typesAlt+D
Edit segmentAlt+S
Change segment register valueAlt+G
Select union memberAlt+Y
UndoCtrl+Z
RedoCtrl+Shift+Z

For structs and function prototypes, Y is usually the fastest cleanup key. In IDA 9.3, Options -> General -> Misc -> Setting type renames target controls whether applying a renamed type also renames the target.

Open Subviews

SubviewShortcut
PseudocodeF5
MicrocodeCtrl+Shift+F8
Local TypesShift+F1
FunctionsShift+F3
NamesShift+F4
SignaturesShift+F5
SegmentsShift+F7
Segment RegistersShift+F8
StructuresShift+F9
EnumerationsShift+F10
Type LibrariesShift+F11
StringsShift+F12
Stack VariablesCtrl+K
Cross References TreeShift+X
BookmarksCtrl+Shift+M

Local Types in recent IDA builds has C type-name autocompletion. Use Ctrl+Space when editing a declaration.

Functions

ActionShortcut
Create functionP
Edit functionAlt+P
Set function endE
Stack variablesCtrl+K
Change stack pointerAlt+K
Rename registerV
Set typeY
Jump to current function startCtrl+P, Enter
Jump previous functionCtrl+Shift+Up
Jump next functionCtrl+Shift+Down

Decompiler Workflow

Use this loop for normal reversing:

  1. Find target function: Ctrl+P, Ctrl+L, G, Ctrl+Alt+G, or xrefs with X.
  2. Decompile with F5.
  3. Rename variables/functions with N.
  4. Fix types with Y.
  5. Create structs and apply members with T, K, and Local Types.
  6. Move between assembly and pseudocode with Tab.
  7. Export selected functions or the whole program with Ctrl+F5 only when you need a C file.
  8. Inspect hard cases with Microcode using Ctrl+Shift+F8.

In pseudocode:

ActionShortcut
Refresh current decompilationF5
Jump to matching disassemblyTab
Follow/decompile function under cursorEnter
Open target in new pseudocode windowCtrl+Enter or Ctrl double-click
Go back in pseudocode historyEsc
RenameN
Set typeY
Copy selectionCtrl+C

Microcode

Microcode is Hex-Rays’ intermediate representation between assembly and pseudocode. Use it when pseudocode hides too much or an optimization/obfuscation issue needs lower-level inspection.

ActionShortcut
Open Microcode viewCtrl+Shift+F8
Increase / decrease maturity level> / <
Jump to corresponding disassemblyTab
Delete / restore microcode instructionDel

IDA 9.3 added more interactive microcode work: assertions, instruction deletion with undo, flow graphs, def-use/use-def chain display, compact/detailed mode, value numbers, number origins, and persistent viewer state.

Debugger

ActionShortcut
Add/remove breakpointF2
Start / continue processF9
Terminate processCtrl+F2
Step intoF7
Step overF8
Run until returnCtrl+F7
Run to cursorF4
Breakpoint listCtrl+Alt+B
Stack trace / call stackCtrl+Alt+S

IDA 9.3 improves Android 14-16 native debugging and adds stack-view dereferencing. IDA 9.2 improved x86-64 PE call stacks using unwind info and refreshed the debugger register widget.

File And Windows

ActionShortcut
Parse C header fileCtrl+F9
Create ASM fileAlt+F10
Create C file from decompilerCtrl+F5
Save databaseCtrl+S
ExitAlt+X or Alt+F4
Windows list / next windowCtrl+Tab
Switch to window 1..9Alt+1..Alt+9
Close windowAlt+F3 or Ctrl+F4, depending on platform/config
Script commandShift+F2
Focus command line.
Leave command line / return focusEsc
Calculator?

Lumina

Current docs expose Lumina through the Lumina menu and command palette:

  • Pull all metadata
  • Push all metadata
  • View all metadata
  • Pull current function metadata
  • Push current function metadata
  • Revert current function metadata

Older PDF sheets commonly listed F12, Ctrl+F12, and Alt+F12 for Lumina actions. Since the current official shortcuts page does not list those as default bindings, verify Lumina shortcuts in Options -> Shortcuts... on the exact IDA install.

Pwndbg / IDA Integration

Modern pwndbg decompiler integration is installed from inside pwndbg:

di install ida
set integration-provider ida

Then open the same binary in IDA and the debugger. The integration lets pwndbg query IDA/Hex-Rays symbols and decompilation.

Useful debugger-side commands and helpers:

p/x $ida("main")
b *$ida("main")
b *$ida("sub_3C350")
decomp $pc
decomp *$ida("sub_3C350")
pwndbg ida
config ida

Older pwndbg notes may mention manually running ida_script.py or pwndbg-idascript.py from IDA. Prefer the current di install ida flow unless working with an older pwndbg checkout.

References