LogoLogo
IDA 9.0
IDA 9.0
  • Welcome to Hex-Rays docs
    • What's new?
  • Getting Started
    • Install IDA
    • Licensing
    • Basic Usage
    • What's next?
  • User Guide
    • User Interface
      • Menu Bar
        • File
          • Load file
          • Script File
          • Script command
          • Produce output files
          • Invoke OS Shell
          • Take database snapshot
          • Save database
          • Save database as...
          • Abort IDA
          • Exit IDA
        • Edit
          • Export data
          • Undo an action
          • Redo an action
          • Clear undo history
          • Disable undo
          • Convert to instruction
          • Convert to data
          • Convert to string literal
          • Convert to array
          • Undefine a byte
          • Give Name to the Location
          • Operand types
            • Offset
            • Number
            • Perform en masse operation
            • Convert operand to character
            • Convert operand to segment
            • Complex Offset Expression
            • Convert operand to symbolic constant (enum)
            • Convert operand to stack variable
            • Change operand sign
            • Bitwise negate operand
            • User-defined operand
            • Set operand type
          • Comments
          • Functions
          • Structs
          • Segments
          • Patch core
          • Other
            • Rename Any Address
          • Plugins
        • Jump
          • Center current line in window
          • Problems List
        • Search
          • REGULAR EXPRESSION SYNTAX SUMMARY
        • View
          • Open subviews
          • Graphs
          • Message Window
          • Arrows window
          • Database snapshot manager
          • Highlighting identifiers
          • Browser options
          • Lumina options
          • Assembler level and C level types
          • C++ type details
          • Bookmarks window
          • Calculator
          • View segment registers
          • View Internal Flags
          • Hide
          • Unhide
          • Del hidden range
          • Hide all items
          • Unhide all items
          • Setup hidden items
        • Debugger
          • Debugger window
          • Process Control
            • Start process
            • Process options
            • Pause process
            • Terminate process
            • Step into
            • Step over
            • Run to cursor
            • Run until return
            • Attach to process
            • Detach from process
            • Set current ip
            • Show application screen
          • Breakpoints
          • Watches
          • Tracing
          • Source code view
            • Watch view (source level)
          • Process Memory
            • Take memory snapshot
            • Manual memory regions
            • Refresh memory
          • Thread list
          • Module list
          • Stack trace
          • Exceptions
          • Debugger options
          • Switch debugger
        • Lumina
        • Options
          • Low & High Suspicious Operand Limits
        • Windows
          • Rename a stack variable
          • Miscellanous Options
          • Environment variables
          • Reset Hidden Messages
          • Various dialog help messages
        • List of all menu options
      • Desktops
      • Command line
      • How To Use List Viewers in IDA
      • Licenses
        • Apache License for Ghidra
        • Apache License for LLVM
        • Common Public License Version 1.0
        • APPLE PUBLIC SOURCE LICENSE
        • PCRE2 LICENCE
        • GNU Lesser General Public License v2.1 for libiberty
      • Database conversion from idb to i64
    • Disassembler
      • Interactivity
      • Background Analysis
      • Graph view
        • Graphing tutorial
      • Proximity view
      • Navigation
        • Anchor
        • How to Enter a Segment Value
        • How to Enter a Number
        • How to Enter an Identifier
        • How to enter text
        • How to Enter an Address
      • Disassembly Gallery
        • Philips 51XA-G3
        • 6502 and 65C02 Disassembler
        • 6301, 6303, 6800, 6801 and 6803 Disassembler
        • 68040, Amiga
        • 6805 Disassembler
        • 6808 Disassembler
        • 6809 OS9 Flex Disassembler
        • 6809 Disassembler
        • 6811 Disassembler
        • 68HC12 Disassembler
        • 68HC16 Disassembler
        • 68k Amiga Disassembler
        • 68k Mac OS
        • 68k Palm Pilot
        • Unix COFF
        • NEC 78k0 and 78k0s Processor
        • 80196 Processor
        • 8051 Disassembler
        • Analog Devices 218x.
        • Alpha Processor – NT COFF
        • Alpha Processor – Unix ELF
        • Android ARM Executables (.elf)
        • ARC Processor
        • ARM Processor EPOC App
        • ARM Processor EPOC PE File
        • ARM Processor EPOC ROMFile
        • EPOC SIS File Handler
        • ARM Processor iOS (iPhone): Unlock
        • ARM Processor iOS (iPhone): Objective-C metadata
        • ARM Processor iOS (iPhone): Objective-C Instance variables
        • ARM Processor iOS (iPhone): Parameter Identification & Tracking (PIT)
        • ARM Processor iOS (iPhone): Start
        • ARM Processor iOS (iPhone): Switch statements
        • ARM Processor iOS (iPhone): C++ signatures
        • ARM Processor iOS (iPhone): Write
        • ARM Processor: Linux ELF
        • ARM Processor: AOF SDK
        • ARM Processor: Windows CE COFF Format
        • ARM Processor: Windows CE PE Format
        • ATMEL AVR Disassembler
        • C166 Processor
        • C166 Processor with ELF file
        • Rockwell C39
        • Microsoft .NET CLI Disassembler. VisualBasic library
        • CR16
        • Android Dalvik Executables (.dex)
        • Microsoft .NET CLI Disassembler
        • DSP56K
        • Fujitsu FR (.elf)
        • Gameboy
        • H8 300: COFF FILE Format
        • H8 300s: COFF FILE Format
        • H8 500
        • HPPA Risc Processor: HP-UX SOM
        • i51
        • i860
        • Intel i960
        • Intel IA-64 (Itanium)
        • Java Bytecode
        • Angstrem KR 1878
        • Renesas/Hitachi M16C
        • Renesas/Hitachi M32R
        • M740
        • M7700
        • M7900
        • MIPS Processor: Nintendo N64
        • MIPS R5900 Processor : Sony bin
        • MIPS Processor: Sony ELF
        • MIPS Processor: Sony PSX
        • MIPS Processor: Sony PSX
        • MIPS Processor: Unix COFF File Format
        • MIPS Processor: Unix ELF File Format
        • MIPS Processor: Windows CE PE File Format
        • MIPS Processor: Windows CE PE2 File Format
        • Panasonic MN102
        • Atmel OAK DSP
        • 80×86 Architecture: DOS Extender
        • 80×86 Architecture: Watcom Runtime
        • 80×86 Architecture: Geos APP
        • 80×86 Architecture: Geos DRV
        • 80×86 Architecture: Geos LIB
        • 80×86 Architecture: GNU COFF Format
        • 80×86 Architecture: OS/2 Linear Executable Format
        • 80×86 Architecture: Netware NLM
        • 80×86 Architecture: QNX Executable
        • 80×86 Architecture: Watcom Runtime
        • 80×86 Architecture: Windows OMF
        • 80×86 Architecture: Windows Portable Executable Format
        • 80×86 Architecture: Windows Virtual Device Driver
        • 80×86 Architecture: Windows 16 bits DLL
        • X-Box Disassembler
        • PDP 11: SAV File
        • PIC
        • PIC 12xx
        • Power PC AIF ECOFF file Format
        • Power PC Linux ELF
        • Mac OS PEF File
        • Mac OS X File
        • Windows NT PE File
        • Hitachi SH-1 Processor
        • Hitachi SH-3 Processor: Windows CE COFF format
        • Hitachi SH-3 Processor: Windows CE PE format
        • Hitachi SH-4 Processor: ELF File Format
        • Hitachi SH-4 Processor: Windows CE PE File Format
        • Super Nintendo Entertainement System (SNES)
        • SPARC Solaris COFF
        • SPARC Solaris ELF
        • SPARC Sun ELF
        • SPARC Sun ELF SO
        • ST 20C4
        • ST 7
        • ST 9
        • Toshiba TLCS 900
        • TMS 320c2 COFF
        • TMS 320c5
        • TMS 320c54
        • TMS 320c6 COFF File Format
        • TRICORE
        • SunPlus unSP
        • NEC V850
        • Z180 COFF File Format
        • Z380 COFF File Format
        • Z8
        • Z80
      • Supported processors
      • Supported file formats
        • Windmp file loader
      • Bitfields
        • Bit Fields tutorial
      • Structures tutorial
      • Union tutorial
      • Variable length structures tutorial
      • Data types, operands and constructs
      • Packed executables
    • Decompiler
      • Prerequisites
      • Quick primer
      • Exception handler
      • Introduction to Decompilation vs. Disassembly
        • Comparisons of ARM disassembly and decompilation
        • Comparisons of PowerPC disassembly and decompilation
        • Comparisons of MIPS disassembly and decompilation
        • Hex-Rays v7.4 vs. v7.3 Decompiler Comparison Page
        • Hex-Rays v7.3 vs. v7.2 Decompiler Comparison Page
        • Hex-Rays v7.2 vs. v7.1 Decompiler Comparison Page
      • Interactive operation
        • Rename
        • Set type
        • Set number representation
        • Edit indented comment
        • Edit block comment
        • Hide/unhide C statements
        • Split/unsplit expression
        • Force call type
        • Set call type
        • Add/del variadic arguments
        • Del function argument
        • Add/delete function return type
        • Jump to cross reference
        • Jump to cross reference globally
        • Generate HTML file
        • Mark/unmark as decompiled
        • Copy to assembly
        • Show/hide casts
        • Reset pointer type
        • Convert to struct *
        • Create new struct type
        • Split variable
        • Select union field
        • Jump to paired paren
        • Collapse/uncollapse item
        • Map to another variable
      • Batch operation
      • Configuration
      • Third party plugins
      • Floating point support
      • Support for intrinsic functions
      • Overlapped variables
      • gooMBA
      • Failures and troubleshooting
      • FAQ
      • Limitations
      • Tips and tricks
    • Debugger
      • Instant debugger
      • Remote debugging
        • Remote iOS Debugger
        • Android debugger
        • Dalvik debugger
        • Remote GDB Debugger
          • Remote GDB Debugger options
          • Debugging with gdbserver
          • Debugging with VMWare
          • Debugging with OpenOCD
          • Debugging with QEMU
          • External programs and GDB Debugger
          • Debugging code snippets with QEMU
        • PIN debugger
          • Building the PIN tool
          • Connecting a remote PIN tool instance from IDA
          • PIN support for MacOSX
        • Replayer debugger
        • Bochs debugger
          • Bochs Disk Image operation mode
          • Bochs IDB operation mode
          • Bochs PE operation mode
          • Bochs debugger FAQ
      • Local debugging
        • WinDbg Debugger
        • Linux debugger
        • Intel/ARM macOS debugger
      • Debugger tutorials
        • Debugging Dalvik Programs
        • IDA Win32 Local Debugging
        • IDA Linux Local Debugging
        • IDA Linux to Win64 Debugging
        • IDA Win32 to Linux Debugging
        • Debugging Mac OSX Applications with IDA Pro
        • Debugging iOS Applications using CoreDevice (iOS 17 and up)
        • Debugging iOS Applications with IDA Pro
        • Debugging Linux Applications locally
        • Debugging Linux/Windows Applications with PIN Tracer module
        • Debugging Windows Applications with IDA Bochs Plugin
        • Debugging Windows Applications with IDA WinDbg Plugin
        • Using the Bochs debugger plugin in Linux
        • Debugging Windows Kernel with VMWare and IDA WinDbg Plugin
        • Debugging Linux Kernel under VMWare using IDA GDB debugger
        • Windows Debugger Hub
        • Linux Debugger
        • Debugging a Windows executable locally and remotely
        • Debugging the XNU Kernel with IDA Pro
        • Remote debugging with IDA Pro
        • IDA Scriptable Debugger: overview
          • IDA Scriptable Debugger: scriptability
        • Debugging code snippets with QEMU debugger (a la IDA Bochs debugger)
        • Trace Replayer and managing traces
        • Using IDA Pro's tracing features
        • Working with PIN
        • Appcall
    • Creating Signatures
      • FLIRT
        • IDA F.L.I.R.T. Technology: In-Depth
        • Generate FLIRT signature file
        • Supported Compilers
          • Turbo Pascal
          • Delphi
      • Makesig
    • Creating Type Libraries
      • IDAClang
      • TILIB
    • Configuration
      • Configuration files
      • Command line switches
      • Keyboard macros
      • UI/Fonts/Themes
      • Shortcuts
      • Customizing IDA
      • CSS-based styling
    • Teams
      • IDA Teams Licenses
      • Diffing and Merging Databases with IDA Teams
      • Teams lc command reference manual
      • hv command reference manual
      • Hex-Rays Vault’s visual client user manual
    • Lumina
      • lc command reference manual
    • Plugins
      • Open Plugin Architecture
      • Plugin options
      • Plugins Shipped with IDA
        • Swift plugin
        • Golang plugin
        • Rust plugin
        • picture_search
        • Objective-C Analysis Plugin
        • DYLD Shared Cache Utils
        • Borland RTTI descriptors plugin
        • DWARF plugin
        • Patfind plugin
        • IDA Feeds
          • FLIRT Signature Bundle
      • Plugin Contest
      • How to write your own plugin?
    • Helper Tools
    • idalib
  • Developer Guide
    • C++ SDK
      • Getting Started with C++ SDK
      • C++ SDK Reference
      • Using the Decompiler SDK: Decompiler plugin
      • C++ SDK examples
      • How to create a plugin in C++?
      • C++ SDK Porting Guide from IDA 8.x to 9.0
    • IDAPython
      • Getting started with IDAPython
      • IDAPython API Reference
      • IDAPython examples
      • How to create a plugin in IDAPython?
      • IDAPython Porting Guide from IDA 8.x to 9.0
    • IDC
      • Core concepts
        • Expressions
        • Statements
        • Functions
        • Variables
        • Constants
        • Exceptions
        • Classes
        • Predefined symbols
        • loader_input_t class
        • Slices
      • IDC API Reference
        • Index of debugger related IDC functions
        • Alphabetical list of IDC functions
          • is_member_id
          • load_type
          • get_member_by_idx
          • get_ordinal_limit
          • set_selector
          • enable_tracing
          • get_prev_fixup_ea
          • del_segm
          • get_bmask_cmt
          • end_type_updating
          • Find
          • toggle_bnot
          • patch_byte
          • get_module_info
          • set_member_name
          • create_float
          • del_struc_member
          • read_dbg_memory
          • get_enum_width
          • getn_thread_name
          • del_struc
          • filelength
          • set_manual_insn
          • is_value...() functions
          • get_ip_val
          • del_extra_cmt
          • create_insn
          • op_offset_high16
          • get_cmt
          • expand_struc
          • get_idb_path
          • set_frame_size
          • get_file_ext
          • has_value
          • readshort
          • sanitize_file_name
          • get_member_flag
          • create_struct
          • ARM specific
          • set_enum_member_cmt
          • rename
          • set_ida_state
          • get_member_size
          • msg
          • qbasename
          • get_enum_member_enum
          • auto_mark_range
          • plan_to_apply_idasgn
          • set_named_type
          • op_offset
          • rename_entry
          • strlen
          • get_extra_cmt
          • get_enum_flag
          • fgetc
          • op_stkvar
          • get_last_index
          • get_field_ea
          • get_struc_id
          • select_thread
          • create_array
          • get_struc_cmt
          • set_array_string
          • set_func_attr
          • set_storage_type
          • get_struc_size
          • demangle_name
          • get_next_fixup_ea
          • get_next_bmask
          • delattr
          • gen_simple_call_chart
          • patch_qword
          • get_enum_name
          • loader_input_t.getc
          • get_debugger_event_cond
          • read_dbg_qword
          • define_local_var
          • generate_disasm_line
          • add_idc_hotkey
          • tolower
          • del_selector
          • set_debugger_event_cond
          • get_imagebase
          • gen_file
          • get_entry
          • find_custom_data_format
          • get_debug_name_ea
          • add_default_til
          • set_func_end
          • exit_process
          • delete_array
          • xtol
          • get_exception_code
          • detach_process
          • set_enum_cmt
          • get_wide_word
          • put_bookmark
          • is_loaded
          • add_enum_member
          • parse_decls
          • readstr
          • get_entry_qty
          • ord
          • sprintf
          • get_root_filename
          • get_enum_member_cmt
          • create_word
          • set_func_flags
          • loader_input_t.tell
          • create_align
          • read_dbg_dword
          • next_addr
          • get_bytes
          • batch
          • start_process
          • process_config_line
          • del_user_info
          • qmakefile
          • set_struc_name
          • print_decls
          • create_custom_data
          • del_enum_member
          • format_cdata
          • get_fixup_target_sel
          • get_item_size
          • loader_input_t.gets
          • get_last_bmask
          • Step Tracing Options
          • selector_by_name
          • get_enum_cmt
          • next_not_tail
          • prev_head
          • set_color
          • set_numbered_type
          • get_member_name
          • auto_wait
          • get_enum_member_bmask
          • fseek
          • get_segm_start
          • attach_process
          • Trace file functions
          • get_enum_member_value
          • op_stroff
          • get_next_offset
          • set_processor_type
          • get_bookmark_desc
          • create_data
          • lastattr
          • get_operand_value
          • collect_stack_trace
          • toupper
          • get_fixup_target_dis
          • set_cmt
          • add_entry
          • set_segm_addressing
          • qmake_full_path
          • get_source_linnum
          • fputc
          • resume_thread
          • get_func_attr
          • get_first_enum_member
          • add_sourcefile
          • get_first_bmask
          • read_selection_start
          • hasattr
          • get_member_cmt
          • gen_flow_graph
          • get_array_element
          • get_tinfo
          • loader_input_t
          • tinfo_errstr
          • TRUNC
          • add_segm_ex
          • Local types information and manipulation helpers
          • set_source_linnum
          • get_next_enum_member
          • loader_input_t.readbytes
          • set_array_params
          • jumpto
          • get_bookmark
          • set_enum_bf
          • prev_not_tail
          • toggle_sign
          • loader_input_t.size
          • Trace events functions
          • get_func_flags
          • get_gotea
          • set_segm_attr
          • get_item_head
          • set_default_sreg_value
          • print_insn_mnem
          • set_member_cmt
          • get_ordinal_qty
          • set_target_assembler
          • add_user_stkpnt
          • set_local_type
          • Hidden ranges
          • del_items
          • compile_idc_text
          • Dalvik debugger extension functions
          • byte_value
          • create_dword
          • is_code
          • del_func
          • get_enum
          • make_array
          • rotate_left
          • recalc_spd
          • search_path
          • CommonBits
          • get_processor_name
          • set_func_cmt
          • get_prev_bmask
          • Hashes
          • split_sreg_range
          • process_ui_action
          • set_fixup
          • get_fixup_target_type
          • create_oword
          • get_flags
          • get_func_name
          • create_strlit
          • add_struc
          • atol
          • load_debugger
          • mkdir
          • sizeof
          • get_enum_member_by_name
          • save_database
          • guess_type
          • get_segm_name
          • print_operand
          • qisabspath
          • get_member_qty
          • set_struc_cmt
          • get_fixup_target_flags
          • idadir
          • object.retrieve
          • add_auto_stkpnt
          • get_numbered_type_name
          • get_enum_member_name
          • get_next_index
          • prev_addr
          • get_name_ea
          • get_sp_delta
          • set_bmask_cmt
          • readlong
          • set_segm_name
          • get_prev_offset
          • set_segm_alignment
          • get_strlit_contents
          • forget_exception
          • get_item_end
          • add_func
          • get_name
          • Asks
          • get_spd
          • Debugger: control
          • get_wide_byte
          • plan_and_wait
          • set_enum_flag
          • RunPythonStatement
          • del_sourcefile
          • find_selector
          • get_frame_regs_size
          • op_num
          • define_exception
          • create_double
          • create_byte
          • read_selection_end
          • OpTypes
          • op_plain_offset
          • move_segm
          • get_member_id
          • set_segm_combination
          • get_current_thread
          • trim
          • Debugger: options
          • getn_thread
          • get_frame_id
          • typeinfo.print
          • to_ea
          • rebase_program
          • add_struc_member
          • get_exception_qty
          • get_first_index
          • import_type
          • set_segm_type
          • find_custom_data_type
          • get_next_seg
          • find_func_end
          • get_last_enum_member
          • getattr
          • get_frame_size
          • get_screen_ea
          • loader_input_t.read
          • set_reg_value
          • Debugger: modules
          • create_pack_real
          • writestr
          • exec_idc
          • get_enum_size
          • set_enum_name
          • create_tbyte
          • sel2para
          • atoa
          • loader_input_t.close
          • add_enum
          • ltoa
          • substr
          • del_idc_hotkey
          • Breakpoint handling functions
          • loader_input_t.seek
          • cleanup_appcall
          • object.store
          • get_type
          • qexit
          • get_debug_name
          • get_array_id
          • Can't Open File
          • suspend_process
          • process_config_directive
          • get_entry_name
          • get_last_member
          • get_struc_name
          • clear_selection
          • fclose
          • firstattr
          • create_yword
          • dbg_appcall
          • get_qword
          • patch_dword
          • begin_type_updating
          • read_dbg_byte
          • get_fpnum
          • qsleep
          • get_first_member
          • get_nsec_stamp
          • del_stkpnt
          • eval
          • savefile
          • eval_python
          • Xrefs
          • strstr
          • writeshort
          • get_sreg
          • get_segm_end
          • get_func_off_str
          • set_func_start
          • del_array_element
          • get_full_flags
          • set_exception_flags
          • rename_array
          • get_frame_args_size
          • op_flt
          • get_min_spd_ea
          • apply_type
          • get_prev_index
          • loadfile
          • retrieve_input_file_md5
          • get_wide_dword
          • patch_dbg_byte
          • Functions provided by the WinDbg debugger
          • get_original_byte
          • get_member_strid
          • call_system
          • writelong
          • get_thread_qty
          • nextattr
          • send_dbg_command
          • get_first_seg
          • get_processes
          • patch_word
          • get_manual_insn
          • ftell
          • get_entry_ordinal
          • set_array_long
          • delete_all_segments
          • TO_LONG
          • Function chunk related functions
          • Debugger: events
          • get_prev_func
          • op_seg
          • validate_idb_names
          • fprintf
          • fopen
          • strfill
          • del_fixup
          • get_bmask_name
          • inf_attr
          • is_bf
          • read_dbg_word
          • qdirname
          • get_segm_attr
          • func_contains
          • del_source_linnum
          • get_sourcefile
          • clr_database_flag
          • set_name
          • Refresh Screen
          • op_enum
          • getn_enum
          • get_db_byte
          • setattr
          • get_forced_operand
          • op_bin
          • Functions provided by the replayer debugger
          • prevattr
          • update_extra_cmt
          • get_str_type
          • op_man
          • choose_func
          • set_bmask_name
          • get_curline
          • decode_insn
          • set_segment_bounds
          • set_segm_class
          • write_dbg_memory
          • get_exception_name
          • get_enum_member
          • is_mapped
          • del_enum
          • get_frame_lvar_size
          • get_operand_type
          • set_root_filename
          • compile_idc_file
          • typeinfo.size
          • get_local_tinfo
          • get_fixup_target_off
          • is_union
          • unlink
          • get_segm_by_sel
          • set_enum_width
          • take_memory_snapshot
          • exec_python
          • get_next_func
          • get_member_offset
          • get_func_cmt
          • parse_decl
          • create_qword
          • next_head
          • suspend_thread
          • loader_input_t.getz
          • get_color
          • get_reg_value
          • load_and_run_plugin
          • set_database_flag
          • set_enum_member_name
          • set_member_type
          • get_prev_enum_member
      • IDC examples
        • Analyzing encrypted code
  • Admin Guide
    • Lumina server
    • Teams server
    • License server
      • Hex-Rays License Server Migration Guide
  • Release Notes
    • IDA 9.0
    • IDA 8.4sp2
    • IDA 8.4sp1
    • IDA 8.4
    • IDA 8.3
    • IDA 8.2sp1
    • IDA 8.2
    • IDA 8.1
    • IDA 8.0sp1
    • IDA 8.0
    • IDA 7.7sp1
    • IDA 7.7
    • IDA 7.6sp1
    • IDA 7.6
    • IDA 7.5sp3
    • IDA 7.5sp2
    • IDA 7.5sp1
    • IDA 7.5
    • IDA 7.4sp1
    • IDA 7.4
    • IDA 7.3
      • IDA 7.3 Undo: IDA can do it
    • IDA 7.2
      • IDA 7.2 The Mac Rundown
    • IDA 7.1
      • IDA 7.1 Debugger API 7.1 Porting Guide
    • IDA 7.0sp1
    • IDA 7.0
      • Internationalization (i18n)
      • Automatic discovery of string literals
      • API 7.0 Porting Guide
      • IDAPython backward compatibility
    • IDA 6.95
    • IDA 6.9
    • IDA 6.8
    • IDA 6.7
    • IDA 6.6
    • IDA 6.5
    • IDA 6.4
    • IDA 6.3
    • IDA 6.2
    • IDA 6.1
    • IDA 6.0
    • IDA 5.7
    • IDA 5.6
    • IDA 5.5
      • 5.5 Gallery
      • 5.5 Comparison
    • IDA 5.4
    • IDA 5.3
    • IDA 5.2
    • IDA 5.1
    • IDA 5.0
    • IDA 4.9SP
    • IDA 4.9
    • IDA 4.8
    • IDA 4.7
    • IDA 4.6
    • IDA 4.x
    • IDA 3.x
    • Cumulative bugfix for IDA
  • Archive
    • IDA’s Windbg plugin
    • IDA’s Bochs debugger plugin
    • IDA’s Bochs debugger plugin 2
    • DosWin32
    • Hex-Rays v1.1 vs. v1.0 Decompiler Comparison Page
    • Hex-Rays v1.2 vs. v1.1 Decompiler Comparison Page
    • Hex-Rays v1.3 vs. v1.2 Decompiler Comparison Page
    • Hex-Rays v1.6 vs. v1.5 Decompiler Comparison Page
    • Hex-Rays v1.7 vs. v1.6 Decompiler Comparison Page
    • Costly Greetings – An Adventure In Hostile Code Analysis
    • An Adventure In Hostile Code Analysis: Description
    • An Adventure In Hostile Code Analysis: Disassembly
    • Improved code flow analysis
    • Program Navigation Bar
    • IDA Home Contest
    • Pimp My IDA: vote results
    • Turning off IDA 6.x compatibility in IDAPython
    • Porting guide for IDA 7.4 turning off IDA 6.x API backwards-compatibility by default
    • Porting guide for IDA 7.4 IDAPython and Python 3
    • IDAPython and Python 3
    • Porting guide for changes in IDAPython-on-Python-3 APIs
    • Debugging iOS Applications With IDA
    • IDA Win32 to Win32 Debugging
    • IDA Win32 to Win64 Debugging
    • Legacy license server: Floating Licenses
      • Installing on Linux
      • Installing on Windows
      • Installing on OS X
    • Decompiler Installation
    • Enumerated types tutorial
  • Bug Bounty
Powered by GitBook
LogoLogo

Need Help?

  • FAQs
  • Support

Community

  • Forum
  • Plugins

Resources

  • Blog
  • Download center

© 2025 Copyright Hex-Rays

On this page
  • Hex-Rays v1.6 vs. v1.5 Decompiler Comparison Page
  • Inline CFString constants
  • More humanly if-conditions
  • Support for CONTAINING_RECORD macro
  • Support for LIST_ENTRY macros
  • Better tail call recognition
  • Improved memset recognition
  • Support for TEB/KPCR references
  • Better char/short variable recognition
  • Better recognition of inline functions
  • Structure copying - 1
  • Structure copying - 2
  • Support for union fields
  • Support for merged calls

Was this helpful?

Export as PDF
  1. Archive

Hex-Rays v1.6 vs. v1.5 Decompiler Comparison Page

Last updated 6 months ago

Was this helpful?

Hex-Rays v1.6 vs. v1.5 Decompiler Comparison Page

Below you will find side-by-side comparisons of v1.5 and v1.6 decompilations. Please maximize the window too see both columns simultaneously.

The following examples are displayed on this page:


Inline CFString constants

This simple improvement can substantially speed up analysis of Objective C code: CFString text constants are immediately visible in the output.

void *__cdecl _PMProxy_showHistroyWindow__()
{
  void *v0; // eax@1

  v0 = objc_msgSend("NSWorkspace", "sharedWorkspace");
  return objc_msgSend(v0, "openFile:withApplication:", CFSTR("/var/log/cups/error_log"), CFSTR("Console"));
}
void *__cdecl _PMProxy_showHistroyWindow__()
{
  void *v0; // eax@1

  v0 = objc_msgSend("NSWorkspace", "sharedWorkspace");
  return objc_msgSend(v0, "openFile:withApplication:", &cfstr_VarLogCupsErro, &cfstr_Console);
}

More humanly if-conditions

The decompiler generates much more readable text by dividing complex conditions into smaller chunks. The output is longer but hey, sometimes it makes sense to be verbose! :)

  pos1 = *mark1;
  err.x = parseMark(_viewer, &_text, mark1, _pInfo, &_iLineNo, &point1);
  if ( err.x )
    return err.x;
  if ( mark2 )
  {
    pos2 = *mark2;
    err.x = parseMark(_viewer, &pageNo2, mark2, _pInfo, &lineNo2, &err);
    if ( err.x )
      return err.x;
  }
  if ( pRects )
  {
    curPage = _viewer->nPage;
    if ( pageNo2 < curPage || _text > curPage )
      return err.x;
  }
  pos1 = *mark1;
  err.x = parseMark(_viewer, &_text, mark1, _pInfo, &_iLineNo, &point1);
  if ( err.x
    || mark2 && (pos2 = *mark2, (err.x = parseMark(_viewer, &pageNo2, mark2, _pInfo, &lineNo2, &err)) != 0)
    || pRects && ((curPage = _viewer->nPage, pageNo2 < curPage) || _text > curPage) )
    return err.x;

Support for CONTAINING_RECORD macro

  _HW_STREAM_OBJECT *HwStreamObject; 
  _STREAM_OBJECT *StreamObject; // esi@1
  StreamObject = CONTAINING_RECORD(HwStreamObject, _STREAM_OBJECT, HwStreamObject);
  _HW_STREAM_OBJECT *HwStreamObject; 
  _STREAM_OBJECT *StreamObject; // esi@1
  StreamObject = (_STREAM_OBJECT *)((char *)&HwStreamObject[-2] - 36);

Support for LIST_ENTRY macros

void __stdcall SCStartRequestOnStream(_STREAM_OBJECT *a1, _DEVICE_EXTENSION *a2)
{
  KSPIN_LOCK *v2; // ebx@1                                                            

  v2 = &a2->SpinLock;
  KefAcquireSpinLockAtDpcLevel(&a2->SpinLock);
  if ( a1->ReadyForNextDataReq && !IsListEmpty(&a1->DataPendingQueue) )
  {
    SCDequeueAndStartStreamDataRequest(a1);
    KefAcquireSpinLockAtDpcLevel(v2);
  }
  if ( !a1->ReadyForNextControlReq || IsListEmpty(&a1->ControlPendingQueue) )
    KefReleaseSpinLockFromDpcLevel(v2);
  else
    SCDequeueAndStartStreamControlRequest(a1);
}
int __stdcall SCStartRequestOnStream(_STREAM_OBJECT *a1, _DEVICE_EXTENSION *a2)
{
  char *v2; // ebx@1
  int result; // eax@6

  v2 = (char *)&a2->SpinLock;
  KefAcquireSpinLockAtDpcLevel(&a2->SpinLock);
  if ( a1->ReadyForNextDataReq && a1->DataPendingQueue.Flink != &a1->DataPendingQueue )
  {
    SCDequeueAndStartStreamDataRequest(a1);
    KefAcquireSpinLockAtDpcLevel(v2);
  }
  if ( a1->ReadyForNextControlReq && a1->ControlPendingQueue.Flink != &a1->ControlPendingQueue )
    result = SCDequeueAndStartStreamControlRequest(a1);
  else
    result = KefReleaseSpinLockFromDpcLevel(v2);
  return result;
}

Better tail call recognition

A much better recognition of tail call optimization leads to less JUMPOUT() calls in the output. The call arguments are recognized correctly. The function return value is not lost anymore.

BOOL __stdcall BaseDllInitialize(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved)
{
  if ( fdwReason == 1 )
    __security_init_cookie();
  return _BaseDllInitialize(hinstDLL, fdwReason, lpReserved);
}
BOOL __stdcall BaseDllInitialize(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved)
{
  if ( fdwReason == 1 )
    __security_init_cookie();
  JUMPOUT(*(int *)_BaseDllInitialize);
}

Improved memset recognition

Six non-trivial lines of code have been collapsed into one simple line. We are happy with this improvement!

  memset(v10, 0, v10->cbSize);
      v15 = v10->cbSize;
      v16 = v10->cbSize >> 2;
      memset(v10, 0, 4 * v16);
      v17 = (int)((char *)v10 + 4 * v16);
      for ( i = v15 & 3; i; --i )
        *(_BYTE *)v17++ = 0;

Support for TEB/KPCR references

SessionId = NtCurrentTeb()->ProcessEnvironmentBlock->SessionId;
SessionId = *(_DWORD *)(*(_DWORD *)(__readfsdword(24) + 48) + 468);

Better char/short variable recognition

The previous version of the decompiler failed to create a 16-bit variable that was stored by the compiler in bx. This had some very nasty consequences: the function prototype had an incorrect input argument (ebx) and the calling convention was wrong. While it was possible to correct it by specifying the function prototype manually, the new version lifts this burden from you.

The new version takes care of this situation much better. It uses a more fine-grained approach to variable allocation. It created a small 16-bit variable v4. No more ugly LOWORD() macro, the output is cleaner. The correctly determined function prototype will help when decompiling other functions as well because there will be less parasitic arguments and less confusion.

signed int __thiscall sub_600112F7(void *this, int a2, int a3)
{
  unsigned __int16 v4; // bx@1
  v10 = this;
  v4 = *(_WORD *)(a2 + 12);
signed int __userpurge sub_600112F7<eax>(int a1<ecx>, int a2<ebx>, int a3, int a4)
{
  v10 = a1;
  LOWORD(a2) = *(_WORD *)(a3 + 12);

Better recognition of inline functions

Sorry for a long sample, the previous version of the decompiler was not handling strlen() well enough. It is a never ending fight and perfection is impossible, but we still continue to work on it. Recognition of inline functions is an incredibly hard problem, but the new version has a better engine to recognize them. There is plenty of room for improvement, to put it mildly.

  v18 = (char *)operator new(v15);
  strcpy(v18, *v3);
  strcat(v18, " ");
  strcat(v18, v3[1]);
  strcat(v18, " ");
  strcat(v18, v3[2]);
  if ( v3[3] )
  {
    argca = v3 + 3;
    v25 = v3 + 3;
    do
    {
      strcat(v18, " \"");
      strcat(v18, *argca);
      if ( (*argca)[strlen(*argca) - 1] == 92 )
        strcat(v18, "\\");
      strcat(v18, "\"");
      ++v25;
      argca = v25;
    }
    while ( *v25 );
  }
  v27 = (char *)operator new(v24);
  v28 = v27;
  strcpy(v27, *v3);
  v29 = -1;
  v30 = " ";
  do
  {
    if ( !v29 )
      break;
    v12 = *v30++ == 0;
    --v29;
  }
  while ( !v12 );
  v31 = ~v29;
  v32 = v31;
  v33 = &v30[-v31];
  v34 = -1;
  v35 = v27;
  do
  {
    if ( !v34 )
      break;
    v12 = *v35++ == 0;
    --v34;
  }
  while ( !v12 );
  memcpy(v35 - 1, v33, v32);
  v36 = v3[1];
  v37 = -1;
  do
  {
    if ( !v37 )
      break;
    v12 = *v36++ == 0;
    --v37;
  }
  while ( !v12 );
  v38 = ~v37;
  v39 = &v36[-v38];
  v40 = v38;
  v41 = v27;
  v42 = -1;
  do
  {
    if ( !v42 )
      break;
    v12 = *v41++ == 0;
    --v42;
  }
  while ( !v12 );
  memcpy(v41 - 1, v39, v40);
  v43 = " ";
  v44 = -1;
  do
  {
    if ( !v44 )
      break;
    v12 = *v43++ == 0;
    --v44;
  }
  while ( !v12 );
  v45 = ~v44;
  v46 = &v43[-v45];
  v47 = v45;
  v48 = v27;
  v49 = -1;
  do
  {
    if ( !v49 )
      break;
    v12 = *v48++ == 0;
    --v49;
  }
  while ( !v12 );
  memcpy(v48 - 1, v46, v47);
  v50 = v3[2];
  v51 = -1;
  do
  {
    if ( !v51 )
      break;
    v12 = *v50++ == 0;
    --v51;
  }
  while ( !v12 );
  v52 = ~v51;
  v53 = &v50[-v52];
  v54 = v52;
  v55 = v27;
  v56 = -1;
  do
  {
    if ( !v56 )
      break;
    v12 = *v55++ == 0;
    --v56;
  }
  while ( !v12 );
  memcpy(v55 - 1, v53, v54);
  if ( v3[3] )
  {
    argca = v3 + 3;
    v91 = v3 + 3;
    do
    {
      v57 = " \"";
      v58 = -1;
      do
      {
        if ( !v58 )
          break;
        v12 = *v57++ == 0;
        --v58;
      }
      while ( !v12 );
      v59 = ~v58;
      v60 = &v57[-v59];
      v61 = v59;
      v62 = v27;
      v63 = -1;
      do
      {
        if ( !v63 )
          break;
        v12 = *v62++ == 0;
        --v63;
      }
      while ( !v12 );
      memcpy(v62 - 1, v60, v61);
      v64 = *argca;
      v65 = -1;
      do
      {
        if ( !v65 )
          break;
        v12 = *v64++ == 0;
        --v65;
      }
      while ( !v12 );
      v66 = ~v65;
      v67 = &v64[-v66];
      v68 = v66;
      v69 = v27;
      v70 = -1;
      do
      {
        if ( !v70 )
          break;
        v12 = *v69++ == 0;
        --v70;
      }
      while ( !v12 );
      memcpy(v69 - 1, v67, v68);
      if ( (*argca)[strlen(*argca) - 1] == 92 )
      {
        v71 = "\\";
        v72 = -1;
        do
        {
          if ( !v72 )
            break;
          v12 = *v71++ == 0;
          --v72;
        }
        while ( !v12 );
        v73 = ~v72;
        v74 = &v71[-v73];
        v75 = v73;
        v76 = v27;
        v77 = -1;
        do
        {
          if ( !v77 )
            break;
          v12 = *v76++ == 0;
          --v77;
        }
        while ( !v12 );
        memcpy(v76 - 1, v74, v75);
      }
      v78 = "\"";
      v79 = -1;
      do
      {
        if ( !v79 )
          break;
        v12 = *v78++ == 0;
        --v79;
      }
      while ( !v12 );
      v80 = ~v79;
      v81 = &v78[-v80];
      v82 = v80;
      v83 = v27;
      v84 = -1;
      do
      {
        if ( !v84 )
          break;
        v12 = *v83++ == 0;
        --v84;
      }
      while ( !v12 );
      memcpy(v83 - 1, v81, v82);
      ++v91;
      argca = v91;
    }
    while ( *v91 );
  }

Structure copying - 1

void __thiscall FileInfo::InitTime(FileInfo *this)
{
  FileInfo *_this; // ST08_4@1
  _SYSTEMTIME st; // [sp+4h] [bp-18h]@1
  _FILETIME ft; // [sp+14h] [bp-8h]@1

  _this = this;
  GetSystemTime(&st);
  SystemTimeToFileTime(&st, &ft);
  _this->m_CreateTime = ft;
  _this->m_AccessTime = ft;
  _this->m_WriteTime = ft;
}

void __thiscall FileInfo::InitTime(FileInfo *this)
{
  FileInfo *_this; // ST08_4@1                                                        
  _SYSTEMTIME st; // [sp+4h] [bp-18h]@1                                               
  _FILETIME ft; // [sp+14h] [bp-8h]@1                                                 

  _this = this;
  GetSystemTime(&st);
  SystemTimeToFileTime(&st, &ft);
  _this->m_CreateTime.dwLowDateTime = ft.dwLowDateTime;
  _this->m_CreateTime.dwHighDateTime = ft.dwHighDateTime;
  _this->m_AccessTime.dwLowDateTime = ft.dwLowDateTime;
  _this->m_AccessTime.dwHighDateTime = ft.dwHighDateTime;
  _this->m_WriteTime.dwLowDateTime = ft.dwLowDateTime;
  _this->m_WriteTime.dwHighDateTime = ft.dwHighDateTime;
}

Structure copying - 2

Please note that after collapsing several assignments into one we also got rid of the intermediary v30 variable. Very good!

(*pRects)[roff / 0x10u] = r;
        v30 = &(*pRects)[roff / 0x10u];
        v30->x = r.x;
        v30->y = r.y;
        v30->width = r.width;
        v30->height = r.height;                                        

Sometimes compilers copy structures by DWORD's, regardless of member types. The previous version of the decompiler diligently represented these assignments in the best form it could. However, using a structure copy operation is much better, it is concise and precise.

  _hostobj = &machine->curHostObject;
  *_hostobj = machine->pCallObject->this;
  _this = &machine->pCallObject->this;
  _hostobj = &machine->curHostObject;
  machine->curHostObject.pNext = _this->pNext;
  *(_DWORD *)&_hostobj->nSymID = *(_DWORD *)&_this->nSymID;
  _hostobj->data = _this->data;
  _hostobj->data2 = _this->data2;

Support for union fields

Finally the decompiler has proper support for union fields. Previously analysing code with unions could quickly turn into a nightmare because the decompiler would just use the first union field and would not allow you to change it. The code, while it had the field names, was very misleading because these names could be completely wrong. This is what we have on the left sample.

The new version is much better in this aspect. First, it tries to determine the best union field using several heuristic rules. It checks the disassembly listing for 'structure offset' operands, checks the current context to select the best fit union field. In many cases no user intervention is required. However, if the decompiler fails to pick the corrent union field, the user can always correct it by selecting the desired union field manually. Even complex situations like a union with another nested union or structure are supported. Anonymous nested unions are represented correctly too.

   PIO_STACK_LOCATION _stacklocation; // [sp+10h] [bp-14h]@1

  if ( stacklocation->Parameters.DeviceIoControl.IoControlCode == 0x224010 )
  {
    v8 = stacklocation->Parameters.Create.Options == 20;
    Semaphore = 0;
    if ( !v8 )
      goto LABEL_18;
    if ( stacklocation->Parameters.Read.Length < 1 )
      goto LABEL_87;
    buf = Irp->AssociatedIrp.SystemBuffer;
    v33 = &Semaphore;
    v32 = stacklocation->FileObject;
    memcpy(&v27, buf, 0x14u);
    DeviceObjecta = ChanMgrGetByHandleAndFileObject(v27, v28, v29, v30, v31, v32, &Semaphore);
    if ( DeviceObjecta < 0 )
      goto LABEL_92;
    v24 = Irp->AssociatedIrp.SystemBuffer;
    v33 = &v36;
    v32 = stacklocation->Parameters.DeviceIoControl.OutputBufferLength;
    v6 = ChannelIRead(Semaphore, v24, v32, &v36);
LABEL_90:
    v33 = Semaphore;
    goto LABEL_91;
  }
  if ( stacklocation->Parameters.DeviceIoControl.IoControlCode == 2244628 )
  {
    v8 = stacklocation->Parameters.DeviceIoControl.InputBufferLength == 20;
    Semaphore = 0;
    if ( v8 && stacklocation->Parameters.DeviceIoControl.OutputBufferLength == 1 )
    {
      v22 = Irp->AssociatedIrp.SystemBuffer;
  PIO_STACK_LOCATION _stacklocation; // [sp+10h] [bp-14h]@1

  if ( *&stacklocation->Parameters.Create.FileAttributes == 0x224010 )
  {
    v8 = stacklocation->Parameters.Create.Options == 20;
    Semaphore = 0;
    if ( !v8 )
      goto LABEL_18;
    if ( stacklocation->Parameters.Create.SecurityContext < 1 )
      goto LABEL_87;
    v23 = Irp->AssociatedIrp.MasterIrp;
    v33 = &Semaphore;
    v32 = stacklocation->FileObject;
    memcpy(&v27, v23, 0x14u);
    DeviceObjecta = ChanMgrGetByHandleAndFileObject(v27, v28, v29, v30, v31, v32, &Semaphore);
    if ( DeviceObjecta < 0 )
      goto LABEL_92;
    v24 = Irp->AssociatedIrp.MasterIrp;
    v33 = &v36;
    v32 = stacklocation->Parameters.Create.SecurityContext;
    v6 = ChannelIRead(Semaphore, v24, v32, &v36);
LABEL_90:
    v33 = Semaphore;
    goto LABEL_91;
  }
  if ( *&stacklocation->Parameters.Create.FileAttributes == 2244628 )
  {
    v8 = stacklocation->Parameters.Create.Options == 20;
    Semaphore = 0;
    if ( v8 && stacklocation->Parameters.Create.SecurityContext == 1 )
    {
      v22 = Irp->AssociatedIrp.MasterIrp;

Support for merged calls

The new version unmerged the call and got rid of the goto statement. Isn't it nice?

INT_PTR __stdcall EditBinaryValueDlgProc(HWND hwndDlg, UINT uMsg, WPARAM wParam, LPHELPINFO hinfo)
{
  LONG v5; // eax@8                                                                   

  if ( uMsg == WM_HELP )
  {
    WinHelpW(hinfo->hItemHandle, g_pHelpFileName, HELP_WM_HELP, (ULONG_PTR)s_EditBinaryValueHelpIDs);
  }
  else
  {
    if ( uMsg == WM_CONTEXTMENU )
    {
      WinHelpW((HWND)wParam, g_pHelpFileName, HELP_CONTEXTMENU, (ULONG_PTR)s_EditBinaryValueHelpIDs);
    }
    else
    {
      if ( uMsg == WM_INITDIALOG )
        return EditBinaryValue_OnInitDialog(hwndDlg, wParam, (LONG)hinfo);
      if ( uMsg != 273 || (signed int)(unsigned __int16)wParam <= 0 || (signed int)(unsigned __int16)wParam > 2 )
        return 0;
      v5 = GetWindowLongW(hwndDlg, 8);
      *(_DWORD *)(v5 + 8) = dword_105A048;
      *(_DWORD *)(v5 + 4) = hMem;
      hMem = 0;
      EndDialog(hwndDlg, (unsigned __int16)wParam);
    }
  }
  return 1;
}

INT_PTR __stdcall EditBinaryValueDlgProc(HWND hwndDlg, UINT uMsg, WPARAM wParam, LPHELPINFO hinfo)
{
  LONG v5; // eax@8                                                                             
  HWND v6; // [sp-10h] [bp-14h]@10                                                              
  const WCHAR *v7; // [sp-Ch] [bp-10h]@10                                                       
  UINT v8; // [sp-8h] [bp-Ch]@10                                                                
  ULONG_PTR v9; // [sp-4h] [bp-8h]@10                                                           

  if ( uMsg == WM_HELP )
  {
    v9 = (ULONG_PTR)s_EditBinaryValueHelpIDs;
    v8 = HELP_WM_HELP;
    v7 = g_pHelpFileName;
    v6 = hinfo->hItemHandle;
    goto LABEL_12;
  }
  if ( uMsg == WM_CONTEXTMENU )
  {
    v9 = (ULONG_PTR)s_EditBinaryValueHelpIDs;
    v8 = HELP_CONTEXTMENU;
    v7 = g_pHelpFileName;
    v6 = (HWND)wParam;
LABEL_12:
    WinHelpW(v6, v7, v8, v9);
    return 1;
  }
  if ( uMsg == WM_INITDIALOG )
    return EditBinaryValue_OnInitDialog(hwndDlg, wParam, (LONG)hinfo);
  if ( uMsg != 273 || (signed int)(unsigned __int16)wParam <= 0 || (signed int)(unsigned __int16)wParam > 2 )
    return 0;
  v5 = GetWindowLongW(hwndDlg, 8);
  *(_DWORD *)(v5 + 8) = dword_105A048;
  *(_DWORD *)(v5 + 4) = hMem;
  hMem = 0;
  EndDialog(hwndDlg, (unsigned __int16)wParam);
  return 1;
}

NOTE: these are just some selected examples that can be illustrated as a side-by-side difference. Hex-Rays Decompiler v1.6 includes are many other improvements and new features that are not mentioned on this page - simply because there was nothing to compare them with. Also, some improvements have already been illustrated in the previous comparisons. Please refer to the for more details.

iv class="cmptell"> The decompiler knows how to use the macro it the output to get rid of typecasts. As soon as the variable types are correctly set, it replaces casts with a simple macro call.

We added recognition of macros. While not all cases are handled yet, it usually works quite well. Saves you from the mental effort of recognizing these macros yourself.

No more cryptic offsets anymore. As an additional bonus, the decompiler automatically determines variable types because it can use the . By the way, KPCR fields are recognized too, you just need to load the corresponding til file!

While it is not pure C, we feel that using C++ style structure copying operations in the output adds to clarity. The above sample is almost perfect, this only possible improvement is to _this to this. The new decompiler can do that, read our for more info.

There is a common compiler optimization that reuses the same call instruction for different calls. Of the left side, the WinHelpA() call is used in two different situations. The decompiler had to use a goto statement because it could not represent the code with constructs.

news page
CONTAINING_RECORD
LIST_ENTRY
TEB layout
map
blog post
structured programming
Inline CFString constants
More humanly if-conditions
Support for CONTAINING_RECORD macro
Support for LIST_ENTRY macros
Better tail call recognition
Improved memset recognition
Support for TEB/KPCR references
Better char/short variable recognition
Better recognition of inline functions
Structure copying - 1
Structure copying - 2
Structure copying - 3
Support for union fields
Support for merged calls