LogoLogo
IDA 9.0
IDA 9.0
  • Welcome to Hex-Rays docs
    • What's new?
  • Getting Started
    • Install IDA
    • Licensing
    • Basic Usage
    • What's next?
  • User Guide
    • User Interface
      • Menu Bar
        • File
          • Load file
          • Script File
          • Script command
          • Produce output files
          • Invoke OS Shell
          • Take database snapshot
          • Save database
          • Save database as...
          • Abort IDA
          • Exit IDA
        • Edit
          • Export data
          • Undo an action
          • Redo an action
          • Clear undo history
          • Disable undo
          • Convert to instruction
          • Convert to data
          • Convert to string literal
          • Convert to array
          • Undefine a byte
          • Give Name to the Location
          • Operand types
            • Offset
            • Number
            • Perform en masse operation
            • Convert operand to character
            • Convert operand to segment
            • Complex Offset Expression
            • Convert operand to symbolic constant (enum)
            • Convert operand to stack variable
            • Change operand sign
            • Bitwise negate operand
            • User-defined operand
            • Set operand type
          • Comments
          • Functions
          • Structs
          • Segments
          • Patch core
          • Other
            • Rename Any Address
          • Plugins
        • Jump
          • Center current line in window
          • Problems List
        • Search
          • REGULAR EXPRESSION SYNTAX SUMMARY
        • View
          • Open subviews
          • Graphs
          • Message Window
          • Arrows window
          • Database snapshot manager
          • Highlighting identifiers
          • Browser options
          • Lumina options
          • Assembler level and C level types
          • C++ type details
          • Bookmarks window
          • Calculator
          • View segment registers
          • View Internal Flags
          • Hide
          • Unhide
          • Del hidden range
          • Hide all items
          • Unhide all items
          • Setup hidden items
        • Debugger
          • Debugger window
          • Process Control
            • Start process
            • Process options
            • Pause process
            • Terminate process
            • Step into
            • Step over
            • Run to cursor
            • Run until return
            • Attach to process
            • Detach from process
            • Set current ip
            • Show application screen
          • Breakpoints
          • Watches
          • Tracing
          • Source code view
            • Watch view (source level)
          • Process Memory
            • Take memory snapshot
            • Manual memory regions
            • Refresh memory
          • Thread list
          • Module list
          • Stack trace
          • Exceptions
          • Debugger options
          • Switch debugger
        • Lumina
        • Options
          • Low & High Suspicious Operand Limits
        • Windows
          • Rename a stack variable
          • Miscellanous Options
          • Environment variables
          • Reset Hidden Messages
          • Various dialog help messages
        • List of all menu options
      • Desktops
      • Command line
      • How To Use List Viewers in IDA
      • Licenses
        • Apache License for Ghidra
        • Apache License for LLVM
        • Common Public License Version 1.0
        • APPLE PUBLIC SOURCE LICENSE
        • PCRE2 LICENCE
        • GNU Lesser General Public License v2.1 for libiberty
      • Database conversion from idb to i64
    • Disassembler
      • Interactivity
      • Background Analysis
      • Graph view
        • Graphing tutorial
      • Proximity view
      • Navigation
        • Anchor
        • How to Enter a Segment Value
        • How to Enter a Number
        • How to Enter an Identifier
        • How to enter text
        • How to Enter an Address
      • Disassembly Gallery
        • Philips 51XA-G3
        • 6502 and 65C02 Disassembler
        • 6301, 6303, 6800, 6801 and 6803 Disassembler
        • 68040, Amiga
        • 6805 Disassembler
        • 6808 Disassembler
        • 6809 OS9 Flex Disassembler
        • 6809 Disassembler
        • 6811 Disassembler
        • 68HC12 Disassembler
        • 68HC16 Disassembler
        • 68k Amiga Disassembler
        • 68k Mac OS
        • 68k Palm Pilot
        • Unix COFF
        • NEC 78k0 and 78k0s Processor
        • 80196 Processor
        • 8051 Disassembler
        • Analog Devices 218x.
        • Alpha Processor – NT COFF
        • Alpha Processor – Unix ELF
        • Android ARM Executables (.elf)
        • ARC Processor
        • ARM Processor EPOC App
        • ARM Processor EPOC PE File
        • ARM Processor EPOC ROMFile
        • EPOC SIS File Handler
        • ARM Processor iOS (iPhone): Unlock
        • ARM Processor iOS (iPhone): Objective-C metadata
        • ARM Processor iOS (iPhone): Objective-C Instance variables
        • ARM Processor iOS (iPhone): Parameter Identification & Tracking (PIT)
        • ARM Processor iOS (iPhone): Start
        • ARM Processor iOS (iPhone): Switch statements
        • ARM Processor iOS (iPhone): C++ signatures
        • ARM Processor iOS (iPhone): Write
        • ARM Processor: Linux ELF
        • ARM Processor: AOF SDK
        • ARM Processor: Windows CE COFF Format
        • ARM Processor: Windows CE PE Format
        • ATMEL AVR Disassembler
        • C166 Processor
        • C166 Processor with ELF file
        • Rockwell C39
        • Microsoft .NET CLI Disassembler. VisualBasic library
        • CR16
        • Android Dalvik Executables (.dex)
        • Microsoft .NET CLI Disassembler
        • DSP56K
        • Fujitsu FR (.elf)
        • Gameboy
        • H8 300: COFF FILE Format
        • H8 300s: COFF FILE Format
        • H8 500
        • HPPA Risc Processor: HP-UX SOM
        • i51
        • i860
        • Intel i960
        • Intel IA-64 (Itanium)
        • Java Bytecode
        • Angstrem KR 1878
        • Renesas/Hitachi M16C
        • Renesas/Hitachi M32R
        • M740
        • M7700
        • M7900
        • MIPS Processor: Nintendo N64
        • MIPS R5900 Processor : Sony bin
        • MIPS Processor: Sony ELF
        • MIPS Processor: Sony PSX
        • MIPS Processor: Sony PSX
        • MIPS Processor: Unix COFF File Format
        • MIPS Processor: Unix ELF File Format
        • MIPS Processor: Windows CE PE File Format
        • MIPS Processor: Windows CE PE2 File Format
        • Panasonic MN102
        • Atmel OAK DSP
        • 80×86 Architecture: DOS Extender
        • 80×86 Architecture: Watcom Runtime
        • 80×86 Architecture: Geos APP
        • 80×86 Architecture: Geos DRV
        • 80×86 Architecture: Geos LIB
        • 80×86 Architecture: GNU COFF Format
        • 80×86 Architecture: OS/2 Linear Executable Format
        • 80×86 Architecture: Netware NLM
        • 80×86 Architecture: QNX Executable
        • 80×86 Architecture: Watcom Runtime
        • 80×86 Architecture: Windows OMF
        • 80×86 Architecture: Windows Portable Executable Format
        • 80×86 Architecture: Windows Virtual Device Driver
        • 80×86 Architecture: Windows 16 bits DLL
        • X-Box Disassembler
        • PDP 11: SAV File
        • PIC
        • PIC 12xx
        • Power PC AIF ECOFF file Format
        • Power PC Linux ELF
        • Mac OS PEF File
        • Mac OS X File
        • Windows NT PE File
        • Hitachi SH-1 Processor
        • Hitachi SH-3 Processor: Windows CE COFF format
        • Hitachi SH-3 Processor: Windows CE PE format
        • Hitachi SH-4 Processor: ELF File Format
        • Hitachi SH-4 Processor: Windows CE PE File Format
        • Super Nintendo Entertainement System (SNES)
        • SPARC Solaris COFF
        • SPARC Solaris ELF
        • SPARC Sun ELF
        • SPARC Sun ELF SO
        • ST 20C4
        • ST 7
        • ST 9
        • Toshiba TLCS 900
        • TMS 320c2 COFF
        • TMS 320c5
        • TMS 320c54
        • TMS 320c6 COFF File Format
        • TRICORE
        • SunPlus unSP
        • NEC V850
        • Z180 COFF File Format
        • Z380 COFF File Format
        • Z8
        • Z80
      • Supported processors
      • Supported file formats
        • Windmp file loader
      • Bitfields
        • Bit Fields tutorial
      • Structures tutorial
      • Union tutorial
      • Variable length structures tutorial
      • Data types, operands and constructs
      • Packed executables
    • Decompiler
      • Prerequisites
      • Quick primer
      • Exception handler
      • Introduction to Decompilation vs. Disassembly
        • Comparisons of ARM disassembly and decompilation
        • Comparisons of PowerPC disassembly and decompilation
        • Comparisons of MIPS disassembly and decompilation
        • Hex-Rays v7.4 vs. v7.3 Decompiler Comparison Page
        • Hex-Rays v7.3 vs. v7.2 Decompiler Comparison Page
        • Hex-Rays v7.2 vs. v7.1 Decompiler Comparison Page
      • Interactive operation
        • Rename
        • Set type
        • Set number representation
        • Edit indented comment
        • Edit block comment
        • Hide/unhide C statements
        • Split/unsplit expression
        • Force call type
        • Set call type
        • Add/del variadic arguments
        • Del function argument
        • Add/delete function return type
        • Jump to cross reference
        • Jump to cross reference globally
        • Generate HTML file
        • Mark/unmark as decompiled
        • Copy to assembly
        • Show/hide casts
        • Reset pointer type
        • Convert to struct *
        • Create new struct type
        • Split variable
        • Select union field
        • Jump to paired paren
        • Collapse/uncollapse item
        • Map to another variable
      • Batch operation
      • Configuration
      • Third party plugins
      • Floating point support
      • Support for intrinsic functions
      • Overlapped variables
      • gooMBA
      • Failures and troubleshooting
      • FAQ
      • Limitations
      • Tips and tricks
    • Debugger
      • Instant debugger
      • Remote debugging
        • Remote iOS Debugger
        • Android debugger
        • Dalvik debugger
        • Remote GDB Debugger
          • Remote GDB Debugger options
          • Debugging with gdbserver
          • Debugging with VMWare
          • Debugging with OpenOCD
          • Debugging with QEMU
          • External programs and GDB Debugger
          • Debugging code snippets with QEMU
        • PIN debugger
          • Building the PIN tool
          • Connecting a remote PIN tool instance from IDA
          • PIN support for MacOSX
        • Replayer debugger
        • Bochs debugger
          • Bochs Disk Image operation mode
          • Bochs IDB operation mode
          • Bochs PE operation mode
          • Bochs debugger FAQ
      • Local debugging
        • WinDbg Debugger
        • Linux debugger
        • Intel/ARM macOS debugger
      • Debugger tutorials
        • Debugging Dalvik Programs
        • IDA Win32 Local Debugging
        • IDA Linux Local Debugging
        • IDA Linux to Win64 Debugging
        • IDA Win32 to Linux Debugging
        • Debugging Mac OSX Applications with IDA Pro
        • Debugging iOS Applications using CoreDevice (iOS 17 and up)
        • Debugging iOS Applications with IDA Pro
        • Debugging Linux Applications locally
        • Debugging Linux/Windows Applications with PIN Tracer module
        • Debugging Windows Applications with IDA Bochs Plugin
        • Debugging Windows Applications with IDA WinDbg Plugin
        • Using the Bochs debugger plugin in Linux
        • Debugging Windows Kernel with VMWare and IDA WinDbg Plugin
        • Debugging Linux Kernel under VMWare using IDA GDB debugger
        • Windows Debugger Hub
        • Linux Debugger
        • Debugging a Windows executable locally and remotely
        • Debugging the XNU Kernel with IDA Pro
        • Remote debugging with IDA Pro
        • IDA Scriptable Debugger: overview
          • IDA Scriptable Debugger: scriptability
        • Debugging code snippets with QEMU debugger (a la IDA Bochs debugger)
        • Trace Replayer and managing traces
        • Using IDA Pro's tracing features
        • Working with PIN
        • Appcall
    • Creating Signatures
      • FLIRT
        • IDA F.L.I.R.T. Technology: In-Depth
        • Generate FLIRT signature file
        • Supported Compilers
          • Turbo Pascal
          • Delphi
      • Makesig
    • Creating Type Libraries
      • IDAClang
      • TILIB
    • Configuration
      • Configuration files
      • Command line switches
      • Keyboard macros
      • UI/Fonts/Themes
      • Shortcuts
      • Customizing IDA
      • CSS-based styling
    • Teams
      • IDA Teams Licenses
      • Diffing and Merging Databases with IDA Teams
      • Teams lc command reference manual
      • hv command reference manual
      • Hex-Rays Vault’s visual client user manual
    • Lumina
      • lc command reference manual
    • Plugins
      • Open Plugin Architecture
      • Plugin options
      • Plugins Shipped with IDA
        • Swift plugin
        • Golang plugin
        • Rust plugin
        • picture_search
        • Objective-C Analysis Plugin
        • DYLD Shared Cache Utils
        • Borland RTTI descriptors plugin
        • DWARF plugin
        • Patfind plugin
        • IDA Feeds
          • FLIRT Signature Bundle
      • Plugin Contest
      • How to write your own plugin?
    • Helper Tools
    • idalib
  • Developer Guide
    • C++ SDK
      • Getting Started with C++ SDK
      • C++ SDK Reference
      • Using the Decompiler SDK: Decompiler plugin
      • C++ SDK examples
      • How to create a plugin in C++?
      • C++ SDK Porting Guide from IDA 8.x to 9.0
    • IDAPython
      • Getting started with IDAPython
      • IDAPython API Reference
      • IDAPython examples
      • How to create a plugin in IDAPython?
      • IDAPython Porting Guide from IDA 8.x to 9.0
    • IDC
      • Core concepts
        • Expressions
        • Statements
        • Functions
        • Variables
        • Constants
        • Exceptions
        • Classes
        • Predefined symbols
        • loader_input_t class
        • Slices
      • IDC API Reference
        • Index of debugger related IDC functions
        • Alphabetical list of IDC functions
          • is_member_id
          • load_type
          • get_member_by_idx
          • get_ordinal_limit
          • set_selector
          • enable_tracing
          • get_prev_fixup_ea
          • del_segm
          • get_bmask_cmt
          • end_type_updating
          • Find
          • toggle_bnot
          • patch_byte
          • get_module_info
          • set_member_name
          • create_float
          • del_struc_member
          • read_dbg_memory
          • get_enum_width
          • getn_thread_name
          • del_struc
          • filelength
          • set_manual_insn
          • is_value...() functions
          • get_ip_val
          • del_extra_cmt
          • create_insn
          • op_offset_high16
          • get_cmt
          • expand_struc
          • get_idb_path
          • set_frame_size
          • get_file_ext
          • has_value
          • readshort
          • sanitize_file_name
          • get_member_flag
          • create_struct
          • ARM specific
          • set_enum_member_cmt
          • rename
          • set_ida_state
          • get_member_size
          • msg
          • qbasename
          • get_enum_member_enum
          • auto_mark_range
          • plan_to_apply_idasgn
          • set_named_type
          • op_offset
          • rename_entry
          • strlen
          • get_extra_cmt
          • get_enum_flag
          • fgetc
          • op_stkvar
          • get_last_index
          • get_field_ea
          • get_struc_id
          • select_thread
          • create_array
          • get_struc_cmt
          • set_array_string
          • set_func_attr
          • set_storage_type
          • get_struc_size
          • demangle_name
          • get_next_fixup_ea
          • get_next_bmask
          • delattr
          • gen_simple_call_chart
          • patch_qword
          • get_enum_name
          • loader_input_t.getc
          • get_debugger_event_cond
          • read_dbg_qword
          • define_local_var
          • generate_disasm_line
          • add_idc_hotkey
          • tolower
          • del_selector
          • set_debugger_event_cond
          • get_imagebase
          • gen_file
          • get_entry
          • find_custom_data_format
          • get_debug_name_ea
          • add_default_til
          • set_func_end
          • exit_process
          • delete_array
          • xtol
          • get_exception_code
          • detach_process
          • set_enum_cmt
          • get_wide_word
          • put_bookmark
          • is_loaded
          • add_enum_member
          • parse_decls
          • readstr
          • get_entry_qty
          • ord
          • sprintf
          • get_root_filename
          • get_enum_member_cmt
          • create_word
          • set_func_flags
          • loader_input_t.tell
          • create_align
          • read_dbg_dword
          • next_addr
          • get_bytes
          • batch
          • start_process
          • process_config_line
          • del_user_info
          • qmakefile
          • set_struc_name
          • print_decls
          • create_custom_data
          • del_enum_member
          • format_cdata
          • get_fixup_target_sel
          • get_item_size
          • loader_input_t.gets
          • get_last_bmask
          • Step Tracing Options
          • selector_by_name
          • get_enum_cmt
          • next_not_tail
          • prev_head
          • set_color
          • set_numbered_type
          • get_member_name
          • auto_wait
          • get_enum_member_bmask
          • fseek
          • get_segm_start
          • attach_process
          • Trace file functions
          • get_enum_member_value
          • op_stroff
          • get_next_offset
          • set_processor_type
          • get_bookmark_desc
          • create_data
          • lastattr
          • get_operand_value
          • collect_stack_trace
          • toupper
          • get_fixup_target_dis
          • set_cmt
          • add_entry
          • set_segm_addressing
          • qmake_full_path
          • get_source_linnum
          • fputc
          • resume_thread
          • get_func_attr
          • get_first_enum_member
          • add_sourcefile
          • get_first_bmask
          • read_selection_start
          • hasattr
          • get_member_cmt
          • gen_flow_graph
          • get_array_element
          • get_tinfo
          • loader_input_t
          • tinfo_errstr
          • TRUNC
          • add_segm_ex
          • Local types information and manipulation helpers
          • set_source_linnum
          • get_next_enum_member
          • loader_input_t.readbytes
          • set_array_params
          • jumpto
          • get_bookmark
          • set_enum_bf
          • prev_not_tail
          • toggle_sign
          • loader_input_t.size
          • Trace events functions
          • get_func_flags
          • get_gotea
          • set_segm_attr
          • get_item_head
          • set_default_sreg_value
          • print_insn_mnem
          • set_member_cmt
          • get_ordinal_qty
          • set_target_assembler
          • add_user_stkpnt
          • set_local_type
          • Hidden ranges
          • del_items
          • compile_idc_text
          • Dalvik debugger extension functions
          • byte_value
          • create_dword
          • is_code
          • del_func
          • get_enum
          • make_array
          • rotate_left
          • recalc_spd
          • search_path
          • CommonBits
          • get_processor_name
          • set_func_cmt
          • get_prev_bmask
          • Hashes
          • split_sreg_range
          • process_ui_action
          • set_fixup
          • get_fixup_target_type
          • create_oword
          • get_flags
          • get_func_name
          • create_strlit
          • add_struc
          • atol
          • load_debugger
          • mkdir
          • sizeof
          • get_enum_member_by_name
          • save_database
          • guess_type
          • get_segm_name
          • print_operand
          • qisabspath
          • get_member_qty
          • set_struc_cmt
          • get_fixup_target_flags
          • idadir
          • object.retrieve
          • add_auto_stkpnt
          • get_numbered_type_name
          • get_enum_member_name
          • get_next_index
          • prev_addr
          • get_name_ea
          • get_sp_delta
          • set_bmask_cmt
          • readlong
          • set_segm_name
          • get_prev_offset
          • set_segm_alignment
          • get_strlit_contents
          • forget_exception
          • get_item_end
          • add_func
          • get_name
          • Asks
          • get_spd
          • Debugger: control
          • get_wide_byte
          • plan_and_wait
          • set_enum_flag
          • RunPythonStatement
          • del_sourcefile
          • find_selector
          • get_frame_regs_size
          • op_num
          • define_exception
          • create_double
          • create_byte
          • read_selection_end
          • OpTypes
          • op_plain_offset
          • move_segm
          • get_member_id
          • set_segm_combination
          • get_current_thread
          • trim
          • Debugger: options
          • getn_thread
          • get_frame_id
          • typeinfo.print
          • to_ea
          • rebase_program
          • add_struc_member
          • get_exception_qty
          • get_first_index
          • import_type
          • set_segm_type
          • find_custom_data_type
          • get_next_seg
          • find_func_end
          • get_last_enum_member
          • getattr
          • get_frame_size
          • get_screen_ea
          • loader_input_t.read
          • set_reg_value
          • Debugger: modules
          • create_pack_real
          • writestr
          • exec_idc
          • get_enum_size
          • set_enum_name
          • create_tbyte
          • sel2para
          • atoa
          • loader_input_t.close
          • add_enum
          • ltoa
          • substr
          • del_idc_hotkey
          • Breakpoint handling functions
          • loader_input_t.seek
          • cleanup_appcall
          • object.store
          • get_type
          • qexit
          • get_debug_name
          • get_array_id
          • Can't Open File
          • suspend_process
          • process_config_directive
          • get_entry_name
          • get_last_member
          • get_struc_name
          • clear_selection
          • fclose
          • firstattr
          • create_yword
          • dbg_appcall
          • get_qword
          • patch_dword
          • begin_type_updating
          • read_dbg_byte
          • get_fpnum
          • qsleep
          • get_first_member
          • get_nsec_stamp
          • del_stkpnt
          • eval
          • savefile
          • eval_python
          • Xrefs
          • strstr
          • writeshort
          • get_sreg
          • get_segm_end
          • get_func_off_str
          • set_func_start
          • del_array_element
          • get_full_flags
          • set_exception_flags
          • rename_array
          • get_frame_args_size
          • op_flt
          • get_min_spd_ea
          • apply_type
          • get_prev_index
          • loadfile
          • retrieve_input_file_md5
          • get_wide_dword
          • patch_dbg_byte
          • Functions provided by the WinDbg debugger
          • get_original_byte
          • get_member_strid
          • call_system
          • writelong
          • get_thread_qty
          • nextattr
          • send_dbg_command
          • get_first_seg
          • get_processes
          • patch_word
          • get_manual_insn
          • ftell
          • get_entry_ordinal
          • set_array_long
          • delete_all_segments
          • TO_LONG
          • Function chunk related functions
          • Debugger: events
          • get_prev_func
          • op_seg
          • validate_idb_names
          • fprintf
          • fopen
          • strfill
          • del_fixup
          • get_bmask_name
          • inf_attr
          • is_bf
          • read_dbg_word
          • qdirname
          • get_segm_attr
          • func_contains
          • del_source_linnum
          • get_sourcefile
          • clr_database_flag
          • set_name
          • Refresh Screen
          • op_enum
          • getn_enum
          • get_db_byte
          • setattr
          • get_forced_operand
          • op_bin
          • Functions provided by the replayer debugger
          • prevattr
          • update_extra_cmt
          • get_str_type
          • op_man
          • choose_func
          • set_bmask_name
          • get_curline
          • decode_insn
          • set_segment_bounds
          • set_segm_class
          • write_dbg_memory
          • get_exception_name
          • get_enum_member
          • is_mapped
          • del_enum
          • get_frame_lvar_size
          • get_operand_type
          • set_root_filename
          • compile_idc_file
          • typeinfo.size
          • get_local_tinfo
          • get_fixup_target_off
          • is_union
          • unlink
          • get_segm_by_sel
          • set_enum_width
          • take_memory_snapshot
          • exec_python
          • get_next_func
          • get_member_offset
          • get_func_cmt
          • parse_decl
          • create_qword
          • next_head
          • suspend_thread
          • loader_input_t.getz
          • get_color
          • get_reg_value
          • load_and_run_plugin
          • set_database_flag
          • set_enum_member_name
          • set_member_type
          • get_prev_enum_member
      • IDC examples
        • Analyzing encrypted code
  • Admin Guide
    • Lumina server
    • Teams server
    • License server
      • Hex-Rays License Server Migration Guide
  • Release Notes
    • IDA 9.0
    • IDA 8.4sp2
    • IDA 8.4sp1
    • IDA 8.4
    • IDA 8.3
    • IDA 8.2sp1
    • IDA 8.2
    • IDA 8.1
    • IDA 8.0sp1
    • IDA 8.0
    • IDA 7.7sp1
    • IDA 7.7
    • IDA 7.6sp1
    • IDA 7.6
    • IDA 7.5sp3
    • IDA 7.5sp2
    • IDA 7.5sp1
    • IDA 7.5
    • IDA 7.4sp1
    • IDA 7.4
    • IDA 7.3
      • IDA 7.3 Undo: IDA can do it
    • IDA 7.2
      • IDA 7.2 The Mac Rundown
    • IDA 7.1
      • IDA 7.1 Debugger API 7.1 Porting Guide
    • IDA 7.0sp1
    • IDA 7.0
      • Internationalization (i18n)
      • Automatic discovery of string literals
      • API 7.0 Porting Guide
      • IDAPython backward compatibility
    • IDA 6.95
    • IDA 6.9
    • IDA 6.8
    • IDA 6.7
    • IDA 6.6
    • IDA 6.5
    • IDA 6.4
    • IDA 6.3
    • IDA 6.2
    • IDA 6.1
    • IDA 6.0
    • IDA 5.7
    • IDA 5.6
    • IDA 5.5
      • 5.5 Gallery
      • 5.5 Comparison
    • IDA 5.4
    • IDA 5.3
    • IDA 5.2
    • IDA 5.1
    • IDA 5.0
    • IDA 4.9SP
    • IDA 4.9
    • IDA 4.8
    • IDA 4.7
    • IDA 4.6
    • IDA 4.x
    • IDA 3.x
    • Cumulative bugfix for IDA
  • Archive
    • IDA’s Windbg plugin
    • IDA’s Bochs debugger plugin
    • IDA’s Bochs debugger plugin 2
    • DosWin32
    • Hex-Rays v1.1 vs. v1.0 Decompiler Comparison Page
    • Hex-Rays v1.2 vs. v1.1 Decompiler Comparison Page
    • Hex-Rays v1.3 vs. v1.2 Decompiler Comparison Page
    • Hex-Rays v1.6 vs. v1.5 Decompiler Comparison Page
    • Hex-Rays v1.7 vs. v1.6 Decompiler Comparison Page
    • Costly Greetings – An Adventure In Hostile Code Analysis
    • An Adventure In Hostile Code Analysis: Description
    • An Adventure In Hostile Code Analysis: Disassembly
    • Improved code flow analysis
    • Program Navigation Bar
    • IDA Home Contest
    • Pimp My IDA: vote results
    • Turning off IDA 6.x compatibility in IDAPython
    • Porting guide for IDA 7.4 turning off IDA 6.x API backwards-compatibility by default
    • Porting guide for IDA 7.4 IDAPython and Python 3
    • IDAPython and Python 3
    • Porting guide for changes in IDAPython-on-Python-3 APIs
    • Debugging iOS Applications With IDA
    • IDA Win32 to Win32 Debugging
    • IDA Win32 to Win64 Debugging
    • Legacy license server: Floating Licenses
      • Installing on Linux
      • Installing on Windows
      • Installing on OS X
    • Decompiler Installation
    • Enumerated types tutorial
  • Bug Bounty
Powered by GitBook
LogoLogo

Need Help?

  • FAQs
  • Support

Community

  • Forum
  • Plugins

Resources

  • Blog
  • Download center

© 2025 Copyright Hex-Rays

On this page

Was this helpful?

Export as PDF
  1. Release Notes

IDA 5.2

Highlights

Improved iPhone support

IDA 5.2 handles iPhone executables out of the box.

Much improved ARM and PowerPC support

The updated ARM module supports 200 new instructions. This module started with mere 38 instructions: the ARM was a small and sleek processor; now it boasts 3 different instruction encodings [arm, thumb, thumb32], dsp, floating point, vector, simd, and even java instructions!

Much improved PowerPC module

The PowerPC module has ~40 new instructions.\

Easy debugger scripts in IDC

The debugger is finally available from IDC. There is no need to write complex plugins, install event handlers and express the logic in a finite state machine form. Simple and natural functions that allow to wait for the next debugger event and continue the script without yielding control to the ida kernel have been introduced.

Improved type support

The type system has been improved to support types of abitrary length and complexity (there was a limitation of 1024 bytes per type descriptor). The user interface offers a new window to display and manipulate local types. This allows for easy migration of types from one database to another. You can even export all local types in a compiler readable form!

Detailed list of changes\

Changelist

Processor Modules

  • 6811: the output is more conforming to Motorola freeware assemblers (thanks for Alex Bratovic)

  • 68xx: CodeWarrior and GNU output support have been added by Alex Bratovic

  • ARM: add/sub instructions are better emulated

  • ARM: added bxj insn (Igor Skochinsky)

  • ARM: added one more switch pattern (Igor Skochnisky)

  • ARM: added RealView v3.1 low-endian signatures

  • ARM: added recognition of rt_switch8() function (Igor Skochinsky)

  • ARM: added support for v6ZK instructions

  • ARM: added support for VFP (vector floating point) instructions

  • ARM: added thumb32 encodings and v7 instructions

  • ARM: analysis of some pc-relative addressing modes has been improved (notable difference for iphone executables)

  • ARM: armv6 instructions are supported

  • ARM: better propagation of thumb-bit; more glue code patterns are recognized

  • ARM: better recognition of thunk functions and flow detection

  • ARM: better register tracking in the thumb mode

  • ARM: BX LR is considered as a return instruction

  • ARM: more intelligent handling of immediate values in instructions; they are converted to offsets only in the second analysis pass and only if the kernel option permits it

  • ARM: more jump tables are recognized

  • ARM: more return instruction forms are recognized

  • ARM: more thumb-mode macro instructions are recognized (this and many other arm improvements thanks to Igor Skochnisky)

  • ARM: much better handling of glue code

  • ARM: noreturn-analysis has been turned on for ARM

  • ARM: some pc-relative addressing modes were not supported

  • ARM: thumb glue handling has been improved

  • ARM: "push lr" is considered as a function start

  • ARM FMXR/FMRX: added VFP system registers FPINST, FPINST2, MVFR1, MVFR0 (by Igor)

  • ARM: better tracing of the stack pointer

  • ARM: more jumptables are recognized (Igor)

  • ARM: skip irrelevant instruction during function frame analysis

  • M32R: added floating point and bit instructions

  • MIPS: automatically determine $gp value for pic programs (heuristic rule)

  • PC: call insn with the sole purpose of obfuscating the code are recognized

  • PC: prolog analysis has been improved

  • PC: thunk functions have priority over function chunks

  • PC: XlatAsciiOutput translation is applied to the hex view and unexplored byte comments

  • PPC: added support for ~40 new instructions

  • SH3: added support for i/o port config files; sign extend byte/word immediate transfers

  • TMS320C55: added support for 6-byte instructions and some undocumented parallel instructions (thanks to Roman Vasiliev & Ivan Litvin)

File Formats

  • ELF: added handling of the R_X86_64_RELATIVE relocation type

  • ELF: arm: some elf files have low bit 1 in the thumb function addresses; ignore it

  • ELF: improved processing of .got section in elf files

  • ELF: pc: added support for 64bit gotpcrel and plt relocation types

  • added support for iPhone Mach-O files (no relocations yet)

  • MACHO: entry point of arm executables is detected

  • MACHO: 64bit macho files are supported; better reloc handling; cfstring handling (all by Igor Skochinsky)

  • MACHO: added handling of arm relocations; thumb-exports; (thanks to Igor Skochinsky)

  • support for SunOS a.out file format has been added (an ida user contribution)

  • TDS: OPTVAR32 records are handled

Kernel

  • Added an option not to truncate functions upon code deletion

  • added noret.cfg with the names of non-returning functions

  • added support for new visual studio mangling schemes (thanks to Yury Haron)

  • added support for the #include_next directive in the c header parser

  • anomalious situations when the same block was repeatedly converted to code and back to data are better handled

  • FLAIR: added support for reaview libraries

  • do not automatically create non-zero page unicode strings (usually it is wrong)

  • new analysis option: ignore control flow to pure data segments. it is off by default except for mach-o files

  • new keyword in function prototypes: __spoils<reglist>. It specifies the list of spoiled registers for non-standard functions

  • new switch -L can be used to specify the name of the log file

  • non-zero page unicode strings are displayed in a more readable form

  • propagate function names from export thunks to function implementations

  • updated gnuunx.til

  • do not create data array in the stack segment if it contains the entry point

  • references to local types are made by their ordinal numbers

  • structure/enum modifications are automatically synchronized into local til

Scripts & SDK

  • added more debugger related IDC functions and reimplemented the core functionality of uunp in IDC

  • c parser: accept preprocessor macros in include directives

  • IDC: Added Eval(), IsString(), IsLong(), IsFloat() functions

  • IDC: added GenFuncGdl() and GenCallGdl() functions to generate GDL files

  • IDC: added high level debugger functions to idc; now it is possible to write scripts to control the debugger

  • IDC: added functions to manipulate local types

  • IDC: string variables can hold strings > 1023 characters

  • SDK: add_chooser_command() to add user-defined actions to chooser windows

  • SDK: added a callback for mouse click events in custom viewers; graph viewers are custom viewers too and all custom viewer functions can be used with them

  • SDK: added pc_module_t::find_reg_value callback so that plugins can find register values if necessary

  • SDK: added readsel2() to get more info about the current selection

  • SDK: added reserve(), capacity(), swap() functions to the qvector template class

  • SDK: added set_custom_viewer_range()

  • SDK: added support for negative operand values in offsets; the kernel will use a negative value if the OOF_SIGNED bit is used in outflags; PPC and M32R listings are much better

  • SDK: added wait_for_next_event() and get_debug_event() functions

  • SDK: almost all type-related functions have til_t as the first parameter; this will allow us to introduce local type libraries and local types in the future

  • SDK: more efficient (but more memory hungry) implementation of qvector::resize()

  • SDK: new event ui_ready_to_run: occurs when the user interface is fully initialized. this event can be used to run automatic actions from plugins

  • SDK: new function compact_til() should be called before storing til file to the disk; otherwise store_til() will compact the til anyway

  • SDK: new function: parse_reg_name()

  • SDK: ph.calc_arglocs has been superseded by ph.calc_arglocs2 (optimization)

  • SDK: prototypes of type-related functions have been modified to support unlimited type strings; old functions are still available but their use is strongly discouraged

  • SDK: qeprintf() function to print on stderr has been exported

  • SDK: qsplitpath() function has been replaced by qdirname()

  • SDK: replaced value_t with idc_value_t, a class which allocated/frees memory itself and does not require manual handling

  • SDK: show_wait_box() can display dialogs with the "cancel" button. For that, pass the wait messager prefixed with "HIDECANCEL\n"

  • SDK: added export_type() to copy struct/enum definitions to til improved local til view

  • SDK: added new functions: for_all_types(), replace_subtypes(), create_numbered_type_name()

  • SDK: added print_type_to_qstring(), a generic type printing function

  • SDK: added ui_open_builtin callback and corresponding functions

  • SDK: introduced compile time constant: IDA_SDK_VERSION

  • SDK: introduced request_refresh() for more efficient window refreshing; this function allows the programmer to specify exactly what windows must be refreshed

User Interface

  • ui: remember input field history in the registry (gui)

  • ui: added menu items to produce GDL files (flow chart and call graph)

  • ui: breakpoint commands are available in the "occurrences of..." lists

  • ui: if a saved desktop is incompatible with the current screen resolution, inform the user in the message window

  • ui: local type definitions can be manipulated in the new "local types" window

  • ui: local type library can be synchronized to the current idb and vice versa

  • ui: text search results have one more column: function name

  • ui: added "export local types to header file" command (right click in the local types window)

  • ui: Shift-F1 opens the local types window

Bugfixes

  • BUGFIX: -o switch would cause get_input_file_path() to return wrong value

  • BUGFIX: "can't assign to segment register" was displayed on some object files

  • BUGFIX: 16-bit PIC instruction that skip the next instruction were not taken into account during the analysis

  • BUGFIX: 64bit delayed import tables were parsed incorrectly; 32-bit import tables could have an extra empty slot at the end

  • BUGFIX: 68k: 2-byte floating point constants in instructions were decoded incorrectly

  • BUGFIX: ad218x: CF_JUMP bit was set for wrong insns

  • BUGFIX: add_regvar was incorrectly handling the situation when a register is redefined in a smaller range

  • BUGFIX: adding xrefs from the user interface was adding only code xrefs

  • BUGFIX: an access violation could occur during the analysis of huge and complex programs with fragmented functions

  • BUGFIX: ar2idt was broken

  • BUGFIX: arm $-auxiliary symbols in elf files were not always handled

  • BUGFIX: arm: bx thumb_code was creating wrong xrefs if the target address has the low 2 bits set

  • BUGFIX: build_funcarg_arrays() would fail on typedefed function types

  • BUGFIX: build_funcarg_info() could return >= 0 for a non-function type

  • BUGFIX: c parser: enum members starting with an underscore could not be used in other enum declarations

  • BUGFIX: Cbuilder 5.1 has a bug in realloc(), added a workaround

  • BUGFIX: closing forms with customized "No" button by clicking on the X window close button would return "true" as if the user pressed OK

  • BUGFIX: complex type names could be intermixed during get_type_size()

  • BUGFIX: corrupted database would cause an access violation if an unexisting function tail was removed

  • BUGFIX: could display an internal error on old database with partial jump table information attached to indirect jumps

  • BUGFIX: could not debug new PocketPC devices because the processor was detected as xscale for some reason (thanks to Alexander Alkhovik for the tests)

  • BUGFIX: curloc() destructor could spoil database (in theory)

  • BUGFIX: demangler mode was set incorrectly

  • BUGFIX: epoc file without import table could not be loaded

  • BUGFIX: epoc idata section was not created in the text version

  • BUGFIX: epoc loader could crash trying to load incorrect input files

  • BUGFIX: EPOCV9 target processor type was not detected correctly

  • BUGFIX: extern "C" { extern... could not be parsed

  • BUGFIX: F12 (generate graph for wingrap32) was creating too many outgoing edges for some nodes

  • BUGFIX: FLAIR signature files with names 1023 chars or longer could not be loaded

  • BUGFIX: function names in the xrefs window were aligned to the right

  • BUGFIX: gcc v3 static names that are local to a function were not demangled

  • BUGFIX: get_idp_type() was using static buffers to return its return value; there was not enough of them to handle deeply nested structures

  • BUGFIX: get_short_name() group was not demangling gcc v3.x generated names

  • BUGFIX: guess_type() could recurse indefinitely and crash

  • BUGFIX: help file was mentioning IDC FindProc() function which did not exist anymore

  • BUGFIX: IDA was accepting "struct DWORD" as a valid type which is illegal because DWORD is declared as a scalar type, not a struct

  • BUGFIX: IDA could crash if the file history in the registry had holes in the numbering

  • BUGFIX: IDA was not reanalyzing the stack if the purged bytes of a called function became determined

  • BUGFIX: IDC: is was impossible to take segment snapshot with SetSegmentAttr()

  • BUGFIX: if a function with graph node group information was truncated, the graph view could not be rendered in some cases

  • BUGFIX: if lazy jumps were on, some jump targets could not be reached (the ones just below the visible part of the listing)

  • BUGFIX: if the function end was changed after sp-analysis had been planned but not processed, the sp-analysis would not be performed at all

  • BUGFIX: in some cases function tails were not reanalyzed

  • BUGFIX: indirect calls were not using the type information in memory dumps (because memory dumps had dangling pointers to system dlls and the callee was determined to be outside of the program)

  • BUGFIX: It was impossible to open the structure window if the enum window was the active window

  • BUGFIX: m32r: incorrect encoding of the mvtc instruction could cause an internal error

  • BUGFIX: m32r: it was impossible to change the sign of immediate operands

  • BUGFIX: mac: debugged application arguments were malformed

  • BUGFIX: mac: if idal was not in path, it could not be launched using the relative path

  • BUGFIX: memory corruption might occur in idag.exe at the very start

  • BUGFIX: mips: non-returning functions were terminating the execution flow too early, without taking into account the delay slots

  • BUGFIX: modifying the function end would destroy detailed prolog info

  • BUGFIX: modifying the function start would destroy frame info

  • BUGFIX: moving a segment while staying at address 0 would hang ida

  • BUGFIX: omf import libraries were displayed incorrectly in the listing (superfluous 'db' directirves were present)

  • BUGFIX: only the first 2 operands of instructions were handled with complex struct offset dialog box

  • BUGFIX: pc: "xchg rax, r8" was not disassembled correctly

  • BUGFIX: pc: 16bit indirect call targets were guessed incorrectly (the current segment base was not taken into account)

  • BUGFIX: pc: 16bit: the segment part of a far jump to an invalid address would be displayed using the selector value if that segment happened to have a corresponding selector. this could confuse the user

  • BUGFIX: pc: in some rare cases ida could miss the end of a basic block terminating with an indirect jump

  • BUGFIX: pc: sahf/lahf feature bits were wrong

  • BUGFIX: pc: the target of an indirect call with a register phrase and immediate displacement which had been converted to a user-defined offset was not determined correctly

  • BUGFIX: pc64: A1 opcode with the REX prefix was decoded incorrectly

  • BUGFIX: pic18 instructions comments were missing from ida.int

  • BUGFIX: PPC: unpredictable branch hints could not be decoded

  • BUGFIX: preprocessor token glue idiom (##) with empty tokens was not handled properly

  • BUGFIX: qvector.resize() had an integer overlow

  • BUGFIX: SDK: calc_names_cmts() had wrong calling convention for the callback

  • BUGFIX: SDK: dbg_exception event parameters were wrong

  • BUGFIX: SelStart()/SelEnd() IDC functions were working incorrectly for hexviews

  • BUGFIX: some functions would be incorrectly marked as "thunk"

  • BUGFIX: some intentionally malformed PE files could not be loaded correctly

  • BUGFIX: sparc flow charts were not optimal, call instructions were dividing nodes

  • BUGFIX: sparc high offsets were broken

  • BUGFIX: Symbian ROM EKA2 images were loaded incorrectly (in fact we could not tell apart EKA2 and EKA1, now we added an heuristic rule)

  • BUGFIX: the 'copy to clipboard' command was not available unless we are in a eaview

  • BUGFIX: the argument names of idb structure fields typed as "pointer to function" were incorrectly translated to type system field names

  • BUGFIX: the code to refresh the navigation band could spoil exception records

  • BUGFIX: the debugger server could accept a specially crafted incoming connection without a password

  • BUGFIX: the dialog box displayed by choose_enum() was not positioning on the default enum

  • BUGFIX: the font attribute was wrong in the output html files

  • BUGFIX: the pushinfo of 1byte functions could delete the pushinfo of the next function; it is not saved in the database anymore

  • BUGFIX: THREAD_EXIT debugging event was not handled properly

  • BUGFIX: tracing was not skipping library and debuger segments

  • BUGFIX: truncating a function with renamed registers could corrupt memory

  • BUGFIX: when a new mdi window was opened, ida would forget about the last disassembly view pointer

  • BUGFIX: when the graph overview window was active, displaying a modal form would cause an error message about focus and window visibility

  • BUGFIX: ARM: LDC/STC: some addressing modes were disassembled incorrectly

  • BUGFIX: ARM: SRS was missing the first argument (SP)

  • BUGFIX: ARM: XScale MRA and MAR instructions were swapped

  • BUGFIX: could not parse a header file if it contained redefinitions of standard structure types using typedefs

  • BUGFIX: IDA would crash at the exit time if the cpu registers window was open but the debugger never run

  • BUGFIX: it was impossible to find GetIdbPath using the search function of the help

  • BUGFIX: notepad could ignore the Enter key after displaying a modal window

  • BUGFIX: set_visible_func() called with a pointer to function tail could crash

  • BUGFIX: some switch idioms were recognized as having too many cases

  • BUGFIX: structure types with gap at the very beginning could not be used correctly in function prototypes

  • BUGFIX: structure/enum window would appear to be empty after a mass type deletion from a script even if not all types were deleted

  • BUGFIX: switch_info_ex_t structures were not deleted upon the 'undefine' command

  • BUGFIX: the 'create stroff' command was not displaying the sizeof(struct) choice for structures with embedded unions if the union was the first field of the structure

  • BUGFIX: the string list would continue to use the old program boundaries after segment creation/deletion

  • BUGFIX: debugger: DEP exceptions are correctly reported as "execution failure"

Last updated 9 months ago

Was this helpful?