LogoLogo
IDA 9.0
IDA 9.0
  • Welcome to Hex-Rays docs
    • What's new?
  • Getting Started
    • Install IDA
    • Licensing
    • Basic Usage
    • What's next?
  • User Guide
    • User Interface
      • Menu Bar
        • File
          • Load file
          • Script File
          • Script command
          • Produce output files
          • Invoke OS Shell
          • Take database snapshot
          • Save database
          • Save database as...
          • Abort IDA
          • Exit IDA
        • Edit
          • Export data
          • Undo an action
          • Redo an action
          • Clear undo history
          • Disable undo
          • Convert to instruction
          • Convert to data
          • Convert to string literal
          • Convert to array
          • Undefine a byte
          • Give Name to the Location
          • Operand types
            • Offset
            • Number
            • Perform en masse operation
            • Convert operand to character
            • Convert operand to segment
            • Complex Offset Expression
            • Convert operand to symbolic constant (enum)
            • Convert operand to stack variable
            • Change operand sign
            • Bitwise negate operand
            • User-defined operand
            • Set operand type
          • Comments
          • Functions
          • Structs
          • Segments
          • Patch core
          • Other
            • Rename Any Address
          • Plugins
        • Jump
          • Center current line in window
          • Problems List
        • Search
          • REGULAR EXPRESSION SYNTAX SUMMARY
        • View
          • Open subviews
          • Graphs
          • Message Window
          • Arrows window
          • Database snapshot manager
          • Highlighting identifiers
          • Browser options
          • Lumina options
          • Assembler level and C level types
          • C++ type details
          • Bookmarks window
          • Calculator
          • View segment registers
          • View Internal Flags
          • Hide
          • Unhide
          • Del hidden range
          • Hide all items
          • Unhide all items
          • Setup hidden items
        • Debugger
          • Debugger window
          • Process Control
            • Start process
            • Process options
            • Pause process
            • Terminate process
            • Step into
            • Step over
            • Run to cursor
            • Run until return
            • Attach to process
            • Detach from process
            • Set current ip
            • Show application screen
          • Breakpoints
          • Watches
          • Tracing
          • Source code view
            • Watch view (source level)
          • Process Memory
            • Take memory snapshot
            • Manual memory regions
            • Refresh memory
          • Thread list
          • Module list
          • Stack trace
          • Exceptions
          • Debugger options
          • Switch debugger
        • Lumina
        • Options
          • Low & High Suspicious Operand Limits
        • Windows
          • Rename a stack variable
          • Miscellanous Options
          • Environment variables
          • Reset Hidden Messages
          • Various dialog help messages
        • List of all menu options
      • Desktops
      • Command line
      • How To Use List Viewers in IDA
      • Licenses
        • Apache License for Ghidra
        • Apache License for LLVM
        • Common Public License Version 1.0
        • APPLE PUBLIC SOURCE LICENSE
        • PCRE2 LICENCE
        • GNU Lesser General Public License v2.1 for libiberty
      • Database conversion from idb to i64
    • Disassembler
      • Interactivity
      • Background Analysis
      • Graph view
        • Graphing tutorial
      • Proximity view
      • Navigation
        • Anchor
        • How to Enter a Segment Value
        • How to Enter a Number
        • How to Enter an Identifier
        • How to enter text
        • How to Enter an Address
      • Disassembly Gallery
        • Philips 51XA-G3
        • 6502 and 65C02 Disassembler
        • 6301, 6303, 6800, 6801 and 6803 Disassembler
        • 68040, Amiga
        • 6805 Disassembler
        • 6808 Disassembler
        • 6809 OS9 Flex Disassembler
        • 6809 Disassembler
        • 6811 Disassembler
        • 68HC12 Disassembler
        • 68HC16 Disassembler
        • 68k Amiga Disassembler
        • 68k Mac OS
        • 68k Palm Pilot
        • Unix COFF
        • NEC 78k0 and 78k0s Processor
        • 80196 Processor
        • 8051 Disassembler
        • Analog Devices 218x.
        • Alpha Processor – NT COFF
        • Alpha Processor – Unix ELF
        • Android ARM Executables (.elf)
        • ARC Processor
        • ARM Processor EPOC App
        • ARM Processor EPOC PE File
        • ARM Processor EPOC ROMFile
        • EPOC SIS File Handler
        • ARM Processor iOS (iPhone): Unlock
        • ARM Processor iOS (iPhone): Objective-C metadata
        • ARM Processor iOS (iPhone): Objective-C Instance variables
        • ARM Processor iOS (iPhone): Parameter Identification & Tracking (PIT)
        • ARM Processor iOS (iPhone): Start
        • ARM Processor iOS (iPhone): Switch statements
        • ARM Processor iOS (iPhone): C++ signatures
        • ARM Processor iOS (iPhone): Write
        • ARM Processor: Linux ELF
        • ARM Processor: AOF SDK
        • ARM Processor: Windows CE COFF Format
        • ARM Processor: Windows CE PE Format
        • ATMEL AVR Disassembler
        • C166 Processor
        • C166 Processor with ELF file
        • Rockwell C39
        • Microsoft .NET CLI Disassembler. VisualBasic library
        • CR16
        • Android Dalvik Executables (.dex)
        • Microsoft .NET CLI Disassembler
        • DSP56K
        • Fujitsu FR (.elf)
        • Gameboy
        • H8 300: COFF FILE Format
        • H8 300s: COFF FILE Format
        • H8 500
        • HPPA Risc Processor: HP-UX SOM
        • i51
        • i860
        • Intel i960
        • Intel IA-64 (Itanium)
        • Java Bytecode
        • Angstrem KR 1878
        • Renesas/Hitachi M16C
        • Renesas/Hitachi M32R
        • M740
        • M7700
        • M7900
        • MIPS Processor: Nintendo N64
        • MIPS R5900 Processor : Sony bin
        • MIPS Processor: Sony ELF
        • MIPS Processor: Sony PSX
        • MIPS Processor: Sony PSX
        • MIPS Processor: Unix COFF File Format
        • MIPS Processor: Unix ELF File Format
        • MIPS Processor: Windows CE PE File Format
        • MIPS Processor: Windows CE PE2 File Format
        • Panasonic MN102
        • Atmel OAK DSP
        • 80×86 Architecture: DOS Extender
        • 80×86 Architecture: Watcom Runtime
        • 80×86 Architecture: Geos APP
        • 80×86 Architecture: Geos DRV
        • 80×86 Architecture: Geos LIB
        • 80×86 Architecture: GNU COFF Format
        • 80×86 Architecture: OS/2 Linear Executable Format
        • 80×86 Architecture: Netware NLM
        • 80×86 Architecture: QNX Executable
        • 80×86 Architecture: Watcom Runtime
        • 80×86 Architecture: Windows OMF
        • 80×86 Architecture: Windows Portable Executable Format
        • 80×86 Architecture: Windows Virtual Device Driver
        • 80×86 Architecture: Windows 16 bits DLL
        • X-Box Disassembler
        • PDP 11: SAV File
        • PIC
        • PIC 12xx
        • Power PC AIF ECOFF file Format
        • Power PC Linux ELF
        • Mac OS PEF File
        • Mac OS X File
        • Windows NT PE File
        • Hitachi SH-1 Processor
        • Hitachi SH-3 Processor: Windows CE COFF format
        • Hitachi SH-3 Processor: Windows CE PE format
        • Hitachi SH-4 Processor: ELF File Format
        • Hitachi SH-4 Processor: Windows CE PE File Format
        • Super Nintendo Entertainement System (SNES)
        • SPARC Solaris COFF
        • SPARC Solaris ELF
        • SPARC Sun ELF
        • SPARC Sun ELF SO
        • ST 20C4
        • ST 7
        • ST 9
        • Toshiba TLCS 900
        • TMS 320c2 COFF
        • TMS 320c5
        • TMS 320c54
        • TMS 320c6 COFF File Format
        • TRICORE
        • SunPlus unSP
        • NEC V850
        • Z180 COFF File Format
        • Z380 COFF File Format
        • Z8
        • Z80
      • Supported processors
      • Supported file formats
        • Windmp file loader
      • Bitfields
        • Bit Fields tutorial
      • Structures tutorial
      • Union tutorial
      • Variable length structures tutorial
      • Data types, operands and constructs
      • Packed executables
    • Decompiler
      • Prerequisites
      • Quick primer
      • Exception handler
      • Introduction to Decompilation vs. Disassembly
        • Comparisons of ARM disassembly and decompilation
        • Comparisons of PowerPC disassembly and decompilation
        • Comparisons of MIPS disassembly and decompilation
        • Hex-Rays v7.4 vs. v7.3 Decompiler Comparison Page
        • Hex-Rays v7.3 vs. v7.2 Decompiler Comparison Page
        • Hex-Rays v7.2 vs. v7.1 Decompiler Comparison Page
      • Interactive operation
        • Rename
        • Set type
        • Set number representation
        • Edit indented comment
        • Edit block comment
        • Hide/unhide C statements
        • Split/unsplit expression
        • Force call type
        • Set call type
        • Add/del variadic arguments
        • Del function argument
        • Add/delete function return type
        • Jump to cross reference
        • Jump to cross reference globally
        • Generate HTML file
        • Mark/unmark as decompiled
        • Copy to assembly
        • Show/hide casts
        • Reset pointer type
        • Convert to struct *
        • Create new struct type
        • Split variable
        • Select union field
        • Jump to paired paren
        • Collapse/uncollapse item
        • Map to another variable
      • Batch operation
      • Configuration
      • Third party plugins
      • Floating point support
      • Support for intrinsic functions
      • Overlapped variables
      • gooMBA
      • Failures and troubleshooting
      • FAQ
      • Limitations
      • Tips and tricks
    • Debugger
      • Instant debugger
      • Remote debugging
        • Remote iOS Debugger
        • Android debugger
        • Dalvik debugger
        • Remote GDB Debugger
          • Remote GDB Debugger options
          • Debugging with gdbserver
          • Debugging with VMWare
          • Debugging with OpenOCD
          • Debugging with QEMU
          • External programs and GDB Debugger
          • Debugging code snippets with QEMU
        • PIN debugger
          • Building the PIN tool
          • Connecting a remote PIN tool instance from IDA
          • PIN support for MacOSX
        • Replayer debugger
        • Bochs debugger
          • Bochs Disk Image operation mode
          • Bochs IDB operation mode
          • Bochs PE operation mode
          • Bochs debugger FAQ
      • Local debugging
        • WinDbg Debugger
        • Linux debugger
        • Intel/ARM macOS debugger
      • Debugger tutorials
        • Debugging Dalvik Programs
        • IDA Win32 Local Debugging
        • IDA Linux Local Debugging
        • IDA Linux to Win64 Debugging
        • IDA Win32 to Linux Debugging
        • Debugging Mac OSX Applications with IDA Pro
        • Debugging iOS Applications using CoreDevice (iOS 17 and up)
        • Debugging iOS Applications with IDA Pro
        • Debugging Linux Applications locally
        • Debugging Linux/Windows Applications with PIN Tracer module
        • Debugging Windows Applications with IDA Bochs Plugin
        • Debugging Windows Applications with IDA WinDbg Plugin
        • Using the Bochs debugger plugin in Linux
        • Debugging Windows Kernel with VMWare and IDA WinDbg Plugin
        • Debugging Linux Kernel under VMWare using IDA GDB debugger
        • Windows Debugger Hub
        • Linux Debugger
        • Debugging a Windows executable locally and remotely
        • Debugging the XNU Kernel with IDA Pro
        • Remote debugging with IDA Pro
        • IDA Scriptable Debugger: overview
          • IDA Scriptable Debugger: scriptability
        • Debugging code snippets with QEMU debugger (a la IDA Bochs debugger)
        • Trace Replayer and managing traces
        • Using IDA Pro's tracing features
        • Working with PIN
        • Appcall
    • Creating Signatures
      • FLIRT
        • IDA F.L.I.R.T. Technology: In-Depth
        • Generate FLIRT signature file
        • Supported Compilers
          • Turbo Pascal
          • Delphi
      • Makesig
    • Creating Type Libraries
      • IDAClang
      • TILIB
    • Configuration
      • Configuration files
      • Command line switches
      • Keyboard macros
      • UI/Fonts/Themes
      • Shortcuts
      • Customizing IDA
      • CSS-based styling
    • Teams
      • IDA Teams Licenses
      • Diffing and Merging Databases with IDA Teams
      • Teams lc command reference manual
      • hv command reference manual
      • Hex-Rays Vault’s visual client user manual
    • Lumina
      • lc command reference manual
    • Plugins
      • Open Plugin Architecture
      • Plugin options
      • Plugins Shipped with IDA
        • Swift plugin
        • Golang plugin
        • Rust plugin
        • picture_search
        • Objective-C Analysis Plugin
        • DYLD Shared Cache Utils
        • Borland RTTI descriptors plugin
        • DWARF plugin
        • Patfind plugin
        • IDA Feeds
          • FLIRT Signature Bundle
      • Plugin Contest
      • How to write your own plugin?
    • Helper Tools
    • idalib
  • Developer Guide
    • C++ SDK
      • Getting Started with C++ SDK
      • C++ SDK Reference
      • Using the Decompiler SDK: Decompiler plugin
      • C++ SDK examples
      • How to create a plugin in C++?
      • C++ SDK Porting Guide from IDA 8.x to 9.0
    • IDAPython
      • Getting started with IDAPython
      • IDAPython API Reference
      • IDAPython examples
      • How to create a plugin in IDAPython?
      • IDAPython Porting Guide from IDA 8.x to 9.0
    • IDC
      • Core concepts
        • Expressions
        • Statements
        • Functions
        • Variables
        • Constants
        • Exceptions
        • Classes
        • Predefined symbols
        • loader_input_t class
        • Slices
      • IDC API Reference
        • Index of debugger related IDC functions
        • Alphabetical list of IDC functions
          • is_member_id
          • load_type
          • get_member_by_idx
          • get_ordinal_limit
          • set_selector
          • enable_tracing
          • get_prev_fixup_ea
          • del_segm
          • get_bmask_cmt
          • end_type_updating
          • Find
          • toggle_bnot
          • patch_byte
          • get_module_info
          • set_member_name
          • create_float
          • del_struc_member
          • read_dbg_memory
          • get_enum_width
          • getn_thread_name
          • del_struc
          • filelength
          • set_manual_insn
          • is_value...() functions
          • get_ip_val
          • del_extra_cmt
          • create_insn
          • op_offset_high16
          • get_cmt
          • expand_struc
          • get_idb_path
          • set_frame_size
          • get_file_ext
          • has_value
          • readshort
          • sanitize_file_name
          • get_member_flag
          • create_struct
          • ARM specific
          • set_enum_member_cmt
          • rename
          • set_ida_state
          • get_member_size
          • msg
          • qbasename
          • get_enum_member_enum
          • auto_mark_range
          • plan_to_apply_idasgn
          • set_named_type
          • op_offset
          • rename_entry
          • strlen
          • get_extra_cmt
          • get_enum_flag
          • fgetc
          • op_stkvar
          • get_last_index
          • get_field_ea
          • get_struc_id
          • select_thread
          • create_array
          • get_struc_cmt
          • set_array_string
          • set_func_attr
          • set_storage_type
          • get_struc_size
          • demangle_name
          • get_next_fixup_ea
          • get_next_bmask
          • delattr
          • gen_simple_call_chart
          • patch_qword
          • get_enum_name
          • loader_input_t.getc
          • get_debugger_event_cond
          • read_dbg_qword
          • define_local_var
          • generate_disasm_line
          • add_idc_hotkey
          • tolower
          • del_selector
          • set_debugger_event_cond
          • get_imagebase
          • gen_file
          • get_entry
          • find_custom_data_format
          • get_debug_name_ea
          • add_default_til
          • set_func_end
          • exit_process
          • delete_array
          • xtol
          • get_exception_code
          • detach_process
          • set_enum_cmt
          • get_wide_word
          • put_bookmark
          • is_loaded
          • add_enum_member
          • parse_decls
          • readstr
          • get_entry_qty
          • ord
          • sprintf
          • get_root_filename
          • get_enum_member_cmt
          • create_word
          • set_func_flags
          • loader_input_t.tell
          • create_align
          • read_dbg_dword
          • next_addr
          • get_bytes
          • batch
          • start_process
          • process_config_line
          • del_user_info
          • qmakefile
          • set_struc_name
          • print_decls
          • create_custom_data
          • del_enum_member
          • format_cdata
          • get_fixup_target_sel
          • get_item_size
          • loader_input_t.gets
          • get_last_bmask
          • Step Tracing Options
          • selector_by_name
          • get_enum_cmt
          • next_not_tail
          • prev_head
          • set_color
          • set_numbered_type
          • get_member_name
          • auto_wait
          • get_enum_member_bmask
          • fseek
          • get_segm_start
          • attach_process
          • Trace file functions
          • get_enum_member_value
          • op_stroff
          • get_next_offset
          • set_processor_type
          • get_bookmark_desc
          • create_data
          • lastattr
          • get_operand_value
          • collect_stack_trace
          • toupper
          • get_fixup_target_dis
          • set_cmt
          • add_entry
          • set_segm_addressing
          • qmake_full_path
          • get_source_linnum
          • fputc
          • resume_thread
          • get_func_attr
          • get_first_enum_member
          • add_sourcefile
          • get_first_bmask
          • read_selection_start
          • hasattr
          • get_member_cmt
          • gen_flow_graph
          • get_array_element
          • get_tinfo
          • loader_input_t
          • tinfo_errstr
          • TRUNC
          • add_segm_ex
          • Local types information and manipulation helpers
          • set_source_linnum
          • get_next_enum_member
          • loader_input_t.readbytes
          • set_array_params
          • jumpto
          • get_bookmark
          • set_enum_bf
          • prev_not_tail
          • toggle_sign
          • loader_input_t.size
          • Trace events functions
          • get_func_flags
          • get_gotea
          • set_segm_attr
          • get_item_head
          • set_default_sreg_value
          • print_insn_mnem
          • set_member_cmt
          • get_ordinal_qty
          • set_target_assembler
          • add_user_stkpnt
          • set_local_type
          • Hidden ranges
          • del_items
          • compile_idc_text
          • Dalvik debugger extension functions
          • byte_value
          • create_dword
          • is_code
          • del_func
          • get_enum
          • make_array
          • rotate_left
          • recalc_spd
          • search_path
          • CommonBits
          • get_processor_name
          • set_func_cmt
          • get_prev_bmask
          • Hashes
          • split_sreg_range
          • process_ui_action
          • set_fixup
          • get_fixup_target_type
          • create_oword
          • get_flags
          • get_func_name
          • create_strlit
          • add_struc
          • atol
          • load_debugger
          • mkdir
          • sizeof
          • get_enum_member_by_name
          • save_database
          • guess_type
          • get_segm_name
          • print_operand
          • qisabspath
          • get_member_qty
          • set_struc_cmt
          • get_fixup_target_flags
          • idadir
          • object.retrieve
          • add_auto_stkpnt
          • get_numbered_type_name
          • get_enum_member_name
          • get_next_index
          • prev_addr
          • get_name_ea
          • get_sp_delta
          • set_bmask_cmt
          • readlong
          • set_segm_name
          • get_prev_offset
          • set_segm_alignment
          • get_strlit_contents
          • forget_exception
          • get_item_end
          • add_func
          • get_name
          • Asks
          • get_spd
          • Debugger: control
          • get_wide_byte
          • plan_and_wait
          • set_enum_flag
          • RunPythonStatement
          • del_sourcefile
          • find_selector
          • get_frame_regs_size
          • op_num
          • define_exception
          • create_double
          • create_byte
          • read_selection_end
          • OpTypes
          • op_plain_offset
          • move_segm
          • get_member_id
          • set_segm_combination
          • get_current_thread
          • trim
          • Debugger: options
          • getn_thread
          • get_frame_id
          • typeinfo.print
          • to_ea
          • rebase_program
          • add_struc_member
          • get_exception_qty
          • get_first_index
          • import_type
          • set_segm_type
          • find_custom_data_type
          • get_next_seg
          • find_func_end
          • get_last_enum_member
          • getattr
          • get_frame_size
          • get_screen_ea
          • loader_input_t.read
          • set_reg_value
          • Debugger: modules
          • create_pack_real
          • writestr
          • exec_idc
          • get_enum_size
          • set_enum_name
          • create_tbyte
          • sel2para
          • atoa
          • loader_input_t.close
          • add_enum
          • ltoa
          • substr
          • del_idc_hotkey
          • Breakpoint handling functions
          • loader_input_t.seek
          • cleanup_appcall
          • object.store
          • get_type
          • qexit
          • get_debug_name
          • get_array_id
          • Can't Open File
          • suspend_process
          • process_config_directive
          • get_entry_name
          • get_last_member
          • get_struc_name
          • clear_selection
          • fclose
          • firstattr
          • create_yword
          • dbg_appcall
          • get_qword
          • patch_dword
          • begin_type_updating
          • read_dbg_byte
          • get_fpnum
          • qsleep
          • get_first_member
          • get_nsec_stamp
          • del_stkpnt
          • eval
          • savefile
          • eval_python
          • Xrefs
          • strstr
          • writeshort
          • get_sreg
          • get_segm_end
          • get_func_off_str
          • set_func_start
          • del_array_element
          • get_full_flags
          • set_exception_flags
          • rename_array
          • get_frame_args_size
          • op_flt
          • get_min_spd_ea
          • apply_type
          • get_prev_index
          • loadfile
          • retrieve_input_file_md5
          • get_wide_dword
          • patch_dbg_byte
          • Functions provided by the WinDbg debugger
          • get_original_byte
          • get_member_strid
          • call_system
          • writelong
          • get_thread_qty
          • nextattr
          • send_dbg_command
          • get_first_seg
          • get_processes
          • patch_word
          • get_manual_insn
          • ftell
          • get_entry_ordinal
          • set_array_long
          • delete_all_segments
          • TO_LONG
          • Function chunk related functions
          • Debugger: events
          • get_prev_func
          • op_seg
          • validate_idb_names
          • fprintf
          • fopen
          • strfill
          • del_fixup
          • get_bmask_name
          • inf_attr
          • is_bf
          • read_dbg_word
          • qdirname
          • get_segm_attr
          • func_contains
          • del_source_linnum
          • get_sourcefile
          • clr_database_flag
          • set_name
          • Refresh Screen
          • op_enum
          • getn_enum
          • get_db_byte
          • setattr
          • get_forced_operand
          • op_bin
          • Functions provided by the replayer debugger
          • prevattr
          • update_extra_cmt
          • get_str_type
          • op_man
          • choose_func
          • set_bmask_name
          • get_curline
          • decode_insn
          • set_segment_bounds
          • set_segm_class
          • write_dbg_memory
          • get_exception_name
          • get_enum_member
          • is_mapped
          • del_enum
          • get_frame_lvar_size
          • get_operand_type
          • set_root_filename
          • compile_idc_file
          • typeinfo.size
          • get_local_tinfo
          • get_fixup_target_off
          • is_union
          • unlink
          • get_segm_by_sel
          • set_enum_width
          • take_memory_snapshot
          • exec_python
          • get_next_func
          • get_member_offset
          • get_func_cmt
          • parse_decl
          • create_qword
          • next_head
          • suspend_thread
          • loader_input_t.getz
          • get_color
          • get_reg_value
          • load_and_run_plugin
          • set_database_flag
          • set_enum_member_name
          • set_member_type
          • get_prev_enum_member
      • IDC examples
        • Analyzing encrypted code
  • Admin Guide
    • Lumina server
    • Teams server
    • License server
      • Hex-Rays License Server Migration Guide
  • Release Notes
    • IDA 9.0
    • IDA 8.4sp2
    • IDA 8.4sp1
    • IDA 8.4
    • IDA 8.3
    • IDA 8.2sp1
    • IDA 8.2
    • IDA 8.1
    • IDA 8.0sp1
    • IDA 8.0
    • IDA 7.7sp1
    • IDA 7.7
    • IDA 7.6sp1
    • IDA 7.6
    • IDA 7.5sp3
    • IDA 7.5sp2
    • IDA 7.5sp1
    • IDA 7.5
    • IDA 7.4sp1
    • IDA 7.4
    • IDA 7.3
      • IDA 7.3 Undo: IDA can do it
    • IDA 7.2
      • IDA 7.2 The Mac Rundown
    • IDA 7.1
      • IDA 7.1 Debugger API 7.1 Porting Guide
    • IDA 7.0sp1
    • IDA 7.0
      • Internationalization (i18n)
      • Automatic discovery of string literals
      • API 7.0 Porting Guide
      • IDAPython backward compatibility
    • IDA 6.95
    • IDA 6.9
    • IDA 6.8
    • IDA 6.7
    • IDA 6.6
    • IDA 6.5
    • IDA 6.4
    • IDA 6.3
    • IDA 6.2
    • IDA 6.1
    • IDA 6.0
    • IDA 5.7
    • IDA 5.6
    • IDA 5.5
      • 5.5 Gallery
      • 5.5 Comparison
    • IDA 5.4
    • IDA 5.3
    • IDA 5.2
    • IDA 5.1
    • IDA 5.0
    • IDA 4.9SP
    • IDA 4.9
    • IDA 4.8
    • IDA 4.7
    • IDA 4.6
    • IDA 4.x
    • IDA 3.x
    • Cumulative bugfix for IDA
  • Archive
    • IDA’s Windbg plugin
    • IDA’s Bochs debugger plugin
    • IDA’s Bochs debugger plugin 2
    • DosWin32
    • Hex-Rays v1.1 vs. v1.0 Decompiler Comparison Page
    • Hex-Rays v1.2 vs. v1.1 Decompiler Comparison Page
    • Hex-Rays v1.3 vs. v1.2 Decompiler Comparison Page
    • Hex-Rays v1.6 vs. v1.5 Decompiler Comparison Page
    • Hex-Rays v1.7 vs. v1.6 Decompiler Comparison Page
    • Costly Greetings – An Adventure In Hostile Code Analysis
    • An Adventure In Hostile Code Analysis: Description
    • An Adventure In Hostile Code Analysis: Disassembly
    • Improved code flow analysis
    • Program Navigation Bar
    • IDA Home Contest
    • Pimp My IDA: vote results
    • Turning off IDA 6.x compatibility in IDAPython
    • Porting guide for IDA 7.4 turning off IDA 6.x API backwards-compatibility by default
    • Porting guide for IDA 7.4 IDAPython and Python 3
    • IDAPython and Python 3
    • Porting guide for changes in IDAPython-on-Python-3 APIs
    • Debugging iOS Applications With IDA
    • IDA Win32 to Win32 Debugging
    • IDA Win32 to Win64 Debugging
    • Legacy license server: Floating Licenses
      • Installing on Linux
      • Installing on Windows
      • Installing on OS X
    • Decompiler Installation
    • Enumerated types tutorial
  • Bug Bounty
Powered by GitBook
LogoLogo

Need Help?

  • FAQs
  • Support

Community

  • Forum
  • Plugins

Resources

  • Blog
  • Download center

© 2025 Copyright Hex-Rays

On this page

Was this helpful?

Export as PDF
  1. Release Notes

IDA 5.7

Last updated 9 months ago

Was this helpful?

Highlights

  • IDAPython IDAPython has been modified a lot. We manually wrapped many new functions and classes. We documented all manually wrapped functions. Online documentation is here:

    Some "idaapi.cvar" variables have been moved to "idaapi.". In particular, the idaapi.cvar.cmd is now accessible as idaapi.cmd.

    Recent script box (Alt+7) and run python script (Alt+9) are replaced with Alt+F7 and Alt+F9 respectively

  • Scripted plugins Plugins can be implemented in Python or IDC.

    See the . See samples in "sdk\plugins\script_plg"

  • Scripted processor modules Processor modules too can be implemented in Python or IDC. See:

    • sdk\module\script\ebc.py: EFI Byte code processor module. It works with EBC PE files.

    • sdk\module\script\msp430.py: MSP430 is a simple 27-instructions 16-bit RISC processor from TI.

    • sdk\module\script\proctemplate.py: Processor module script template

    We have addded many SDK functions to IDAPython to support processor modules.

  • ARM module/Mach-O file format If you analyze iPhone/iPad file, the following improvements are essential:

    • parsing of the LC_DYLD_INFO and LC_ROUTINES loader commands (more names are recovered)

    • improved tracing of register values for ARM that discovers more references

    • improved offset auto-conversion: now you should see less false positives (e.g. no xrefs into middle of instructions)

    • indirect calls via register are resolved when possible, and a comment is added with the final address

    • better Thumb/ARM mode switch tracing

    • when splitting segments, T register is not reset to 0 but the old value at the split point is reused

    • support for PIC code generated by GCC 4.4.x (GOT loading)

    • various other fixes and improvements

    • ARM architecture options for disassembly can be configured in the UI (Processor-specific options), in IDA.CFG or on command line (see documentation; ARMv6 is default)

    • for Mach-O files and ELF files with EABI attributes the architecture is set automatically according to the flags in the binary

    • support for NEON SIMD instructions (available if ARMv7 is selected); they are commonly found in the current iPhone/iPad files

    • when ARMv7 is selected, a unified syntax is used for VFP and NEON instructions (Vxxx instead of old Fxxx)

  • Custom data You can define your own data types. For more details, see:

    See the.

    Also check out "sdk\plugins\custview\custview.cpp" and IDAPython\examples\ex_custdata.py

  • Bochs Linux debugger plugin We have ported the bochs debugger plugin to Linux. See to learn how to configure and use it. The plugin functions similarly to the Windows bochs debugger plugin except that you need to set up environment variables and copy some Windows DLLs to Linux.

  • PDB plugin The PDB plugin now works without having MS DIA DLLs registered in the system (i.e. no need to install the full Visual Studio). It is enough to either install VS 2005 or 2008 runtime redistributable or copy msdiaNN.dll into IDA's directory. It now imports much more types from PDB files with private symbols.

  • WinDbg debugger plugin We improved WinDbg support:

    • Added non-invasive debugging support. You may find this feature useful if you want to attach to a program that is already being debugged.

    • The plugin will not automatically set the PDB path to %TEMP%\ida, one has to manually specify the symbol path (_NT_SYMBOL_PATH env var or .sympath command)

    • Minor bug fixes and speed improvements

    • Typing ".reload /f" will update the symbols state in the UI as well

  • Recent scripts Alt-F7: Open script file Alt-F9: Opens the recent scripts chooser.\

    • Ctrl+E to edit

    • Del to delete

    • Ins to insert a new script to the list

  • New command line switches Please find more information about the -t and -S switches\

  • Output window We replaced the listbox with a richtext control, allowing the users to:

    • double click on any identifier or address to jump to it if applicable

    • select and copy portions of text

    • search for text in the log

  • Debugger

    • Jumping to debug names automatically creates code

    • Right click on a module in module window offers to jump to module base

    • debugger: added support for MSR, XMM and MMX registers

    • debugger: added support for model specific registers registers (win32)

    • breakpoints: breakpoints have a flag to allow the kernel to invalidate memory layout and contents before evaluating a script condition

    • added DbgByte/DbgWord/DbgDWord functions to read debuggee memory directly

    • the breakpoint list window also shows the instruction comment

Changelist

Processor Modules

  • 6808: added new instructions from the 68HCS08 (aka 9S08) family

  • ARM: added a switch pattern often found in EPOC files

  • ARM: improved analysis of constant pool items - reduced false positives when converting data to offsets

  • ARM: improved detection of ADRL macros

  • ARM: handle some of the new idioms produced by GCC 4.4.0

  • ARM: added support for NEON (aka Advanced SIMD) instructions, new to ARMv7 architecture

  • ARM: architecture version can now be set; it is configured automatically for Mach-O files and ELF files with EABI attributes.

  • ARM: many other improvements, switch patterns, etc

  • EBC: EFI Byte Code processor module (written in Python)

  • H8: 24-bit address operands were truncated to 16 bits

  • MIPS: added MIPS16e instructions (jrc, jalrc, save, restore etc)

  • MIPS: added ssnop instruction

  • MIPS: more common instruction sequences are simplified

  • MIPS: set proper types (float/double) for operands of FPU instructions - floating-point constants are now recognized and converted

  • MIPS: substantially improved tracking of register values which recovers most of data and code cross-references in typical MIPS binaries

  • MIPS: table-based switches are recognized and labeled

  • MIPS: trace transitions between mips16 and mips32 code for better analysis

  • MSP430: new processor module (written in Python)

  • PC: improved detection of Delphi exception handlers

  • PC: improved parsing of Visual C++ SEH handlers

  • PC: recognize aligned stack prolog produced by GCC 4.x

  • PIC: improved handling of FSRs for the PIC18xx series; added more chip configurations

  • PPC: added G2 core (603e) instructions tlbld and tlbli

  • PPC: more jump tables are recognized

  • SuperH: added support for SH-2A architecture

  • TMS320c54: added support for memory mappings (thanks to Sylvain Munaut)

File Formats

  • .NET: made output more compatible with MSIL assembler

  • ELF: added support for TLS relocations in x86_64 files

  • ELF: handle MIPS files with mips16 functions

  • ELF: handle more ARM relocations

  • ELF: ARM: if EABI attributes are present (.ARM.attributes section), they're used to set up the ARM architecture options for disassembly

  • Mach-O: rebasing a file (e.g. during debugging) could make some pointers invalid

  • Mach-O: added support for X86_64_RELOC_SIGNED_n relocations

  • Mach-O: added support for ARM BR24 and Thumb BR22 relocations

  • Mach-O: cpusubtype field from the header is used to pre-set the ARM architecture version for disassembly

  • PDB: vtable structures are created and added to class structures if that info is present in the PDB

  • PDB: msdiaNN.dll can now be loaded without being registered, if found in PATH or default VC CRT install path

  • PE: load configuration directory (which includes SEH information) is parsed and commented

  • PE: recognize and load Phar Lap TNT DOS-Extender's 'PL' executables

  • PE: IDA now allows to load corrupted files after a warning instead of aborting

  • XCOFF: added support for weak extern symbols

Kernel

  • added support for scripted processor modules

  • added support for scripted plugins

  • added support for 64-bit offsets with unknown base (they are mainly used in structure fields)

  • added support for appcall with timeouts

  • added support for custom data types and formats

  • added support for locking of area pointers returned by the kernel

  • improved the speed of handling idbs with huge number of segments

  • improved argument propagation algorithm to handle indirect calls, including function pointers stored in stack variables

  • jumping to exported entries will create functions automatically

  • kernel: single-character strings were converted to Unicode too aggressively

  • New command line switch '-t' to run IDA without an input file

  • The "-S" switch now works with any supported script type. Users can pass arguments to scripts and access them via the "ARGV" global variable

  • updated noret.cfg with several no-return functions used in Visual Basic programs (vbaErrorOverflow, vbaGenerateBoundsError etc.)

  • the "Generate IDC" command retains function prototypes

  • added FLIRT signatures for Visual C++ 2010 and C++Builder 2010

Scripts & SDK

  • IDC: IDC definitions are not destroyed upon closing the database

  • IDC: Added DbgByte(), DbgWord(), DbgWord() and DbgQword() to read program bytes from the debugger memory

  • IDC: Added GetManyBytes() to read more than a byte from the database or the debugger memory

  • SDK: added find_extlang_by_ext()

  • SDK: added idp_notify::set_proc_options notification for more fine-grained configuration of processor modules

  • SDK: added get_func_by_frame()

  • SDK: added get_varcall_regs() for processors that use registers for vararg calls (like printf)

  • SDK: added init_process/term_process/get_process_exit_code system independent functions

  • SDK: added netnode::supdel_range() to delete range of supval elements

  • SDK: added qfindfirst/qfindnext/qfindclose functions to enumerate files in a system independent way

  • SDK: added qrename() to rename files. qrename() does not fail if the new file exists (unix behavior)

  • SDK: added call_method to extlang

  • SDK: added set_idc_func_ex(); this function makes it possible to register IDC functions that can work without an open idb; set_idc_func() is obsolete now and should not be used

  • SDK: added support for complex offsets with subtraction from the base value (REFINFO_SUBTRACT)

  • SDK: added VarGetClassName() to retrieve the class name of an IDC object

  • SDK: class areaset_t can now be used by plugins and modules

  • SDK: find_func_bounds() supports flag FIND_FUNC_IGNOREFN

  • SDK: MIPS processor module now uses the same instruction numbers for 32-bit and 16-bit instructions. Plugins that rely on those numbers might have to be recompiled.

  • SDK: processor modules that don't have instruction comments in the ida.int database will receive a get_autocmt notification.

  • SDK: renamed all *_const functions to *_enum_member (add_const() is reserved in Visual C++ 2010)

  • SDK: ua_stkvarN and add_stkvarN could fail when adding a stack variable with an odd offset

User Interface

  • UI: added "follow pointer" context menu command in hex view

  • UI: added a "jump to cross reference from" command (default shortcut Ctrl-J), useful when navigating large switch statements

  • UI: it is now possible to generate flow and xref graphs in DOT format (see ida.cfg)

  • UI: it is possible to add/delete breakpoints from the module names window

  • UI: "Set callee" plugin (hotkey Alt-F11) now also works for ARM and MIPS processors

  • UI: user can now enter type declaration for instruction operands

  • UI: script boxes (Shift-F2, Alt-8) and other multi-line input boxes in IDA now auto-indent new lines

  • UI: Output window is a ritchtext control. Users can double-click on identifiers / address to jump

  • UI: Output window is now searchable (hotkey Alt-T and Ctrl-T)

  • UI: The environment variable TVHEADLESS can be specified for the graphical version of IDA

  • UI: Set function prototype (shortcut 'y') can also be used if cursor is positioned over a function name

  • UI: Breakpoints window also shows the comment at the breakpoint's address

  • UI: Replaced "File / IDC file" with "File / Script file" allowing the users to run any supported script file

Debugger

  • Bochs debugger can be used under Linux and OS X

  • Bochs debugger supports Bochs 2.4.5

  • added "Jump to module base" to the modules list popup menu

  • added "Analyze module" to the modules list popup menu

  • added support for MMX/XMM registers (XMM regs only under windows)

  • connection to a Windows CE device can be canceled

  • win32 debugger: implemented accessing MSRs using the kernel debugger driver provided by Microsoft. Thanks to Alex Ionescu for the assistance!

  • added support for reading/writing model specific registers (MSRs)

  • WINDBG: changing the current thread using the "~Ns" command is now reflected in the UI

  • WINDBG: Reloading symbols in the debugging engine using ".reload" will also update the debug names in IDA

  • WINDBG: The plugin will propose to launch the dbgsrv.exe if debugging an x64 application

  • WINDBG: Added support for non-invasive debugging

Bugfixes

  • BUGFIX: AddHotKey() was broken under *nix

  • BUGFIX: ARM: operand order for XScale MRA/MAR instructions was wrong

  • BUGFIX: ARM: some instructions with PC-relative operand were decoded incorrectly in Thumb mode

  • BUGFIX: ARM: some PC-relative load and store instructions were decoded incorrectly in Thumb mode

  • BUGFIX: ARM: specifying a register pair in a function prototype would crash ida

  • BUGFIX: ARM: Thumb-2 STRD instruction was sometimes decoded as LDRD

  • BUGFIX: ELF: Solaris files with special values in sh_link field of section headers were not loaded correctly

  • BUGFIX: nec850: jr was not stopping execution flow

  • BUGFIX: PIC: 12F629 and 12F675 are 14-bit devices and so should be in pic14.cfg

  • BUGFIX: Bochs plugin in disk image operation mode could not retrieve segment register base properly in Bochs 2.4.2

  • BUGFIX: changing the storage type from sparse to regular could convert some zero-initialized bytes to uninitialized bytes

  • BUGFIX: coff files with more than 0x8000 segments were loaded incorrectly (some symbols could not be resolved)

  • BUGFIX: custom_viewer callbacks were getting wrong shift state information (should be 1-shift, 2-ctrl, 4-alt)

  • BUGFIX: dbg_step_into and similar events were not generated if the operation was invoked interactively by the user (not from a plugin)

  • BUGFIX: debug names were sent over the network repeatedly (remote debugging)

  • BUGFIX: debugger: Linux debugger did not handle well programs which created a lot of short-lived threads

  • BUGFIX: disabled menu items with shortcuts could appear in IDA after loading a new idb; this could lead to minor problems (like Esc not working in the decompiler)

  • BUGFIX: disassembly lines for structure members that are arrays with some repeating values would be truncated

  • BUGFIX: double clicking on a user-defined graph would lead to inconsistent idag state and create problems with focusing/unfocusing windows

  • BUGFIX: TDS plugin: choosing CANCEL in instant debugging mode would crash IDA

  • BUGFIX: Edit,Segment,Move current segment was doing nothing in some cases

  • BUGFIX: editing a breakpoint could lead to a crash during remote debugging session

  • BUGFIX: ELF (MIPS): in some cases HI16/LO16 relocation pairs were processed incorrectly

  • BUGFIX: elf files were rebased incorrectly

  • BUGFIX: even if the user requested octal represention of a number, IDA could still use decimal representation for values 8 and 9

  • BUGFIX: fixed an integer overflow bug in the qnx file loader (thanks to Jason Geffner)

  • BUGFIX: GDB debugger: ARM breakpoints were not working when connecting to OpenOCD

  • BUGFIX: gdb plugin was crashing on empty reply from monitor command

  • BUGFIX: get_prev_area() was broken

  • BUGFIX: GUI: Floating forms could cause IDA GUI to crash if opened and closed many times

  • BUGFIX: GUI: Hotkeys Alt-0 to Alt-9 (used to switch to a window) were not usuable even if no window was open and occupying that hotkey

  • BUGFIX: IDA could crash trying to evaluate "eax++" (illegal postfix operation on a register)

  • BUGFIX: IDA could crash while performing sp-analysis

  • BUGFIX: IDA could crash with memory corruption

  • BUGFIX: IDA could endlessly loop on corrupted databases

  • BUGFIX: IDA could hang when instruction tracing is used with debuggers with the DBG_FLAG_DONT_DISTURB flag

  • BUGFIX: IDA could hang when trying to display a type referring to itself

  • BUGFIX: IDA could sometimes refuse to modify the stack pointer while the background analysis was on

  • BUGFIX: IDA kernel was ignoring the "options" value set by the scriptable loaders in their accept_file()

  • BUGFIX: IDA was not allowing names with dummy prefixes (like byte_...) for structure members; removed this limitation

  • BUGFIX: IDA was setting 'use dup' checkbox while creating new arrays; now it remembers the last used value

  • BUGFIX: IDA would try to continue to interact with the remote debugger server after network timeouts; now it immediately closes the connection because the protocol state is lost

  • BUGFIX: idal could erronously complain about a corrupted configuration file

  • BUGFIX: IDAPython: GetCharPrm(INF_PROCNAME) was broken

  • BUGFIX: IDC DecodeInstruction() was not returning cmd.size attribute

  • BUGFIX: IDC: SetHashLong() was broken

  • BUGFIX: if a debugger session was ended with Alt-X, some debugger (and umimportant non-debugger) settings were not saved

  • BUGFIX: if the network connection was dropped during a debugging session, IDA could crash in some cases

  • BUGFIX: In rare cases, deleting the last segment could lead to a crash

  • BUGFIX: in some cases automatic type propagation could overwrite the stack frame's return address field

  • BUGFIX: it was impossible to connect to 64bit debugger server using 64bit version of IDA without a database

  • BUGFIX: it was not possible to reload binary files

  • BUGFIX: it was not possible to set an empty string as connection string for WinDbg debugger, if there was a saved default string.

  • BUGFIX: it was possible to modify a readonly debugger register from a script

  • BUGFIX: JAVA: IDA could not load some .class files with corrupted StackMapTable

  • BUGFIX: MIPS: IDA was creating multi-instruction macros in delay slots, which was incorrect

  • BUGFIX: MIPS: in some cases 16-bit negative immediate values were displayed as unsigned

  • BUGFIX: MIPS: jalx was incorrectly stopping execution flow

  • BUGFIX: normal functions were improperly detected as no-return for some processors with delayed slot instructions (e.g. SuperH)

  • BUGFIX: only slightly damaged idb files could be repaired by IDA (normally IDA is able to repair badly damaged files too)

  • BUGFIX: OSX: mac_server could interr in some cases when program exited unexpectedly

  • BUGFIX: parse c header files: if a type name was used as a local structure member name in a C header file, it would be parsed incorrectly

  • BUGFIX: parsing "typedef struct x x;" could create a circular dependency

  • BUGFIX: PC: a wait instruction with prefixes was still lumped together with the next instruction

  • BUGFIX: PC: assembler could not handle [reg-imm] while [reg+imm] was working ok

  • BUGFIX: PIC: SFR definitions were not reloaded when opening a previous database

  • BUGFIX: PowerPC: branch targets were truncated to 32 bits in 64-bit mode

  • BUGFIX: pressing Cancel while initializing an instant debugger could hang ida

  • BUGFIX: Python's GetReg and SetReg[Ex] did not work for non-x86 processors

  • BUGFIX: retrieving objects with circular dependencies from the debugged program to IDC could lead to interr

  • BUGFIX: SDK: unicode version of qstrlen() was broken

  • BUGFIX: SDK: request_step_over/step() were not working properly with multithreaded applications

  • BUGFIX: some SSE instructions were described incorrectly (missing CF_... flags)

  • BUGFIX: SuperH: basic block boundaries were determined incorrectly, leading to wrong flow graphs

  • BUGFIX: SuperH: return instructions were not defined correctly for big-endian variants

  • BUGFIX: text version of IDA could crash at the exit time if all debugger plugins were deleted from the disk

  • BUGFIX: the calculator could not properly display 64-bit and floating point results

  • BUGFIX: the screen would not be always refreshed after modifying the very first byte of a segment using the right click menu

  • BUGFIX: the selector list could not be displayed in the text version

  • BUGFIX: TMS320C54 module could not display names located in segments with a non-zero segment base

  • BUGFIX: TMS320C55x: some mov opcodes were decoded incorrectly

  • BUGFIX: tracing systenter on Windows XP would fail

  • BUGFIX: TXT: Open/Save file dialog could not list file name with wildcards in Windows

  • BUGFIX: unmapping all mapped local types and saving the database would corrupt local type storage

  • BUGFIX: wait_for_next_event() could hang if called without WFNE_SUSP and a suspending event occurred

  • BUGFIX: win32: it was possible to attach to services and debug them only once; to attach the second time, IDA had to be restarted

  • BUGFIX: windbg / kernel mode configuration was not being saved

  • BUGFIX: Windbg plugin (with dump-files) and windmp loader were failing to read certain memory areas

  • BUGFIX: IDC function xtol() function in IDC could not convert 64-bit values (in 64bit version of ida)

idapython_docs
blog post
blog post
this tutorial
here