LogoLogo
IDA 9.0
IDA 9.0
  • Welcome to Hex-Rays docs
    • What's new?
  • Getting Started
    • Install IDA
    • Licensing
    • Basic Usage
    • What's next?
  • User Guide
    • User Interface
      • Menu Bar
        • File
          • Load file
          • Script File
          • Script command
          • Produce output files
          • Invoke OS Shell
          • Take database snapshot
          • Save database
          • Save database as...
          • Abort IDA
          • Exit IDA
        • Edit
          • Export data
          • Undo an action
          • Redo an action
          • Clear undo history
          • Disable undo
          • Convert to instruction
          • Convert to data
          • Convert to string literal
          • Convert to array
          • Undefine a byte
          • Give Name to the Location
          • Operand types
            • Offset
            • Number
            • Perform en masse operation
            • Convert operand to character
            • Convert operand to segment
            • Complex Offset Expression
            • Convert operand to symbolic constant (enum)
            • Convert operand to stack variable
            • Change operand sign
            • Bitwise negate operand
            • User-defined operand
            • Set operand type
          • Comments
          • Functions
          • Structs
          • Segments
          • Patch core
          • Other
            • Rename Any Address
          • Plugins
        • Jump
          • Center current line in window
          • Problems List
        • Search
          • REGULAR EXPRESSION SYNTAX SUMMARY
        • View
          • Open subviews
          • Graphs
          • Message Window
          • Arrows window
          • Database snapshot manager
          • Highlighting identifiers
          • Browser options
          • Lumina options
          • Assembler level and C level types
          • C++ type details
          • Bookmarks window
          • Calculator
          • View segment registers
          • View Internal Flags
          • Hide
          • Unhide
          • Del hidden range
          • Hide all items
          • Unhide all items
          • Setup hidden items
        • Debugger
          • Debugger window
          • Process Control
            • Start process
            • Process options
            • Pause process
            • Terminate process
            • Step into
            • Step over
            • Run to cursor
            • Run until return
            • Attach to process
            • Detach from process
            • Set current ip
            • Show application screen
          • Breakpoints
          • Watches
          • Tracing
          • Source code view
            • Watch view (source level)
          • Process Memory
            • Take memory snapshot
            • Manual memory regions
            • Refresh memory
          • Thread list
          • Module list
          • Stack trace
          • Exceptions
          • Debugger options
          • Switch debugger
        • Lumina
        • Options
          • Low & High Suspicious Operand Limits
        • Windows
          • Rename a stack variable
          • Miscellanous Options
          • Environment variables
          • Reset Hidden Messages
          • Various dialog help messages
        • List of all menu options
      • Desktops
      • Command line
      • How To Use List Viewers in IDA
      • Licenses
        • Apache License for Ghidra
        • Apache License for LLVM
        • Common Public License Version 1.0
        • APPLE PUBLIC SOURCE LICENSE
        • PCRE2 LICENCE
        • GNU Lesser General Public License v2.1 for libiberty
      • Database conversion from idb to i64
    • Disassembler
      • Interactivity
      • Background Analysis
      • Graph view
        • Graphing tutorial
      • Proximity view
      • Navigation
        • Anchor
        • How to Enter a Segment Value
        • How to Enter a Number
        • How to Enter an Identifier
        • How to enter text
        • How to Enter an Address
      • Disassembly Gallery
        • Philips 51XA-G3
        • 6502 and 65C02 Disassembler
        • 6301, 6303, 6800, 6801 and 6803 Disassembler
        • 68040, Amiga
        • 6805 Disassembler
        • 6808 Disassembler
        • 6809 OS9 Flex Disassembler
        • 6809 Disassembler
        • 6811 Disassembler
        • 68HC12 Disassembler
        • 68HC16 Disassembler
        • 68k Amiga Disassembler
        • 68k Mac OS
        • 68k Palm Pilot
        • Unix COFF
        • NEC 78k0 and 78k0s Processor
        • 80196 Processor
        • 8051 Disassembler
        • Analog Devices 218x.
        • Alpha Processor – NT COFF
        • Alpha Processor – Unix ELF
        • Android ARM Executables (.elf)
        • ARC Processor
        • ARM Processor EPOC App
        • ARM Processor EPOC PE File
        • ARM Processor EPOC ROMFile
        • EPOC SIS File Handler
        • ARM Processor iOS (iPhone): Unlock
        • ARM Processor iOS (iPhone): Objective-C metadata
        • ARM Processor iOS (iPhone): Objective-C Instance variables
        • ARM Processor iOS (iPhone): Parameter Identification & Tracking (PIT)
        • ARM Processor iOS (iPhone): Start
        • ARM Processor iOS (iPhone): Switch statements
        • ARM Processor iOS (iPhone): C++ signatures
        • ARM Processor iOS (iPhone): Write
        • ARM Processor: Linux ELF
        • ARM Processor: AOF SDK
        • ARM Processor: Windows CE COFF Format
        • ARM Processor: Windows CE PE Format
        • ATMEL AVR Disassembler
        • C166 Processor
        • C166 Processor with ELF file
        • Rockwell C39
        • Microsoft .NET CLI Disassembler. VisualBasic library
        • CR16
        • Android Dalvik Executables (.dex)
        • Microsoft .NET CLI Disassembler
        • DSP56K
        • Fujitsu FR (.elf)
        • Gameboy
        • H8 300: COFF FILE Format
        • H8 300s: COFF FILE Format
        • H8 500
        • HPPA Risc Processor: HP-UX SOM
        • i51
        • i860
        • Intel i960
        • Intel IA-64 (Itanium)
        • Java Bytecode
        • Angstrem KR 1878
        • Renesas/Hitachi M16C
        • Renesas/Hitachi M32R
        • M740
        • M7700
        • M7900
        • MIPS Processor: Nintendo N64
        • MIPS R5900 Processor : Sony bin
        • MIPS Processor: Sony ELF
        • MIPS Processor: Sony PSX
        • MIPS Processor: Sony PSX
        • MIPS Processor: Unix COFF File Format
        • MIPS Processor: Unix ELF File Format
        • MIPS Processor: Windows CE PE File Format
        • MIPS Processor: Windows CE PE2 File Format
        • Panasonic MN102
        • Atmel OAK DSP
        • 80×86 Architecture: DOS Extender
        • 80×86 Architecture: Watcom Runtime
        • 80×86 Architecture: Geos APP
        • 80×86 Architecture: Geos DRV
        • 80×86 Architecture: Geos LIB
        • 80×86 Architecture: GNU COFF Format
        • 80×86 Architecture: OS/2 Linear Executable Format
        • 80×86 Architecture: Netware NLM
        • 80×86 Architecture: QNX Executable
        • 80×86 Architecture: Watcom Runtime
        • 80×86 Architecture: Windows OMF
        • 80×86 Architecture: Windows Portable Executable Format
        • 80×86 Architecture: Windows Virtual Device Driver
        • 80×86 Architecture: Windows 16 bits DLL
        • X-Box Disassembler
        • PDP 11: SAV File
        • PIC
        • PIC 12xx
        • Power PC AIF ECOFF file Format
        • Power PC Linux ELF
        • Mac OS PEF File
        • Mac OS X File
        • Windows NT PE File
        • Hitachi SH-1 Processor
        • Hitachi SH-3 Processor: Windows CE COFF format
        • Hitachi SH-3 Processor: Windows CE PE format
        • Hitachi SH-4 Processor: ELF File Format
        • Hitachi SH-4 Processor: Windows CE PE File Format
        • Super Nintendo Entertainement System (SNES)
        • SPARC Solaris COFF
        • SPARC Solaris ELF
        • SPARC Sun ELF
        • SPARC Sun ELF SO
        • ST 20C4
        • ST 7
        • ST 9
        • Toshiba TLCS 900
        • TMS 320c2 COFF
        • TMS 320c5
        • TMS 320c54
        • TMS 320c6 COFF File Format
        • TRICORE
        • SunPlus unSP
        • NEC V850
        • Z180 COFF File Format
        • Z380 COFF File Format
        • Z8
        • Z80
      • Supported processors
      • Supported file formats
        • Windmp file loader
      • Bitfields
        • Bit Fields tutorial
      • Structures tutorial
      • Union tutorial
      • Variable length structures tutorial
      • Data types, operands and constructs
      • Packed executables
    • Decompiler
      • Prerequisites
      • Quick primer
      • Exception handler
      • Introduction to Decompilation vs. Disassembly
        • Comparisons of ARM disassembly and decompilation
        • Comparisons of PowerPC disassembly and decompilation
        • Comparisons of MIPS disassembly and decompilation
        • Hex-Rays v7.4 vs. v7.3 Decompiler Comparison Page
        • Hex-Rays v7.3 vs. v7.2 Decompiler Comparison Page
        • Hex-Rays v7.2 vs. v7.1 Decompiler Comparison Page
      • Interactive operation
        • Rename
        • Set type
        • Set number representation
        • Edit indented comment
        • Edit block comment
        • Hide/unhide C statements
        • Split/unsplit expression
        • Force call type
        • Set call type
        • Add/del variadic arguments
        • Del function argument
        • Add/delete function return type
        • Jump to cross reference
        • Jump to cross reference globally
        • Generate HTML file
        • Mark/unmark as decompiled
        • Copy to assembly
        • Show/hide casts
        • Reset pointer type
        • Convert to struct *
        • Create new struct type
        • Split variable
        • Select union field
        • Jump to paired paren
        • Collapse/uncollapse item
        • Map to another variable
      • Batch operation
      • Configuration
      • Third party plugins
      • Floating point support
      • Support for intrinsic functions
      • Overlapped variables
      • gooMBA
      • Failures and troubleshooting
      • FAQ
      • Limitations
      • Tips and tricks
    • Debugger
      • Instant debugger
      • Remote debugging
        • Remote iOS Debugger
        • Android debugger
        • Dalvik debugger
        • Remote GDB Debugger
          • Remote GDB Debugger options
          • Debugging with gdbserver
          • Debugging with VMWare
          • Debugging with OpenOCD
          • Debugging with QEMU
          • External programs and GDB Debugger
          • Debugging code snippets with QEMU
        • PIN debugger
          • Building the PIN tool
          • Connecting a remote PIN tool instance from IDA
          • PIN support for MacOSX
        • Replayer debugger
        • Bochs debugger
          • Bochs Disk Image operation mode
          • Bochs IDB operation mode
          • Bochs PE operation mode
          • Bochs debugger FAQ
      • Local debugging
        • WinDbg Debugger
        • Linux debugger
        • Intel/ARM macOS debugger
      • Debugger tutorials
        • Debugging Dalvik Programs
        • IDA Win32 Local Debugging
        • IDA Linux Local Debugging
        • IDA Linux to Win64 Debugging
        • IDA Win32 to Linux Debugging
        • Debugging Mac OSX Applications with IDA Pro
        • Debugging iOS Applications using CoreDevice (iOS 17 and up)
        • Debugging iOS Applications with IDA Pro
        • Debugging Linux Applications locally
        • Debugging Linux/Windows Applications with PIN Tracer module
        • Debugging Windows Applications with IDA Bochs Plugin
        • Debugging Windows Applications with IDA WinDbg Plugin
        • Using the Bochs debugger plugin in Linux
        • Debugging Windows Kernel with VMWare and IDA WinDbg Plugin
        • Debugging Linux Kernel under VMWare using IDA GDB debugger
        • Windows Debugger Hub
        • Linux Debugger
        • Debugging a Windows executable locally and remotely
        • Debugging the XNU Kernel with IDA Pro
        • Remote debugging with IDA Pro
        • IDA Scriptable Debugger: overview
          • IDA Scriptable Debugger: scriptability
        • Debugging code snippets with QEMU debugger (a la IDA Bochs debugger)
        • Trace Replayer and managing traces
        • Using IDA Pro's tracing features
        • Working with PIN
        • Appcall
    • Creating Signatures
      • FLIRT
        • IDA F.L.I.R.T. Technology: In-Depth
        • Generate FLIRT signature file
        • Supported Compilers
          • Turbo Pascal
          • Delphi
      • Makesig
    • Creating Type Libraries
      • IDAClang
      • TILIB
    • Configuration
      • Configuration files
      • Command line switches
      • Keyboard macros
      • UI/Fonts/Themes
      • Shortcuts
      • Customizing IDA
      • CSS-based styling
    • Teams
      • IDA Teams Licenses
      • Diffing and Merging Databases with IDA Teams
      • Teams lc command reference manual
      • hv command reference manual
      • Hex-Rays Vault’s visual client user manual
    • Lumina
      • lc command reference manual
    • Plugins
      • Open Plugin Architecture
      • Plugin options
      • Plugins Shipped with IDA
        • Swift plugin
        • Golang plugin
        • Rust plugin
        • picture_search
        • Objective-C Analysis Plugin
        • DYLD Shared Cache Utils
        • Borland RTTI descriptors plugin
        • DWARF plugin
        • Patfind plugin
        • IDA Feeds
          • FLIRT Signature Bundle
      • Plugin Contest
      • How to write your own plugin?
    • Helper Tools
    • idalib
  • Developer Guide
    • C++ SDK
      • Getting Started with C++ SDK
      • C++ SDK Reference
      • Using the Decompiler SDK: Decompiler plugin
      • C++ SDK examples
      • How to create a plugin in C++?
      • C++ SDK Porting Guide from IDA 8.x to 9.0
    • IDAPython
      • Getting started with IDAPython
      • IDAPython API Reference
      • IDAPython examples
      • How to create a plugin in IDAPython?
      • IDAPython Porting Guide from IDA 8.x to 9.0
    • IDC
      • Core concepts
        • Expressions
        • Statements
        • Functions
        • Variables
        • Constants
        • Exceptions
        • Classes
        • Predefined symbols
        • loader_input_t class
        • Slices
      • IDC API Reference
        • Index of debugger related IDC functions
        • Alphabetical list of IDC functions
          • is_member_id
          • load_type
          • get_member_by_idx
          • get_ordinal_limit
          • set_selector
          • enable_tracing
          • get_prev_fixup_ea
          • del_segm
          • get_bmask_cmt
          • end_type_updating
          • Find
          • toggle_bnot
          • patch_byte
          • get_module_info
          • set_member_name
          • create_float
          • del_struc_member
          • read_dbg_memory
          • get_enum_width
          • getn_thread_name
          • del_struc
          • filelength
          • set_manual_insn
          • is_value...() functions
          • get_ip_val
          • del_extra_cmt
          • create_insn
          • op_offset_high16
          • get_cmt
          • expand_struc
          • get_idb_path
          • set_frame_size
          • get_file_ext
          • has_value
          • readshort
          • sanitize_file_name
          • get_member_flag
          • create_struct
          • ARM specific
          • set_enum_member_cmt
          • rename
          • set_ida_state
          • get_member_size
          • msg
          • qbasename
          • get_enum_member_enum
          • auto_mark_range
          • plan_to_apply_idasgn
          • set_named_type
          • op_offset
          • rename_entry
          • strlen
          • get_extra_cmt
          • get_enum_flag
          • fgetc
          • op_stkvar
          • get_last_index
          • get_field_ea
          • get_struc_id
          • select_thread
          • create_array
          • get_struc_cmt
          • set_array_string
          • set_func_attr
          • set_storage_type
          • get_struc_size
          • demangle_name
          • get_next_fixup_ea
          • get_next_bmask
          • delattr
          • gen_simple_call_chart
          • patch_qword
          • get_enum_name
          • loader_input_t.getc
          • get_debugger_event_cond
          • read_dbg_qword
          • define_local_var
          • generate_disasm_line
          • add_idc_hotkey
          • tolower
          • del_selector
          • set_debugger_event_cond
          • get_imagebase
          • gen_file
          • get_entry
          • find_custom_data_format
          • get_debug_name_ea
          • add_default_til
          • set_func_end
          • exit_process
          • delete_array
          • xtol
          • get_exception_code
          • detach_process
          • set_enum_cmt
          • get_wide_word
          • put_bookmark
          • is_loaded
          • add_enum_member
          • parse_decls
          • readstr
          • get_entry_qty
          • ord
          • sprintf
          • get_root_filename
          • get_enum_member_cmt
          • create_word
          • set_func_flags
          • loader_input_t.tell
          • create_align
          • read_dbg_dword
          • next_addr
          • get_bytes
          • batch
          • start_process
          • process_config_line
          • del_user_info
          • qmakefile
          • set_struc_name
          • print_decls
          • create_custom_data
          • del_enum_member
          • format_cdata
          • get_fixup_target_sel
          • get_item_size
          • loader_input_t.gets
          • get_last_bmask
          • Step Tracing Options
          • selector_by_name
          • get_enum_cmt
          • next_not_tail
          • prev_head
          • set_color
          • set_numbered_type
          • get_member_name
          • auto_wait
          • get_enum_member_bmask
          • fseek
          • get_segm_start
          • attach_process
          • Trace file functions
          • get_enum_member_value
          • op_stroff
          • get_next_offset
          • set_processor_type
          • get_bookmark_desc
          • create_data
          • lastattr
          • get_operand_value
          • collect_stack_trace
          • toupper
          • get_fixup_target_dis
          • set_cmt
          • add_entry
          • set_segm_addressing
          • qmake_full_path
          • get_source_linnum
          • fputc
          • resume_thread
          • get_func_attr
          • get_first_enum_member
          • add_sourcefile
          • get_first_bmask
          • read_selection_start
          • hasattr
          • get_member_cmt
          • gen_flow_graph
          • get_array_element
          • get_tinfo
          • loader_input_t
          • tinfo_errstr
          • TRUNC
          • add_segm_ex
          • Local types information and manipulation helpers
          • set_source_linnum
          • get_next_enum_member
          • loader_input_t.readbytes
          • set_array_params
          • jumpto
          • get_bookmark
          • set_enum_bf
          • prev_not_tail
          • toggle_sign
          • loader_input_t.size
          • Trace events functions
          • get_func_flags
          • get_gotea
          • set_segm_attr
          • get_item_head
          • set_default_sreg_value
          • print_insn_mnem
          • set_member_cmt
          • get_ordinal_qty
          • set_target_assembler
          • add_user_stkpnt
          • set_local_type
          • Hidden ranges
          • del_items
          • compile_idc_text
          • Dalvik debugger extension functions
          • byte_value
          • create_dword
          • is_code
          • del_func
          • get_enum
          • make_array
          • rotate_left
          • recalc_spd
          • search_path
          • CommonBits
          • get_processor_name
          • set_func_cmt
          • get_prev_bmask
          • Hashes
          • split_sreg_range
          • process_ui_action
          • set_fixup
          • get_fixup_target_type
          • create_oword
          • get_flags
          • get_func_name
          • create_strlit
          • add_struc
          • atol
          • load_debugger
          • mkdir
          • sizeof
          • get_enum_member_by_name
          • save_database
          • guess_type
          • get_segm_name
          • print_operand
          • qisabspath
          • get_member_qty
          • set_struc_cmt
          • get_fixup_target_flags
          • idadir
          • object.retrieve
          • add_auto_stkpnt
          • get_numbered_type_name
          • get_enum_member_name
          • get_next_index
          • prev_addr
          • get_name_ea
          • get_sp_delta
          • set_bmask_cmt
          • readlong
          • set_segm_name
          • get_prev_offset
          • set_segm_alignment
          • get_strlit_contents
          • forget_exception
          • get_item_end
          • add_func
          • get_name
          • Asks
          • get_spd
          • Debugger: control
          • get_wide_byte
          • plan_and_wait
          • set_enum_flag
          • RunPythonStatement
          • del_sourcefile
          • find_selector
          • get_frame_regs_size
          • op_num
          • define_exception
          • create_double
          • create_byte
          • read_selection_end
          • OpTypes
          • op_plain_offset
          • move_segm
          • get_member_id
          • set_segm_combination
          • get_current_thread
          • trim
          • Debugger: options
          • getn_thread
          • get_frame_id
          • typeinfo.print
          • to_ea
          • rebase_program
          • add_struc_member
          • get_exception_qty
          • get_first_index
          • import_type
          • set_segm_type
          • find_custom_data_type
          • get_next_seg
          • find_func_end
          • get_last_enum_member
          • getattr
          • get_frame_size
          • get_screen_ea
          • loader_input_t.read
          • set_reg_value
          • Debugger: modules
          • create_pack_real
          • writestr
          • exec_idc
          • get_enum_size
          • set_enum_name
          • create_tbyte
          • sel2para
          • atoa
          • loader_input_t.close
          • add_enum
          • ltoa
          • substr
          • del_idc_hotkey
          • Breakpoint handling functions
          • loader_input_t.seek
          • cleanup_appcall
          • object.store
          • get_type
          • qexit
          • get_debug_name
          • get_array_id
          • Can't Open File
          • suspend_process
          • process_config_directive
          • get_entry_name
          • get_last_member
          • get_struc_name
          • clear_selection
          • fclose
          • firstattr
          • create_yword
          • dbg_appcall
          • get_qword
          • patch_dword
          • begin_type_updating
          • read_dbg_byte
          • get_fpnum
          • qsleep
          • get_first_member
          • get_nsec_stamp
          • del_stkpnt
          • eval
          • savefile
          • eval_python
          • Xrefs
          • strstr
          • writeshort
          • get_sreg
          • get_segm_end
          • get_func_off_str
          • set_func_start
          • del_array_element
          • get_full_flags
          • set_exception_flags
          • rename_array
          • get_frame_args_size
          • op_flt
          • get_min_spd_ea
          • apply_type
          • get_prev_index
          • loadfile
          • retrieve_input_file_md5
          • get_wide_dword
          • patch_dbg_byte
          • Functions provided by the WinDbg debugger
          • get_original_byte
          • get_member_strid
          • call_system
          • writelong
          • get_thread_qty
          • nextattr
          • send_dbg_command
          • get_first_seg
          • get_processes
          • patch_word
          • get_manual_insn
          • ftell
          • get_entry_ordinal
          • set_array_long
          • delete_all_segments
          • TO_LONG
          • Function chunk related functions
          • Debugger: events
          • get_prev_func
          • op_seg
          • validate_idb_names
          • fprintf
          • fopen
          • strfill
          • del_fixup
          • get_bmask_name
          • inf_attr
          • is_bf
          • read_dbg_word
          • qdirname
          • get_segm_attr
          • func_contains
          • del_source_linnum
          • get_sourcefile
          • clr_database_flag
          • set_name
          • Refresh Screen
          • op_enum
          • getn_enum
          • get_db_byte
          • setattr
          • get_forced_operand
          • op_bin
          • Functions provided by the replayer debugger
          • prevattr
          • update_extra_cmt
          • get_str_type
          • op_man
          • choose_func
          • set_bmask_name
          • get_curline
          • decode_insn
          • set_segment_bounds
          • set_segm_class
          • write_dbg_memory
          • get_exception_name
          • get_enum_member
          • is_mapped
          • del_enum
          • get_frame_lvar_size
          • get_operand_type
          • set_root_filename
          • compile_idc_file
          • typeinfo.size
          • get_local_tinfo
          • get_fixup_target_off
          • is_union
          • unlink
          • get_segm_by_sel
          • set_enum_width
          • take_memory_snapshot
          • exec_python
          • get_next_func
          • get_member_offset
          • get_func_cmt
          • parse_decl
          • create_qword
          • next_head
          • suspend_thread
          • loader_input_t.getz
          • get_color
          • get_reg_value
          • load_and_run_plugin
          • set_database_flag
          • set_enum_member_name
          • set_member_type
          • get_prev_enum_member
      • IDC examples
        • Analyzing encrypted code
  • Admin Guide
    • Lumina server
    • Teams server
    • License server
      • Hex-Rays License Server Migration Guide
  • Release Notes
    • IDA 9.0
    • IDA 8.4sp2
    • IDA 8.4sp1
    • IDA 8.4
    • IDA 8.3
    • IDA 8.2sp1
    • IDA 8.2
    • IDA 8.1
    • IDA 8.0sp1
    • IDA 8.0
    • IDA 7.7sp1
    • IDA 7.7
    • IDA 7.6sp1
    • IDA 7.6
    • IDA 7.5sp3
    • IDA 7.5sp2
    • IDA 7.5sp1
    • IDA 7.5
    • IDA 7.4sp1
    • IDA 7.4
    • IDA 7.3
      • IDA 7.3 Undo: IDA can do it
    • IDA 7.2
      • IDA 7.2 The Mac Rundown
    • IDA 7.1
      • IDA 7.1 Debugger API 7.1 Porting Guide
    • IDA 7.0sp1
    • IDA 7.0
      • Internationalization (i18n)
      • Automatic discovery of string literals
      • API 7.0 Porting Guide
      • IDAPython backward compatibility
    • IDA 6.95
    • IDA 6.9
    • IDA 6.8
    • IDA 6.7
    • IDA 6.6
    • IDA 6.5
    • IDA 6.4
    • IDA 6.3
    • IDA 6.2
    • IDA 6.1
    • IDA 6.0
    • IDA 5.7
    • IDA 5.6
    • IDA 5.5
      • 5.5 Gallery
      • 5.5 Comparison
    • IDA 5.4
    • IDA 5.3
    • IDA 5.2
    • IDA 5.1
    • IDA 5.0
    • IDA 4.9SP
    • IDA 4.9
    • IDA 4.8
    • IDA 4.7
    • IDA 4.6
    • IDA 4.x
    • IDA 3.x
    • Cumulative bugfix for IDA
  • Archive
    • IDA’s Windbg plugin
    • IDA’s Bochs debugger plugin
    • IDA’s Bochs debugger plugin 2
    • DosWin32
    • Hex-Rays v1.1 vs. v1.0 Decompiler Comparison Page
    • Hex-Rays v1.2 vs. v1.1 Decompiler Comparison Page
    • Hex-Rays v1.3 vs. v1.2 Decompiler Comparison Page
    • Hex-Rays v1.6 vs. v1.5 Decompiler Comparison Page
    • Hex-Rays v1.7 vs. v1.6 Decompiler Comparison Page
    • Costly Greetings – An Adventure In Hostile Code Analysis
    • An Adventure In Hostile Code Analysis: Description
    • An Adventure In Hostile Code Analysis: Disassembly
    • Improved code flow analysis
    • Program Navigation Bar
    • IDA Home Contest
    • Pimp My IDA: vote results
    • Turning off IDA 6.x compatibility in IDAPython
    • Porting guide for IDA 7.4 turning off IDA 6.x API backwards-compatibility by default
    • Porting guide for IDA 7.4 IDAPython and Python 3
    • IDAPython and Python 3
    • Porting guide for changes in IDAPython-on-Python-3 APIs
    • Debugging iOS Applications With IDA
    • IDA Win32 to Win32 Debugging
    • IDA Win32 to Win64 Debugging
    • Legacy license server: Floating Licenses
      • Installing on Linux
      • Installing on Windows
      • Installing on OS X
    • Decompiler Installation
    • Enumerated types tutorial
  • Bug Bounty
Powered by GitBook
LogoLogo

Need Help?

  • FAQs
  • Support

Community

  • Forum
  • Plugins

Resources

  • Blog
  • Download center

© 2025 Copyright Hex-Rays

On this page

Was this helpful?

Export as PDF
  1. Release Notes

IDA 6.2

Last updated 7 months ago

Was this helpful?

Highlights

  • GUI installers for Linux and OS X No more manual extraction of tar archives for Linux or OS X. A new installer will be provided for ease of installation. Linux installer screenshot:

    OS X installer screenshot:

  • Proximity view: The allows the user to see and browse the relationships between functions, global variables, constants, etc...

    It can be used, for example, to visualize the complete callgraph of a program, to see the path between 2 functions or what global variables are referenced from some function.

  • PE+ support for Bochs (64-bit PE files) Now the Bochs debugger plugin supports debugging basic PE+ executables. API emulation via scripting also works as usual. Click for more details.

    (Screenshot of a PE+ malware being debugged with the Bochs debugger plugin)

  • UI shortcut editor With this feature, it will be possible to change and re-assign the shortcuts of built-in IDA actions and the default shortcuts of plugins, external menu entries and IDC scripts.

    More about

  • UI filters in choosers This feature will be very handy when it comes to filtering out the content of choosers in order to show or highlight the items that matter.

    More about

  • Database snapshots In this version, it will be possible to take and restore them when needed (hierarchical snapshots are supported as well).\

  • Automatic new version check Checking for new Hex-Rays products version has been improved. This new addition will check for new versions of IDA Pro or the Hex-Rays Decompilers.\

  • Cross-references to structure members Another nice addition are xrefs to structure members. This features comes in handy when reversing/tracking data structure use in a program for example.

  • ARM and iOS analysis improvements Apple is not standing still and in iOS 5 the default compiler will be LLVM instead of GCC. It produces somewhat different code and we have improved our processor module to handle it. Compare two snippets of the same file.

    In IDA Pro 6.1:

    In IDA Pro 6.2:

    As you can see, we now also parse and analyze Objective-C 2.0 metadata structures produced by the compiler. Using that information, we rename methods, create structures for classes, and apply C-style prototypes to methods for better results in the decompiler.

    We have also added support for the dyld_shared_cache format used in current iOS versions.

    kernelcache files are also recognized now and are split into separate KEXTs.

  • IDAPython 1.5.3 IDAPython has been updated. The most notable additions:

    • More form control support (refer to AskUsingForm() documentation in the SDK)

    • New processor and UI notification callbacks

    • New APIs and samples

    • IDC compatible netnode support

    • ! and ? pseudo commands to shell execute and retrieve documentation

    • Support for extending IDC functions using Python

    • Working with patched bytes

    • Binding of hotkeys with Python functions (no need to go through IDC anymore)

  • Floating licenses An IDA Pro with floating license can be installed on many computers but only the purchased number of seats can be used simultaneously. Floating licenses require installation of a license manager to track the license use. This feature is useful for enterprises who want to optimize the license use.

Changelist

Processor Modules

  • + 65816: A 65816 CPU module (used in SNES consoles)

  • + ARM: better tracking of cross-references in code produced by LLVM compiler (MOVW+MOVT pairs)

  • + Dalvik: decode instructions produced by dexopt (odex)

  • + HCS12X: implemented extended direct addressing (using DIRECT Direct Page register)

  • + PC: improve recognition of x64 switches produced by GCC

  • + PC: most assemblers encode mov ds, ax and mov ds, eax differently; handle it in the same way

  • + PC: some sparse switches produced by Visual C++ for x64 were not recognized

  • + PC: __SEH_prolog and similar functions were not properly handled in debugged modules

  • + PC: display "66 90" as "xchg ax, ax"

  • + PPC: decode tlbie and tlbiel with an optional immediate operand

  • + SuperH: track values loaded into the gbr register

  • + Z8: added configuration file for device-specific registers, including the Extended Register File banks

  • + Z8: detect the use of different register banks by tracking changes to the register pointer (RP) value

File Formats

  • + SMC: added a SNES rom loader

  • + ELF: added support for MN10200 and MN10300 (AM33, AM34) files

  • + ELF: added support for x64 TLS relocations in object files

  • + ELF: ARM: added support for R_ARM_THM_PC8 relocation

  • + LOD: added a loader for Motorola DSP56000 .LOD files

  • + MACHO: entry point was not set properly for some packed files

  • + MACHO: parse Objective-C 2.0 metadata, rename methods, create structures

  • + MACHO: support dyld_shared_cache file format

  • + MACHO: detect OS X/iOS kernelcache files and split the image into kext subfiles

  • + PE: added support for ARMv7 relocations (MOV32T)

  • + PE: create segments for gaps between sections when complete file is mapped to memory

  • + PE: manually loading PE files will prompt before processing the export directory and the TLS entries

  • + PE: overlays can now be loaded in manual mode

  • + UImage: added a loader for U-Boot images

  • + PDB: support PDBs for ARMv7 files

Kernel

  • + Improved display of self-modifying code which changes during debugging

  • + Track cross-references to structure members

FLIRT & TILS

  • + TIL: tilib: added support the new constructs from VC10 header files

  • + TIL: added VC10 TIL file

  • + FLIRT: pelf: added R_ARM_THM_PC8 support

Scripts & SDK

  • + IDAPython: added add_hotkey and del_hotkey() to associate hotkeys with Python functions

  • + IDAPython: added execute_sync() to insert a function call into the UI message queue

  • + IDAPython: added execute_ui_requests()

  • + IDAPython: added idatuils.ProcessUiActions() to process more than one UI action at a time

  • + IDAPython: added IDC array functions in idc.py module

  • + IDAPython: added IDC hash functions in idc.py module

  • + IDAPython: Added MakeCustomData() (and related MakeCustomDataEx)

  • + IDAPython: added ph_get_operand_info()

  • + IDAPython: Added Structs() and StructMembers() generator functions

  • + IDAPython: added support for multiline text input in the Form class

  • + IDAPython: added the assemble callback

  • + IDAPython: added timer functions

  • + IDAPython: added ui_term/ui_save/ui_saved/ui_get_ea_hint UI notifications

  • + IDAPython: added visit_patched_bytes()

  • + IDAPython: better error reporting for plugin scripts, loaders and processor modules

  • + IDAPython: introduced the '!' (shell command) and '?' (Python help) pseudo commands to the CLI

  • + IDAPython: it is now possible to add/register new IDC functions from Python

  • + IDC: added GetNsecStamp()

  • + IDC: DecodeInstruction() now exposes the canonical feature and mnemonic

  • + IDC: it is now possible to catch IDC script interruption (with a try/catch) and resume exection if needed

  • + IDC: renimp.idc: added support for PE+

  • + SDK: added ALOPT_IGNPRINT option for get_max_ascii_length()

  • + SDK: added execute_ui_requests() to execute a list of UI requests asynchronously

  • + SDK: added extlang->run_statements() callback

  • + SDK: added find_extlang_by_name()

  • + SDK: added gen_rand_buf() to generate random data

  • + SDK: added get_ascii_contents2()

  • + SDK: added LP_USE_SHELL bit to launch_process() to launch commands using a shell

  • + SDK: added new breakpoint management functions to work with source and module relative breakpoints

  • + SDK: added qcopyfile()

  • + SDK: added qfsize() and deprecated efilelength()

  • + SDK: added qtime64_t and supporting functions

  • + SDK: added read/write_dbg_memory(), set_reg_vals() and get_dbg_memory_info()

  • + SDK: added register_addon() to allow registration of plug-ins and other add-ons for the About box

  • + SDK: added save_database_ex()

  • + SDK: added snapshot management plugin sample

  • + SDK: added snapshot manipulation functions

  • + SDK: added ui_requests plugin sample

  • + SDK: added visit_patched_bytes()

  • + SDK: exec requests can now set code = 0 inside their execute method to delegate their destruction to handle_exec_request

  • + SDK: exported base64_encode/base64_decode functions

  • + SDK: introduced ASKBTN_XXX constants for askyn() and askbuttons() functions

  • + SDK: moved debugger related functions to dbg.hpp (get_dbg_byte, etc)

  • + SDK: updated the "uunp" plugin to support PE+ when used in manual reconstruction mode

  • + SDK: Windbg: added debugger extension interface

  • + SDK: removed support for create_flow_chart() and flow_chart_t. Please use qflow_chart_t instead.

  • + SDK: UI: added a way to specify and retrieve user data in forms

  • + SDK: UI: added the close() method to form actions

  • + SDK: UI: added timers API for plugins

  • + SDK: UI: qt: added the code viewer control

  • + SDK: UI: qt: added the get_attrs callback to embedded choosers

User Interface

  • + GUI installer for Linux and OS X

  • + UI: added the proximity browser view

  • + UI: added IDA_NOEH environment variable to disable IDA exception handler on Windows

  • + UI: setting IDA_MINIDUMP=NO disables minidump writing on Windows

  • + UI: File/IDC command (Shift-F2) has been replaced with File/Script command to execute a statement with a selected extlang

  • + UI: Edit/Patch functionality is now enabled by default

  • + UI: added "Edit/Patch/Apply patches to input file" functionality to directly save the patches back to the input file

  • + UI: added combobox and multi-line edit controls to forms (AskUsingForm())

  • + UI: added a menu item "Report a bug or an issue..."

  • + UI: added a status bar context menu item for quick access to processor-specific analysis options

  • + UI: added an option to automatically check for new versions and request updates for IDA

  • + UI: added database snapshots support

  • + UI: added the 'select nodes of this color' right click menu command (available in the graph mode)

  • + UI: AskUsingForm_c() no longer exits IDA in case of form syntax error. Very useful when building forms dynamically from IDAPython

  • + UI: idag.exe and idau.exe are discontinued

  • + UI: idaq now uses CHM (HTML Help) under Windows

  • + UI: plugins can now be quickly executed using the "Quick plugin run" functionality (Ctrl-3)

  • + UI: qt: added the MSG_DELAYED_UPDATE configuration option

  • + UI: qt: added the shortcut editor

  • + UI: qt: all Ctrl-Ins copy shortcuts were changed to Ctrl-C

  • + UI: OSX: 'I' key is used in place of 'Ins' on OS X

Debugger

  • + Added the '-I' command line switch to install IDA as a just-in-time debugger

  • + debugger: added "event condition" debugger option to allow breaking when a debug event matches a given criteria

  • + debugger: huge zero filled arrays are displayed faster in the debugger (do not use the dup construct for them)

  • + Bochs: added option to disable Activation context and SearchPath() usage (this allows loading libraries from current directory or search path w/o activating context applied)

  • + Bochs: added support for PE+ (64-bit PE files)

  • + PDB: handle MIPS16 and ARMv7 files (low bit of the symbol address specifies Thumb/MIPS16 bit)

  • + Win32/Linux/Mac debuggers now support I/O redirection

  • + Win32 debuggers now have a new window to show the SEH list

  • + Windbg: added option to disable debugger auto launch for crash dump files

Bugfixes

  • BUGFIX: 'edit breakpoints' dialog was still wrong in 6.1

  • BUGFIX: 'search for undefined address' (Ctrl-U) was not working correctly in debugger segments

  • BUGFIX: an exception in asynchronious execution request (execute_sync) could crash ida

  • BUGFIX: ARM: instructions combined into macros inside IT blocks could lead to wrong disassembly

  • BUGFIX: armuclinux server was probably broken (it was using a separate thread to listen to debugee events but uclinux seems to have issues with that)

  • BUGFIX: associating .idb extension with idaq was broken

  • BUGFIX: Bochs debugger in disk image mode would display wrong addresses sometimes (caused by optimizer bug in VS2010 compiler)

  • BUGFIX: bochs was not handling sections with vsize==0 properly

  • BUGFIX: bochsrc loader was failing to load the boot sector of the disk images if it was larger than 4GB

  • BUGFIX: choosing a device configuration in some processors could crash IDA on Windows

  • BUGFIX: clicking on the title of a group node could crash IDA

  • BUGFIX: debthread could not handle a hung remote server correctly

  • BUGFIX: debugger: long DNS lookup for the connected peer name could lead to failure of the remote debugging session

  • BUGFIX: demangler option "no return types of functions" had no effect for Borland mangled names

  • BUGFIX: DOS: programs with Borland overlays (FBOV) were loaded incorrectly

  • BUGFIX: EPOC: imports from hal.dll were not renamed

  • BUGFIX: Executing a script that could cause a desktop switch (start or stop debugger) from the recent scripts window would crash IDA

  • BUGFIX: find_binary() was crashing if radix of 0 was passed

  • BUGFIX: find_strmem2() with STRMEM_INDEX was broken

  • BUGFIX: get_next_struc_idx(-1) was not returning -1 as it should

  • BUGFIX: get_type_size() could return >0 value for some illegal types

  • BUGFIX: High 64 bit addresses were not being parsed properly by IDAPython in idaq64

  • BUGFIX: IDA could crash if starting the application the first time failed (e.g. application path was wrong)

  • BUGFIX: IDA could interr when trying to edit an address name in stack view

  • BUGFIX: ida was failing with interr 40419 while rendering some graphs

  • BUGFIX: IDAPython: Calling set_script_timeout() from callbacks may show the script wait box dialog with no possibility to close it

  • BUGFIX: IDAPython: dbg_bpt was called instead of dbg_trace for a DBG_Hooks class implementation

  • BUGFIX: IDAPython: dbg_read|write_memory() and dbg_get_thread_sreg_base() were broken

  • BUGFIX: IDAPython: del_menu_item() was failing to delete menu items inserted in the middle of a menu list

  • BUGFIX: IDAPython: get_blob() was returning a buffer with at most MAXSPECSIZE bytes

  • BUGFIX: idapython: idaapi.get_item_head() was ignored

  • BUGFIX: IDAPython: idc.GetString()/idaapi.get_ascii_contents()/idautils.Strings() were limited to MAXSTR string length

  • BUGFIX: IDC: DelStruc() was behaving as a 'void' function (always returning 0)

  • BUGFIX: IDC: on OS X, macros with 6 or more arguments would cause a syntax error

  • BUGFIX: IDC: rotate_left() was broken

  • BUGFIX: if a function lost some basic blocks (for example, because the user truncated it), its flowchart might be rendered with some empty nodes

  • BUGFIX: if a read or read/write hardware breakpoint and a software breakpoint were defined at the same address, IDA would get confused when such such a breakpoint gets hit

  • BUGFIX: illegal graph group info in the IDB could crash IDA

  • BUGFIX: immediate search could not match the search criteria against defined data items

  • BUGFIX: import libraries for gcc under ms windows were erroneously including _alloca and _main symbols.

  • BUGFIX: in some cases IDA was trying to read memory outside of ranges provided by a debugger module

  • BUGFIX: It was not possible to suspend Bochs if the debuggee was continously calling an API which is emulated by an IDC script

  • BUGFIX: launch_process() was crashing in unix if command line arguments were NULL

  • BUGFIX: linker directives with non-ascii characters in coff files would be displayed incorrectly

  • BUGFIX: location of relative breakpoint was displayed in absolute notation in some cases

  • BUGFIX: multithreaded Android applications could not be debugged on some devices

  • BUGFIX: non-null terminated strings were printed incorrectly for assemblers with ASCIIZ directives (such as AIX PPC assembler)

  • BUGFIX: Opening a crash dump file was failing in some cases

  • BUGFIX: opening a malicious idb could lead to launching of debugger on any file (including files accessible with webdav)

  • BUGFIX: PC: handling of __fastcall calling convention for Delphi was wrong

  • BUGFIX: PC: mov to/from CRn/DRn ignore the mod field and always treat operands as registers (thanks to Ange Albertini)

  • BUGFIX: PC: type information from .til files was not used for __fascall APIs (e.g. KfAcquireSpinLock)

  • BUGFIX: PPC: dccci instruction with non-zero operands was decoded incorrectly

  • BUGFIX: PDB: loading symbols for a module in memory (during debugging) could fail

  • BUGFIX: PDB: old way of retreiving symbols (via dbghelp.dll) did not work for 64-bit modules loaded above 4GB

  • BUGFIX: PDB: the "Load debug symbols" command was trying to use local files even when debugging remotely

  • BUGFIX: PE loader could not properly handle relocations of type IMAGE_REL_BASED_DIR64

  • BUGFIX: PE: files with exceedingly big relocation table size could not be loaded

  • BUGFIX: PE: MIPS16 and ARMv7 exports and .pdata entries were not handled correctly

  • BUGFIX: PE: some files with bogus/huge ImageSize could not be loaded (thanks to Ange Albertini)

  • BUGFIX: qrealloc() was freeing the original pointer if allocation failed

  • BUGFIX: qsem_create() was ignoring the initial value in mac

  • BUGFIX: qt: askfile_c() was returning paths with forward slashes (/) on Windows; this broke some old plugins

  • BUGFIX: qt: custom graphs were sometimes displaying some additional misplaced context-menu items

  • BUGFIX: qt: forms with no dialog buttons (yes, no, cancel) would cause a crash

  • BUGFIX: qt: jump buttons in the CPU Registers window were not working correctly on OSX

  • BUGFIX: Qt: On OS X, shortcuts not defined inside idagui.cfg could contain the wrong modifier

  • BUGFIX: qt: rendering on mac had problems because of a bug in the Carbon API

  • BUGFIX: qt: some actions were not disabled in the stack frame view

  • BUGFIX: qt: the jump xref action was missing in the stack frame view

  • BUGFIX: qt: the strings sub-menu was missing letter shortcuts

  • BUGFIX: qthread_kill() was freeing qthread_t in Windows; it should not

  • BUGFIX: running ida with -z10000 could lead to deadlocks or crashes (for win32/linux/mac debugger modules)

  • BUGFIX: SDK: askfile_c() default answer was not populated properly if it contained an absolute file path

  • BUGFIX: SDK: qfilesize() now returns 0 if file is too large or does not exist (use get_qerrno() to tell between the two).

  • BUGFIX: second failed attempt to launch the debugger would lead to interr

  • BUGFIX: some edges of the graph would be rendered incorrectly after deleting an uncollapsed group (only if the graph contained more than one group)

  • BUGFIX: text version of ida could hang while executing a script that handles numerous debug events

  • BUGFIX: the form change callback of AskUsingForm() may be called recursively (leading to a crash) when using fa.set_field_value()

  • BUGFIX: the function flowchart with custom layout and collapsed groups could be refreshed incorrectly in some cases

  • BUGFIX: UI: "set segment register value dialog" was still using segment selectors even if the processor module had PR_SGROTHER flag set

  • BUGFIX: UI: it was not possible to set a structure member's type to Float from the menus

  • BUGFIX: UI: refreshing the graph was not resetting all the variables, some were still pointing to old nodes

  • BUGFIX: UI: text version was crashing when calling up "Processor-specific options"

  • BUGFIX: UI: the "Analysis enabled" checkbox in the load file dialog did not work as expected for non-x86 files

  • BUGFIX: UI: the notepad text could exceed the maximum size and overwrite other blob indexes

  • BUGFIX: under Windows, IDA still loaded a plugin even if it was renamed to e.g. plugin.plw1 (because the short name extension was still .plw)

  • BUGFIX: Windbg 64bit was always proposing to run the dbgsrv even for 32bit apps

  • BUGFIX: Windbg debugger in kernel mode would show one big segment called MEMORY in some cases

  • BUGFIX: windbg debugger plugin was ignoring the DBGTOOLS value in ida.cfg

  • BUGFIX: Windbg plugin was not able to restore absolute breakpoints on the process start if the memory was not already mapped

  • BUGFIX: Windbg plugin was not working properly in kernel debugging with reconnect mode

  • BUGFIX: Windbg: re-attaching to the kernel debugger may in some cases yield an empty module list (in the modules list window)

  • BUGFIX: Windows plugins that used create_flow_chart() function (e.g. Color Loops) were crashing IDA 6.1.

  • BUGFIX: IDAPython: calling reserve() on a movable type regvals_t was crashing due to regval_t.clear() with grabage values

proximity viewer
here
the shortcut editor
the chooser filters
database snapshots