LogoLogo
IDA 9.0
IDA 9.0
  • Welcome to Hex-Rays docs
    • What's new?
  • Getting Started
    • Install IDA
    • Licensing
    • Basic Usage
    • What's next?
  • User Guide
    • User Interface
      • Menu Bar
        • File
          • Load file
          • Script File
          • Script command
          • Produce output files
          • Invoke OS Shell
          • Take database snapshot
          • Save database
          • Save database as...
          • Abort IDA
          • Exit IDA
        • Edit
          • Export data
          • Undo an action
          • Redo an action
          • Clear undo history
          • Disable undo
          • Convert to instruction
          • Convert to data
          • Convert to string literal
          • Convert to array
          • Undefine a byte
          • Give Name to the Location
          • Operand types
            • Offset
            • Number
            • Perform en masse operation
            • Convert operand to character
            • Convert operand to segment
            • Complex Offset Expression
            • Convert operand to symbolic constant (enum)
            • Convert operand to stack variable
            • Change operand sign
            • Bitwise negate operand
            • User-defined operand
            • Set operand type
          • Comments
          • Functions
          • Structs
          • Segments
          • Patch core
          • Other
            • Rename Any Address
          • Plugins
        • Jump
          • Center current line in window
          • Problems List
        • Search
          • REGULAR EXPRESSION SYNTAX SUMMARY
        • View
          • Open subviews
          • Graphs
          • Message Window
          • Arrows window
          • Database snapshot manager
          • Highlighting identifiers
          • Browser options
          • Lumina options
          • Assembler level and C level types
          • C++ type details
          • Bookmarks window
          • Calculator
          • View segment registers
          • View Internal Flags
          • Hide
          • Unhide
          • Del hidden range
          • Hide all items
          • Unhide all items
          • Setup hidden items
        • Debugger
          • Debugger window
          • Process Control
            • Start process
            • Process options
            • Pause process
            • Terminate process
            • Step into
            • Step over
            • Run to cursor
            • Run until return
            • Attach to process
            • Detach from process
            • Set current ip
            • Show application screen
          • Breakpoints
          • Watches
          • Tracing
          • Source code view
            • Watch view (source level)
          • Process Memory
            • Take memory snapshot
            • Manual memory regions
            • Refresh memory
          • Thread list
          • Module list
          • Stack trace
          • Exceptions
          • Debugger options
          • Switch debugger
        • Lumina
        • Options
          • Low & High Suspicious Operand Limits
        • Windows
          • Rename a stack variable
          • Miscellanous Options
          • Environment variables
          • Reset Hidden Messages
          • Various dialog help messages
        • List of all menu options
      • Desktops
      • Command line
      • How To Use List Viewers in IDA
      • Licenses
        • Apache License for Ghidra
        • Apache License for LLVM
        • Common Public License Version 1.0
        • APPLE PUBLIC SOURCE LICENSE
        • PCRE2 LICENCE
        • GNU Lesser General Public License v2.1 for libiberty
      • Database conversion from idb to i64
    • Disassembler
      • Interactivity
      • Background Analysis
      • Graph view
        • Graphing tutorial
      • Proximity view
      • Navigation
        • Anchor
        • How to Enter a Segment Value
        • How to Enter a Number
        • How to Enter an Identifier
        • How to enter text
        • How to Enter an Address
      • Disassembly Gallery
        • Philips 51XA-G3
        • 6502 and 65C02 Disassembler
        • 6301, 6303, 6800, 6801 and 6803 Disassembler
        • 68040, Amiga
        • 6805 Disassembler
        • 6808 Disassembler
        • 6809 OS9 Flex Disassembler
        • 6809 Disassembler
        • 6811 Disassembler
        • 68HC12 Disassembler
        • 68HC16 Disassembler
        • 68k Amiga Disassembler
        • 68k Mac OS
        • 68k Palm Pilot
        • Unix COFF
        • NEC 78k0 and 78k0s Processor
        • 80196 Processor
        • 8051 Disassembler
        • Analog Devices 218x.
        • Alpha Processor – NT COFF
        • Alpha Processor – Unix ELF
        • Android ARM Executables (.elf)
        • ARC Processor
        • ARM Processor EPOC App
        • ARM Processor EPOC PE File
        • ARM Processor EPOC ROMFile
        • EPOC SIS File Handler
        • ARM Processor iOS (iPhone): Unlock
        • ARM Processor iOS (iPhone): Objective-C metadata
        • ARM Processor iOS (iPhone): Objective-C Instance variables
        • ARM Processor iOS (iPhone): Parameter Identification & Tracking (PIT)
        • ARM Processor iOS (iPhone): Start
        • ARM Processor iOS (iPhone): Switch statements
        • ARM Processor iOS (iPhone): C++ signatures
        • ARM Processor iOS (iPhone): Write
        • ARM Processor: Linux ELF
        • ARM Processor: AOF SDK
        • ARM Processor: Windows CE COFF Format
        • ARM Processor: Windows CE PE Format
        • ATMEL AVR Disassembler
        • C166 Processor
        • C166 Processor with ELF file
        • Rockwell C39
        • Microsoft .NET CLI Disassembler. VisualBasic library
        • CR16
        • Android Dalvik Executables (.dex)
        • Microsoft .NET CLI Disassembler
        • DSP56K
        • Fujitsu FR (.elf)
        • Gameboy
        • H8 300: COFF FILE Format
        • H8 300s: COFF FILE Format
        • H8 500
        • HPPA Risc Processor: HP-UX SOM
        • i51
        • i860
        • Intel i960
        • Intel IA-64 (Itanium)
        • Java Bytecode
        • Angstrem KR 1878
        • Renesas/Hitachi M16C
        • Renesas/Hitachi M32R
        • M740
        • M7700
        • M7900
        • MIPS Processor: Nintendo N64
        • MIPS R5900 Processor : Sony bin
        • MIPS Processor: Sony ELF
        • MIPS Processor: Sony PSX
        • MIPS Processor: Sony PSX
        • MIPS Processor: Unix COFF File Format
        • MIPS Processor: Unix ELF File Format
        • MIPS Processor: Windows CE PE File Format
        • MIPS Processor: Windows CE PE2 File Format
        • Panasonic MN102
        • Atmel OAK DSP
        • 80×86 Architecture: DOS Extender
        • 80×86 Architecture: Watcom Runtime
        • 80×86 Architecture: Geos APP
        • 80×86 Architecture: Geos DRV
        • 80×86 Architecture: Geos LIB
        • 80×86 Architecture: GNU COFF Format
        • 80×86 Architecture: OS/2 Linear Executable Format
        • 80×86 Architecture: Netware NLM
        • 80×86 Architecture: QNX Executable
        • 80×86 Architecture: Watcom Runtime
        • 80×86 Architecture: Windows OMF
        • 80×86 Architecture: Windows Portable Executable Format
        • 80×86 Architecture: Windows Virtual Device Driver
        • 80×86 Architecture: Windows 16 bits DLL
        • X-Box Disassembler
        • PDP 11: SAV File
        • PIC
        • PIC 12xx
        • Power PC AIF ECOFF file Format
        • Power PC Linux ELF
        • Mac OS PEF File
        • Mac OS X File
        • Windows NT PE File
        • Hitachi SH-1 Processor
        • Hitachi SH-3 Processor: Windows CE COFF format
        • Hitachi SH-3 Processor: Windows CE PE format
        • Hitachi SH-4 Processor: ELF File Format
        • Hitachi SH-4 Processor: Windows CE PE File Format
        • Super Nintendo Entertainement System (SNES)
        • SPARC Solaris COFF
        • SPARC Solaris ELF
        • SPARC Sun ELF
        • SPARC Sun ELF SO
        • ST 20C4
        • ST 7
        • ST 9
        • Toshiba TLCS 900
        • TMS 320c2 COFF
        • TMS 320c5
        • TMS 320c54
        • TMS 320c6 COFF File Format
        • TRICORE
        • SunPlus unSP
        • NEC V850
        • Z180 COFF File Format
        • Z380 COFF File Format
        • Z8
        • Z80
      • Supported processors
      • Supported file formats
        • Windmp file loader
      • Bitfields
        • Bit Fields tutorial
      • Structures tutorial
      • Union tutorial
      • Variable length structures tutorial
      • Data types, operands and constructs
      • Packed executables
    • Decompiler
      • Prerequisites
      • Quick primer
      • Exception handler
      • Introduction to Decompilation vs. Disassembly
        • Comparisons of ARM disassembly and decompilation
        • Comparisons of PowerPC disassembly and decompilation
        • Comparisons of MIPS disassembly and decompilation
        • Hex-Rays v7.4 vs. v7.3 Decompiler Comparison Page
        • Hex-Rays v7.3 vs. v7.2 Decompiler Comparison Page
        • Hex-Rays v7.2 vs. v7.1 Decompiler Comparison Page
      • Interactive operation
        • Rename
        • Set type
        • Set number representation
        • Edit indented comment
        • Edit block comment
        • Hide/unhide C statements
        • Split/unsplit expression
        • Force call type
        • Set call type
        • Add/del variadic arguments
        • Del function argument
        • Add/delete function return type
        • Jump to cross reference
        • Jump to cross reference globally
        • Generate HTML file
        • Mark/unmark as decompiled
        • Copy to assembly
        • Show/hide casts
        • Reset pointer type
        • Convert to struct *
        • Create new struct type
        • Split variable
        • Select union field
        • Jump to paired paren
        • Collapse/uncollapse item
        • Map to another variable
      • Batch operation
      • Configuration
      • Third party plugins
      • Floating point support
      • Support for intrinsic functions
      • Overlapped variables
      • gooMBA
      • Failures and troubleshooting
      • FAQ
      • Limitations
      • Tips and tricks
    • Debugger
      • Instant debugger
      • Remote debugging
        • Remote iOS Debugger
        • Android debugger
        • Dalvik debugger
        • Remote GDB Debugger
          • Remote GDB Debugger options
          • Debugging with gdbserver
          • Debugging with VMWare
          • Debugging with OpenOCD
          • Debugging with QEMU
          • External programs and GDB Debugger
          • Debugging code snippets with QEMU
        • PIN debugger
          • Building the PIN tool
          • Connecting a remote PIN tool instance from IDA
          • PIN support for MacOSX
        • Replayer debugger
        • Bochs debugger
          • Bochs Disk Image operation mode
          • Bochs IDB operation mode
          • Bochs PE operation mode
          • Bochs debugger FAQ
      • Local debugging
        • WinDbg Debugger
        • Linux debugger
        • Intel/ARM macOS debugger
      • Debugger tutorials
        • Debugging Dalvik Programs
        • IDA Win32 Local Debugging
        • IDA Linux Local Debugging
        • IDA Linux to Win64 Debugging
        • IDA Win32 to Linux Debugging
        • Debugging Mac OSX Applications with IDA Pro
        • Debugging iOS Applications using CoreDevice (iOS 17 and up)
        • Debugging iOS Applications with IDA Pro
        • Debugging Linux Applications locally
        • Debugging Linux/Windows Applications with PIN Tracer module
        • Debugging Windows Applications with IDA Bochs Plugin
        • Debugging Windows Applications with IDA WinDbg Plugin
        • Using the Bochs debugger plugin in Linux
        • Debugging Windows Kernel with VMWare and IDA WinDbg Plugin
        • Debugging Linux Kernel under VMWare using IDA GDB debugger
        • Windows Debugger Hub
        • Linux Debugger
        • Debugging a Windows executable locally and remotely
        • Debugging the XNU Kernel with IDA Pro
        • Remote debugging with IDA Pro
        • IDA Scriptable Debugger: overview
          • IDA Scriptable Debugger: scriptability
        • Debugging code snippets with QEMU debugger (a la IDA Bochs debugger)
        • Trace Replayer and managing traces
        • Using IDA Pro's tracing features
        • Working with PIN
        • Appcall
    • Creating Signatures
      • FLIRT
        • IDA F.L.I.R.T. Technology: In-Depth
        • Generate FLIRT signature file
        • Supported Compilers
          • Turbo Pascal
          • Delphi
      • Makesig
    • Creating Type Libraries
      • IDAClang
      • TILIB
    • Configuration
      • Configuration files
      • Command line switches
      • Keyboard macros
      • UI/Fonts/Themes
      • Shortcuts
      • Customizing IDA
      • CSS-based styling
    • Teams
      • IDA Teams Licenses
      • Diffing and Merging Databases with IDA Teams
      • Teams lc command reference manual
      • hv command reference manual
      • Hex-Rays Vault’s visual client user manual
    • Lumina
      • lc command reference manual
    • Plugins
      • Open Plugin Architecture
      • Plugin options
      • Plugins Shipped with IDA
        • Swift plugin
        • Golang plugin
        • Rust plugin
        • picture_search
        • Objective-C Analysis Plugin
        • DYLD Shared Cache Utils
        • Borland RTTI descriptors plugin
        • DWARF plugin
        • Patfind plugin
        • IDA Feeds
          • FLIRT Signature Bundle
      • Plugin Contest
      • How to write your own plugin?
    • Helper Tools
    • idalib
  • Developer Guide
    • C++ SDK
      • Getting Started with C++ SDK
      • C++ SDK Reference
      • Using the Decompiler SDK: Decompiler plugin
      • C++ SDK examples
      • How to create a plugin in C++?
      • C++ SDK Porting Guide from IDA 8.x to 9.0
    • IDAPython
      • Getting started with IDAPython
      • IDAPython API Reference
      • IDAPython examples
      • How to create a plugin in IDAPython?
      • IDAPython Porting Guide from IDA 8.x to 9.0
    • IDC
      • Core concepts
        • Expressions
        • Statements
        • Functions
        • Variables
        • Constants
        • Exceptions
        • Classes
        • Predefined symbols
        • loader_input_t class
        • Slices
      • IDC API Reference
        • Index of debugger related IDC functions
        • Alphabetical list of IDC functions
          • is_member_id
          • load_type
          • get_member_by_idx
          • get_ordinal_limit
          • set_selector
          • enable_tracing
          • get_prev_fixup_ea
          • del_segm
          • get_bmask_cmt
          • end_type_updating
          • Find
          • toggle_bnot
          • patch_byte
          • get_module_info
          • set_member_name
          • create_float
          • del_struc_member
          • read_dbg_memory
          • get_enum_width
          • getn_thread_name
          • del_struc
          • filelength
          • set_manual_insn
          • is_value...() functions
          • get_ip_val
          • del_extra_cmt
          • create_insn
          • op_offset_high16
          • get_cmt
          • expand_struc
          • get_idb_path
          • set_frame_size
          • get_file_ext
          • has_value
          • readshort
          • sanitize_file_name
          • get_member_flag
          • create_struct
          • ARM specific
          • set_enum_member_cmt
          • rename
          • set_ida_state
          • get_member_size
          • msg
          • qbasename
          • get_enum_member_enum
          • auto_mark_range
          • plan_to_apply_idasgn
          • set_named_type
          • op_offset
          • rename_entry
          • strlen
          • get_extra_cmt
          • get_enum_flag
          • fgetc
          • op_stkvar
          • get_last_index
          • get_field_ea
          • get_struc_id
          • select_thread
          • create_array
          • get_struc_cmt
          • set_array_string
          • set_func_attr
          • set_storage_type
          • get_struc_size
          • demangle_name
          • get_next_fixup_ea
          • get_next_bmask
          • delattr
          • gen_simple_call_chart
          • patch_qword
          • get_enum_name
          • loader_input_t.getc
          • get_debugger_event_cond
          • read_dbg_qword
          • define_local_var
          • generate_disasm_line
          • add_idc_hotkey
          • tolower
          • del_selector
          • set_debugger_event_cond
          • get_imagebase
          • gen_file
          • get_entry
          • find_custom_data_format
          • get_debug_name_ea
          • add_default_til
          • set_func_end
          • exit_process
          • delete_array
          • xtol
          • get_exception_code
          • detach_process
          • set_enum_cmt
          • get_wide_word
          • put_bookmark
          • is_loaded
          • add_enum_member
          • parse_decls
          • readstr
          • get_entry_qty
          • ord
          • sprintf
          • get_root_filename
          • get_enum_member_cmt
          • create_word
          • set_func_flags
          • loader_input_t.tell
          • create_align
          • read_dbg_dword
          • next_addr
          • get_bytes
          • batch
          • start_process
          • process_config_line
          • del_user_info
          • qmakefile
          • set_struc_name
          • print_decls
          • create_custom_data
          • del_enum_member
          • format_cdata
          • get_fixup_target_sel
          • get_item_size
          • loader_input_t.gets
          • get_last_bmask
          • Step Tracing Options
          • selector_by_name
          • get_enum_cmt
          • next_not_tail
          • prev_head
          • set_color
          • set_numbered_type
          • get_member_name
          • auto_wait
          • get_enum_member_bmask
          • fseek
          • get_segm_start
          • attach_process
          • Trace file functions
          • get_enum_member_value
          • op_stroff
          • get_next_offset
          • set_processor_type
          • get_bookmark_desc
          • create_data
          • lastattr
          • get_operand_value
          • collect_stack_trace
          • toupper
          • get_fixup_target_dis
          • set_cmt
          • add_entry
          • set_segm_addressing
          • qmake_full_path
          • get_source_linnum
          • fputc
          • resume_thread
          • get_func_attr
          • get_first_enum_member
          • add_sourcefile
          • get_first_bmask
          • read_selection_start
          • hasattr
          • get_member_cmt
          • gen_flow_graph
          • get_array_element
          • get_tinfo
          • loader_input_t
          • tinfo_errstr
          • TRUNC
          • add_segm_ex
          • Local types information and manipulation helpers
          • set_source_linnum
          • get_next_enum_member
          • loader_input_t.readbytes
          • set_array_params
          • jumpto
          • get_bookmark
          • set_enum_bf
          • prev_not_tail
          • toggle_sign
          • loader_input_t.size
          • Trace events functions
          • get_func_flags
          • get_gotea
          • set_segm_attr
          • get_item_head
          • set_default_sreg_value
          • print_insn_mnem
          • set_member_cmt
          • get_ordinal_qty
          • set_target_assembler
          • add_user_stkpnt
          • set_local_type
          • Hidden ranges
          • del_items
          • compile_idc_text
          • Dalvik debugger extension functions
          • byte_value
          • create_dword
          • is_code
          • del_func
          • get_enum
          • make_array
          • rotate_left
          • recalc_spd
          • search_path
          • CommonBits
          • get_processor_name
          • set_func_cmt
          • get_prev_bmask
          • Hashes
          • split_sreg_range
          • process_ui_action
          • set_fixup
          • get_fixup_target_type
          • create_oword
          • get_flags
          • get_func_name
          • create_strlit
          • add_struc
          • atol
          • load_debugger
          • mkdir
          • sizeof
          • get_enum_member_by_name
          • save_database
          • guess_type
          • get_segm_name
          • print_operand
          • qisabspath
          • get_member_qty
          • set_struc_cmt
          • get_fixup_target_flags
          • idadir
          • object.retrieve
          • add_auto_stkpnt
          • get_numbered_type_name
          • get_enum_member_name
          • get_next_index
          • prev_addr
          • get_name_ea
          • get_sp_delta
          • set_bmask_cmt
          • readlong
          • set_segm_name
          • get_prev_offset
          • set_segm_alignment
          • get_strlit_contents
          • forget_exception
          • get_item_end
          • add_func
          • get_name
          • Asks
          • get_spd
          • Debugger: control
          • get_wide_byte
          • plan_and_wait
          • set_enum_flag
          • RunPythonStatement
          • del_sourcefile
          • find_selector
          • get_frame_regs_size
          • op_num
          • define_exception
          • create_double
          • create_byte
          • read_selection_end
          • OpTypes
          • op_plain_offset
          • move_segm
          • get_member_id
          • set_segm_combination
          • get_current_thread
          • trim
          • Debugger: options
          • getn_thread
          • get_frame_id
          • typeinfo.print
          • to_ea
          • rebase_program
          • add_struc_member
          • get_exception_qty
          • get_first_index
          • import_type
          • set_segm_type
          • find_custom_data_type
          • get_next_seg
          • find_func_end
          • get_last_enum_member
          • getattr
          • get_frame_size
          • get_screen_ea
          • loader_input_t.read
          • set_reg_value
          • Debugger: modules
          • create_pack_real
          • writestr
          • exec_idc
          • get_enum_size
          • set_enum_name
          • create_tbyte
          • sel2para
          • atoa
          • loader_input_t.close
          • add_enum
          • ltoa
          • substr
          • del_idc_hotkey
          • Breakpoint handling functions
          • loader_input_t.seek
          • cleanup_appcall
          • object.store
          • get_type
          • qexit
          • get_debug_name
          • get_array_id
          • Can't Open File
          • suspend_process
          • process_config_directive
          • get_entry_name
          • get_last_member
          • get_struc_name
          • clear_selection
          • fclose
          • firstattr
          • create_yword
          • dbg_appcall
          • get_qword
          • patch_dword
          • begin_type_updating
          • read_dbg_byte
          • get_fpnum
          • qsleep
          • get_first_member
          • get_nsec_stamp
          • del_stkpnt
          • eval
          • savefile
          • eval_python
          • Xrefs
          • strstr
          • writeshort
          • get_sreg
          • get_segm_end
          • get_func_off_str
          • set_func_start
          • del_array_element
          • get_full_flags
          • set_exception_flags
          • rename_array
          • get_frame_args_size
          • op_flt
          • get_min_spd_ea
          • apply_type
          • get_prev_index
          • loadfile
          • retrieve_input_file_md5
          • get_wide_dword
          • patch_dbg_byte
          • Functions provided by the WinDbg debugger
          • get_original_byte
          • get_member_strid
          • call_system
          • writelong
          • get_thread_qty
          • nextattr
          • send_dbg_command
          • get_first_seg
          • get_processes
          • patch_word
          • get_manual_insn
          • ftell
          • get_entry_ordinal
          • set_array_long
          • delete_all_segments
          • TO_LONG
          • Function chunk related functions
          • Debugger: events
          • get_prev_func
          • op_seg
          • validate_idb_names
          • fprintf
          • fopen
          • strfill
          • del_fixup
          • get_bmask_name
          • inf_attr
          • is_bf
          • read_dbg_word
          • qdirname
          • get_segm_attr
          • func_contains
          • del_source_linnum
          • get_sourcefile
          • clr_database_flag
          • set_name
          • Refresh Screen
          • op_enum
          • getn_enum
          • get_db_byte
          • setattr
          • get_forced_operand
          • op_bin
          • Functions provided by the replayer debugger
          • prevattr
          • update_extra_cmt
          • get_str_type
          • op_man
          • choose_func
          • set_bmask_name
          • get_curline
          • decode_insn
          • set_segment_bounds
          • set_segm_class
          • write_dbg_memory
          • get_exception_name
          • get_enum_member
          • is_mapped
          • del_enum
          • get_frame_lvar_size
          • get_operand_type
          • set_root_filename
          • compile_idc_file
          • typeinfo.size
          • get_local_tinfo
          • get_fixup_target_off
          • is_union
          • unlink
          • get_segm_by_sel
          • set_enum_width
          • take_memory_snapshot
          • exec_python
          • get_next_func
          • get_member_offset
          • get_func_cmt
          • parse_decl
          • create_qword
          • next_head
          • suspend_thread
          • loader_input_t.getz
          • get_color
          • get_reg_value
          • load_and_run_plugin
          • set_database_flag
          • set_enum_member_name
          • set_member_type
          • get_prev_enum_member
      • IDC examples
        • Analyzing encrypted code
  • Admin Guide
    • Lumina server
    • Teams server
    • License server
      • Hex-Rays License Server Migration Guide
  • Release Notes
    • IDA 9.0
    • IDA 8.4sp2
    • IDA 8.4sp1
    • IDA 8.4
    • IDA 8.3
    • IDA 8.2sp1
    • IDA 8.2
    • IDA 8.1
    • IDA 8.0sp1
    • IDA 8.0
    • IDA 7.7sp1
    • IDA 7.7
    • IDA 7.6sp1
    • IDA 7.6
    • IDA 7.5sp3
    • IDA 7.5sp2
    • IDA 7.5sp1
    • IDA 7.5
    • IDA 7.4sp1
    • IDA 7.4
    • IDA 7.3
      • IDA 7.3 Undo: IDA can do it
    • IDA 7.2
      • IDA 7.2 The Mac Rundown
    • IDA 7.1
      • IDA 7.1 Debugger API 7.1 Porting Guide
    • IDA 7.0sp1
    • IDA 7.0
      • Internationalization (i18n)
      • Automatic discovery of string literals
      • API 7.0 Porting Guide
      • IDAPython backward compatibility
    • IDA 6.95
    • IDA 6.9
    • IDA 6.8
    • IDA 6.7
    • IDA 6.6
    • IDA 6.5
    • IDA 6.4
    • IDA 6.3
    • IDA 6.2
    • IDA 6.1
    • IDA 6.0
    • IDA 5.7
    • IDA 5.6
    • IDA 5.5
      • 5.5 Gallery
      • 5.5 Comparison
    • IDA 5.4
    • IDA 5.3
    • IDA 5.2
    • IDA 5.1
    • IDA 5.0
    • IDA 4.9SP
    • IDA 4.9
    • IDA 4.8
    • IDA 4.7
    • IDA 4.6
    • IDA 4.x
    • IDA 3.x
    • Cumulative bugfix for IDA
  • Archive
    • IDA’s Windbg plugin
    • IDA’s Bochs debugger plugin
    • IDA’s Bochs debugger plugin 2
    • DosWin32
    • Hex-Rays v1.1 vs. v1.0 Decompiler Comparison Page
    • Hex-Rays v1.2 vs. v1.1 Decompiler Comparison Page
    • Hex-Rays v1.3 vs. v1.2 Decompiler Comparison Page
    • Hex-Rays v1.6 vs. v1.5 Decompiler Comparison Page
    • Hex-Rays v1.7 vs. v1.6 Decompiler Comparison Page
    • Costly Greetings – An Adventure In Hostile Code Analysis
    • An Adventure In Hostile Code Analysis: Description
    • An Adventure In Hostile Code Analysis: Disassembly
    • Improved code flow analysis
    • Program Navigation Bar
    • IDA Home Contest
    • Pimp My IDA: vote results
    • Turning off IDA 6.x compatibility in IDAPython
    • Porting guide for IDA 7.4 turning off IDA 6.x API backwards-compatibility by default
    • Porting guide for IDA 7.4 IDAPython and Python 3
    • IDAPython and Python 3
    • Porting guide for changes in IDAPython-on-Python-3 APIs
    • Debugging iOS Applications With IDA
    • IDA Win32 to Win32 Debugging
    • IDA Win32 to Win64 Debugging
    • Legacy license server: Floating Licenses
      • Installing on Linux
      • Installing on Windows
      • Installing on OS X
    • Decompiler Installation
    • Enumerated types tutorial
  • Bug Bounty
Powered by GitBook
LogoLogo

Need Help?

  • FAQs
  • Support

Community

  • Forum
  • Plugins

Resources

  • Blog
  • Download center

© 2025 Copyright Hex-Rays

On this page

Was this helpful?

Export as PDF
  1. Release Notes

IDA 6.6

Last updated 7 months ago

Was this helpful?

x64 Decompiler

It was tough and it required even more research than was planned but finally it arrived. The 64-bit decompiler for x64 code is as simple to use as our other decompilers, and fast as well. Below is very short disassembly listing and the decompiler's output for it:

Naturally, it is the very first version and some edges are still rough, but overall it can handle real world code very well.

Dalvik Debugger

Since Android devices become more and more popular, we implemented a debugger for them. It can debug both on the Dalvik bytecode level and on the source code level. Below is a picture showing the bytecode debugging:

And this is the same application on the source code level:

Naturally, the user can switch between the two views any time.

IDA knows about the Dalvik objects and show them in a structured way (if the debug info was not stripped):

PySide is shipped with IDA

The title says it all. Since it is easy to create nice interactive plugins with PySide, we decided to include it with IDA. Now all IDA copies will have it properly installed and configured, so as a plugin writer you can rely on its existence!

UI improvements

Many small but useful features have been added or improved. Here's just a few:

  • Multiline breakpoint conditions

    Python users will love this: now it is possible to write a multiline condition right in the 'edit breakpoint' dialog box. IDA even accepts function definitions there!

  • Functions can be used in IDC snippets

    Now you can use the same scripts as in separate .idc files: IDA will compile all functions present in the script and run the main() function, if it's present.

Complete changelist

  • Processor Modules

    • ARM: decode ARMv7 optional Virtualization Extension instructions (HVC, ERET, banked register MRS/MSR)

    • ARM: decode optional ARMv7-A instructions SDIV and UDIV

    • ARM: decode the stand-alone "second half of Thumb BL instruction" as "BL LR, #imm", if currently selected processor does not support Thumb-2

    • CLI/.NET: put user strings into a pseudo-segment (e.g. so that they can be deobfuscated)

    • CLI/.NET: use full names when naming methods; this reduces naming conflicts and makes the Function List more useful for .NET binaries

    • MIPS: added support for n32/n64 ABI

    • MIPS: when tracking registers, assume that $t9 is initialized with the function's address

    • PC: Added a GCC switch idiom.

    • PC: handle morte non-optimized GCC switch patterns

    • PC: handle non-PIC form of GCC x64 switch (jmp ds:table[reg*8])

    • PC: improve analysis of functions that use __EH_prolog3 helpers

    • PC: improved prolog analysis

    • PPC: support for additional instructions available in some Freescale e200z cores (Volatile Context Save/Restore APU and EFPU2)

    • Tricore: support for architecture V1.6

  • File Formats

    • COFF: added support for EBC object files

    • COFF: recognize and load Visual C++ /GL files (link-time code generation). Note: since such files contain custom Microsoft bytecode, the code can't be disassembled.

    • DWARF: (basic) support for runtime GCC 4.8.2-produced DWARF4 information.

    • DWARF: Allow the plugin to mark function prototypes as being definitive (so e.g. the decompiler can rely on them).

    • DWARF: At load-time, it is now possible to fine-tune the DWARF plugin regarding calling conventions.

    • DWARF: Can now configure whether DWARF data should be loaded when in batch mode.

    • DWARF: Initial support for Golang-produced DWARF debugging information.

    • ELF: added support for some ARCompact relocations

    • ELF: MIPS: use DT_MIPS_GP_VALUE to determing the executable's gp register value

    • PE: better handling of files where .idata is merged into .rdata

    • PE: IA64: handle IMAGE_REL_BASED_IA64_IMM64 relocations

    • PE: improve debug directory formatting

    • PE: parse new fields in the Load Configuration Directory added in Windows 8.1 (control flow guard metadata)

    • PE: X64: parse .pdata section at load time and create function boundaries accordingly.

    • PDB: added support for annotations (e.g. NT_ASSERT macro in checked builds)

  • Kernel

    • improved printing of unicode strings in the watch view, locals, and in the 'export data' command

    • argument locations in function prototypes are specified with @<reg>; the old syntax <reg> is accepted too for the moment; we will suppress it in the next release

  • Decompilers

    • introduced is_mul_ok() helper function to represent multiplication overflows checks

    • introduced qmemcpy() which always copies byte by byte, from low to high addresses

    • added recognition of inlined bswap() function

    • double clicking on a label jumps to it

    • the decompiler may use __spoils keyword to specify registers that are not spoiled by the function

    • improved recognition of register save/restore patterns

    • 'volatile' keyword can be used to override constness of an individual item

    • if an int 2Ch instruction has NT_ASSERT() comment (e.g. extracted by the PDB plugin from PDB annotations), show it as NT_ASSERT() macro call instead of just __int2c()

  • FLIRT, TIL & IDS

    • FLIRT: added EBC startup signature for PE (EFI) files

    • PCF: handle EBC object files

  • Scripts & SDK

    • IDAPython: Don't intercept SIGPIPE, SIGXFZ, SIGXFSZ & SIGINT signals on Unix platforms; leave them for IDA to handle.

    • IDAPython: added the decompiler bindings

    • IDAPython: Expose simpleline_t type to IDAPython. That lets the user to set the bgcolor & text for each line in the decompilation.

    • IDC: added "elang" attribute to the Breakpoint class (scripting language for the breakpoint condition)

    • installer/Windows: check if Python actually works after installing; offer user to retry the installation

    • SDK: added askfile2() for extended open/save file dialog with support for file masks

    • SDK: added 'extlang_changed' IDP event

    • SDK: added qstring methods ltrim(), rtrim(), trim2()

    • SDK: added support for custom arglocs

    • SDK: check_process_exit() now has a 'timeout' argument

    • SDK: form_actions_t is extended with set/get methods for fields of different types to enable compile-time argument type checking

    • SDK: replaced addblanks() by a safer function add_spaces(), which accepts the buffer size

  • User Interface

    • UI: scripting language for the condition field can be specified for every breakpoint separately

    • UI: breakpoint conditions can now be multi-line (use "..." button to open a multi-line editbox)

    • UI: Ctrl-C/Ctrl-Ins copies the currently highlighted text to clipboard (if there is no selection)

    • UI: export_data plugin will now offer to export the item under cursor if there is no selection

    • UI: OSX: IDA's main window will now appear as the top level window on OSX when idaq is started with an IDB file on the command line

  • Debugger

    • debugger: IDA reacts faster to the cancel button while searching for binary patterns

    • debugger: now it is possible to stop a long memory snapshot retreival

    • GDB: added an option to enable/disable the use of stub's single-stepping support for some broken systems (e.g. MIPS or ARM Linux)

  • Bugfixes

    • BUGFIX: 78K0S: instruction "MOV [HL+byte], A" was decoded incorrectly (displacement was always zero)

    • BUGFIX: a reference to a wrongly defined type was considered to be equal to a valid reference (fortunately this occurs rarely)

    • BUGFIX: ARC: some instructions setting flags were decoded without the .f suffix

    • BUGFIX: arglocs for vc32 fastcall CC: only UDT pointers are passed on the stack, hidden arguments (e.g. 'this') distribute according to 'fastcall' policy

    • BUGFIX: ARM: arm64 instruction aliases BFI and BFXIL were decoded incorrectly

    • BUGFIX: ARM: autoanalysis could loop indefinitely in some rare situations when there was a bogus xref into the middle of a macro instruction

    • BUGFIX: bfltldr.py was not working anymore.

    • BUGFIX: btree compress could produce a corrupted base

    • BUGFIX: creating an array type with wrong array attributes could crash IDA or create wrong type

    • BUGFIX: debugger: when attaching to x64 process without an existing database, "IP" and "SP" special registers were detected incorrectly

    • BUGFIX: Debugging an ASLR-enabled binary (which will rebase the IDB) was not rebasing the navigation history.

    • BUGFIX: During breakpoints export operation always export hardware breakpoint sizes

    • BUGFIX: DWARF loading could crash IDA in certain circumstances involving complex graphs of objects with variations (i.e., whose padding bytes are re-used when inherited.)

    • BUGFIX: ELF: dynamic info could be parsed incorrectly for some uClibc files

    • BUGFIX: Fixed exporting of breakpoints with complex conditions, which contains quoted strings

    • BUGFIX: fixed internal error that could occur when loading a pdb file with unaligned bitfields

    • BUGFIX: fixed interr 603

    • BUGFIX: Fixed representation of the chooser filters in "Modify filter" dialog. The collumn was always shown as '*'

    • BUGFIX: fixed wrong direction of the floating point conversion

    • BUGFIX: function argument location could be calculated incorrectly for arguments containing unaligned union fields (gcc64)

    • BUGFIX: function argument location was calculated incorrectly for some structures containing arrays as members

    • BUGFIX: GDB: duplicate threads could appear in the thread list in some situations

    • BUGFIX: GDB: maximum packet size was not respected when doing memory writes

    • BUGFIX: GDB: SendDbgCommand() with PIN's GDB backend would take at least one second (value or of the GDB timeout setting)

    • BUGFIX: GDB: when single-stepping in some thread, IDA could issue a "continue" packet for another thread instead

    • BUGFIX: hexrays: "add pseudocode comments" was broken

    • BUGFIX: hexrays: an indirect call to a noret function in the middle of a function was not supported

    • BUGFIX: hexrays: ARM decompiler could generate references to wrong (unexisting) global variables in some cases

    • BUGFIX: hexrays: ARM decompiler could miss some return instructions and represent them as JUMPOUTs

    • BUGFIX: hexrays: (ARM) if the user turned off macros after analyzing the database, the decompiler could interr or generate wrong output

    • BUGFIX: hexrays: (ARM) big endian decompilation had constant halves swapped

    • BUGFIX: hexrays: decompiler could create overalpping input arguments and later interr

    • BUGFIX: hexrays: decompiler could erroneously optimize away some expressions like 'x*N & M' and replace them with zero

    • BUGFIX: hexrays: decompiler could interr if 32-byte enum type was defined (too wide)

    • BUGFIX: hexrays: decompiler could interr on a comma operator whose type is a bitfield

    • BUGFIX: hexrays: decompiler could interr on some variadic functions

    • BUGFIX: hexrays: decompiler was always moving register arguments to the beginning of the argument list in the pseudocode window

    • BUGFIX: hexrays: def-list for strcat() was sometimes calculated incorrectly

    • BUGFIX: hexrays: enabled negation of 128-bit values, apparently they can occur even in 32-bit programs

    • BUGFIX: hexrays: expression like "(x * N) < 0" could be optimized wrongly in some rare cases

    • BUGFIX: hexrays: fixed a couple of minor memory leaks

    • BUGFIX: hexrays: fixed interr 50375

    • BUGFIX: hexrays: fixed interr 50396

    • BUGFIX: hexrays: fixed interr 50513

    • BUGFIX: hexrays: fixed interr 50708

    • BUGFIX: hexrays: fixed interr 50715

    • BUGFIX: hexrays: fixed interr 50860

    • BUGFIX: hexrays: fixed interr 51049

    • BUGFIX: hexrays: ftst instruction was not decompiled

    • BUGFIX: hexrays: hints for union members were wrong (off=N; where N is the member number, not the offset)

    • BUGFIX: hexrays: if the return value of a function call was used but could not influence the logic of the program, the call could be optimized out, which is wrong

    • BUGFIX: hexrays: movd/movq insructions with a register destination were decompiled incorrectly

    • BUGFIX: hexrays: recursive patterns could be applied wrongly and lead to an interr

    • BUGFIX: hexrays: ScreenEA() would sometimes return BADADDR in the decompiler view because some pseudocode locations cannot be mapped to an address. Now it tries to return the closest EA, or the function's EA in the worst case.

    • BUGFIX: hexrays: the rule to recognize signed modulo by power2 could interr

    • BUGFIX: HT_VIEW example plugin could crash on non-graph views.

    • BUGFIX: IDA could crash trying to print a function declaration (a function returning a pointer to an array of pointers to arrays)

    • BUGFIX: IDA could interr when parsing "int func(int,void)"

    • BUGFIX: IDA could not attach to a remote PIN debugger - tried to launch a local pintool instance instead

    • BUGFIX: IDA could stop with internal error 498 when loading some pdb files

    • BUGFIX: IDA graphs could become corrupted, or even crash IDA, on some versions of linux.

    • BUGFIX: IDA now starts up in the foreground when run from the command line on mac (instead of hiding behind the terminal window)

    • BUGFIX: IDA would crash if the __FILE__ macro was used in a function prototype

    • BUGFIX: IDA would fail to import huge (>0x1FFFFFFF bytes) structures from pdb files

    • BUGFIX: IDA wouldn't display, in the 'Use standard symbolic constant', enum values that have bit 31 set to 1.

    • BUGFIX: IDA could behave incorrectly under Wine due to a bug exposed by the differences in Wine's MSVCRT implementation

    • BUGFIX: IDA could crash when loading big PE files with zero-filled areas

    • BUGFIX: idaw.exe could crash upon closing the database

    • BUGFIX: IDAPython: for non-code locations, idc.GetOpnd() would create instructions instead of returning empty result

    • BUGFIX: IDAPython: idb_event::area_cmt_changed was never received in IDB_Hooks (and descendants)

    • BUGFIX: IDAPython: idb_event::ti_changed, and idb_event::op_ti_changed notifications were not accessible in IDAPython

    • BUGFIX: IDAPython: op_t.value was truncated to 32 bits under IDA64.

    • BUGFIX: IDAPython: print_tinfo() wouldn't return a valid string.

    • BUGFIX: IDAPython: readsel2() was not usable.

    • BUGFIX: IDAPython: read_selection() was buggy for 64-bit programs.

    • BUGFIX: IDAPython: StructMembers() considered holes in structures, and didn't properly iterate through the whole structure definition.

    • BUGFIX: IDAPython: There was no way to call calc_switch_cases() from IDAPython.

    • BUGFIX: IDAPython: when using multi-select/multi-edit choosers, erroneous event codes could be sent at beginning & end of batch deletion of lines.

    • BUGFIX: IDAPython: When, in a PluginForm#OnCreate, the layout of IDA was requested to change (for example by starting a debugging session), that PluginForm could be deleted and create an access violation.

    • BUGFIX: IDC/Python: GetTinfo("") was causing an interr

    • BUGFIX: IDC/Python: SetType would work incorrectly if an invalid string was passed

    • BUGFIX: If closing of one of DockWidget causing the closing of other DockWidgets then changing (reset/load) of desktop layout crashed Ida.

    • BUGFIX: if the user renamed the segments to use dummy segment names like segXXX, IDA would be unable to find such segments by name

    • BUGFIX: In flat rendering mode, standing on a border line of an instruction (i.e., "-------") that is located right before data, and pressing 'C' to make code (in order to turn that data into code), could scroll the view by 1 line if the MakeCode command failed.

    • BUGFIX: In graph view, leaving the mouse on an edge wouldn't show "To:/From:" hints anymore.

    • BUGFIX: in graph view, we can now highlight text by dragging the mouse outside the boundary of a node.

    • BUGFIX: In some cases, switching from flat view to graph view could have the side-effect of moving the cursor down by one or more lines, which changes the EA.

    • BUGFIX: incorrect handling of argument location (gcc64) for some nested unions and unions containing big structures as members

    • BUGFIX: Instances of type tinfo_t couldn't be properly used when they were aggregated by other types.

    • BUGFIX: it was impossible to check out the IDA Pro floating license if both Starter and Pro licenses were present

    • BUGFIX: kernel: reloading a binary file would work incorrectly if extra segments were added before the file data

    • BUGFIX: kernel: user-defined offsets with "subtract" flag set were not working properly for processors that implement ph.translate callback (e.g. MIPS)

    • BUGFIX: M68K: ColdFire instructions REMU.L/REMS.L were decoded as DIVU.L/DIVS.L

    • BUGFIX: Mach-O loader's check for valid section index was not correct.

    • BUGFIX: MACHO: zeroed out symbols were incorrectly considered as imports with unknown names

    • BUGFIX: Middle-button clicking anywhere to the right of a rightmost tab would crash IDA.

    • BUGFIX: MIPS module was not marking switch instructions with a special mark (as it is done for x86 code, for example)

    • BUGFIX: MIPS: arguments in fpu registers were not properly commented in __usercall prototypes

    • BUGFIX: Moving the structures in the structures window didn't work as expected.

    • BUGFIX: Once pulled out from the main window, a PluginForm (or derivative) might not receive events properly anymore.

    • BUGFIX: opening a file with the name starting with @ would lead to a fatal error (instead of a nice error message)

    • BUGFIX: PC: register tracker could incorrectly use previous register values after a popad instruction, leading to wrong comments

    • BUGFIX: pdb with a union of bitfields would cause an internal error

    • BUGFIX: PE: IDA on Linux/OS X would crash when trying to load .NET filles without a User Strings stream

    • BUGFIX: PPC: "branch always" instruction had a hidden condition field operand, even though condition is ignored for it

    • BUGFIX: PPC: use/change operand flags were set incorrectly for some instructions

    • BUGFIX: PPC: IDA could crash due to stack overflow when analyzing some long functions

    • BUGFIX: Pulling the miniview out could cause a crash.

    • BUGFIX: Regex-based filters could be un-applied once the "Modify filters..." window was closed.

    • BUGFIX: reloading the input file with wrong PE file could lead to interr

    • BUGFIX: Renaming a group node by clicking on the 'rename' icon didn't repaint.

    • BUGFIX: Rewritten the wrong algorithm for the areas moving

    • BUGFIX: SDK: call_system() with NULL or empy string argument did not create an interactive shell as expected

    • BUGFIX: SDK: func_item_iterator_t() could stop enumeration prematurely if the starting address was in a tail chunk

    • BUGFIX: SDK: get_output_curline()/get_output_cursor() were returning wrong results if wrapped lines were present in output

    • BUGFIX: SDK: it was impossible to override default behavior of some output window events (msg_click, msg_dblclick, msg_keydown)

    • BUGFIX: SDK: next_unknown() could return wrong result for sparse storage

    • BUGFIX: size of an empty base class can be reported as 1 byte in some (rare) circumstances

    • BUGFIX: Some jmp instructions could create "function chunks" in some inappropriate places (e.g., .plt stubs.)

    • BUGFIX: Some proximity browser graphs could cause IDA to crash.

    • BUGFIX: the application bitness (32 or 64 bit) was not set in some cases

    • BUGFIX: The DWARF plugin could interr on some erroneous DWARF data for complex types.

    • BUGFIX: the type of a struct member would not be displayed when pressing 'F'

    • BUGFIX: tinfo_t objects created from IDAPython could cause an assertion failure at exit time.

    • BUGFIX: type comparison was not taking into account the pointer attributes

    • BUGFIX: Tricore: some xrefs were created with incorrect type

    • BUGFIX: TXT: the "OS Shell" command did not work

    • BUGFIX: UI: creating an array of structs in the struct window could fail

    • BUGFIX: UI: double-clicking on addresses when using WinDbg debugger did not always work as expected

    • BUGFIX: UI: exclude filters on '(any)' column could fail filtering the list of data.

    • BUGFIX: UI: in the message about insufficient disk space, "available" space could be displayed as zero.

    • BUGFIX: UI: it was impossible to stop the process of taking a memory snapshot while big segments were being processed

    • BUGFIX: UI: on OS X, IDA would report "Unknown C++ exception" instead of "Out of memory" error

    • BUGFIX: UI: if an overly long trace description was entered, IDA would crash (Thanks to Alberto Garcia Illera who reported this bug)

    • BUGFIX: Usage of IDAPython's DropdownListControl was broken.

    • BUGFIX: valid-position range information was missing when moving a structure around.

    • BUGFIX: When "recent files" history was set to more than 10, the entries past 10 in the "File" menu wouldn't be numbered.

    • BUGFIX: When debugging, variables of type '*' that were stored directly in a register were not properly printed in the "Locals" view.

    • BUGFIX: when importing PDB info, some bitfields would be imported incorrectly

    • BUGFIX: When in graph view, modifying a function so as to change its structure wouldn't always refresh the graph.

    • BUGFIX: When the program is rebased, the location history is rebased as well.

    • BUGFIX: When the user would pull the miniview out, move out of the graph view to the decompilation view, come back to the disassembly view, the floating window would take focus, and actions could be dispatched to the decompilation view instead of the graph view.

    • BUGFIX: When using a non-default color palette, re-setting a node to its default color could lead to glitchy rendering where node margins are white, & the rest of the node is colored.

    • BUGFIX: with some IDBs, IDA would start with an oversized arrows window, causing the disassembly view to be squeezed to the right and barely visible.

Please see our for more info!

Dalvik debugging tutorial