LogoLogo
IDA 9.0
IDA 9.0
  • Welcome to Hex-Rays docs
    • What's new?
  • Getting Started
    • Install IDA
    • Licensing
    • Basic Usage
    • What's next?
  • User Guide
    • User Interface
      • Menu Bar
        • File
          • Load file
          • Script File
          • Script command
          • Produce output files
          • Invoke OS Shell
          • Take database snapshot
          • Save database
          • Save database as...
          • Abort IDA
          • Exit IDA
        • Edit
          • Export data
          • Undo an action
          • Redo an action
          • Clear undo history
          • Disable undo
          • Convert to instruction
          • Convert to data
          • Convert to string literal
          • Convert to array
          • Undefine a byte
          • Give Name to the Location
          • Operand types
            • Offset
            • Number
            • Perform en masse operation
            • Convert operand to character
            • Convert operand to segment
            • Complex Offset Expression
            • Convert operand to symbolic constant (enum)
            • Convert operand to stack variable
            • Change operand sign
            • Bitwise negate operand
            • User-defined operand
            • Set operand type
          • Comments
          • Functions
          • Structs
          • Segments
          • Patch core
          • Other
            • Rename Any Address
          • Plugins
        • Jump
          • Center current line in window
          • Problems List
        • Search
          • REGULAR EXPRESSION SYNTAX SUMMARY
        • View
          • Open subviews
          • Graphs
          • Message Window
          • Arrows window
          • Database snapshot manager
          • Highlighting identifiers
          • Browser options
          • Lumina options
          • Assembler level and C level types
          • C++ type details
          • Bookmarks window
          • Calculator
          • View segment registers
          • View Internal Flags
          • Hide
          • Unhide
          • Del hidden range
          • Hide all items
          • Unhide all items
          • Setup hidden items
        • Debugger
          • Debugger window
          • Process Control
            • Start process
            • Process options
            • Pause process
            • Terminate process
            • Step into
            • Step over
            • Run to cursor
            • Run until return
            • Attach to process
            • Detach from process
            • Set current ip
            • Show application screen
          • Breakpoints
          • Watches
          • Tracing
          • Source code view
            • Watch view (source level)
          • Process Memory
            • Take memory snapshot
            • Manual memory regions
            • Refresh memory
          • Thread list
          • Module list
          • Stack trace
          • Exceptions
          • Debugger options
          • Switch debugger
        • Lumina
        • Options
          • Low & High Suspicious Operand Limits
        • Windows
          • Rename a stack variable
          • Miscellanous Options
          • Environment variables
          • Reset Hidden Messages
          • Various dialog help messages
        • List of all menu options
      • Desktops
      • Command line
      • How To Use List Viewers in IDA
      • Licenses
        • Apache License for Ghidra
        • Apache License for LLVM
        • Common Public License Version 1.0
        • APPLE PUBLIC SOURCE LICENSE
        • PCRE2 LICENCE
        • GNU Lesser General Public License v2.1 for libiberty
      • Database conversion from idb to i64
    • Disassembler
      • Interactivity
      • Background Analysis
      • Graph view
        • Graphing tutorial
      • Proximity view
      • Navigation
        • Anchor
        • How to Enter a Segment Value
        • How to Enter a Number
        • How to Enter an Identifier
        • How to enter text
        • How to Enter an Address
      • Disassembly Gallery
        • Philips 51XA-G3
        • 6502 and 65C02 Disassembler
        • 6301, 6303, 6800, 6801 and 6803 Disassembler
        • 68040, Amiga
        • 6805 Disassembler
        • 6808 Disassembler
        • 6809 OS9 Flex Disassembler
        • 6809 Disassembler
        • 6811 Disassembler
        • 68HC12 Disassembler
        • 68HC16 Disassembler
        • 68k Amiga Disassembler
        • 68k Mac OS
        • 68k Palm Pilot
        • Unix COFF
        • NEC 78k0 and 78k0s Processor
        • 80196 Processor
        • 8051 Disassembler
        • Analog Devices 218x.
        • Alpha Processor – NT COFF
        • Alpha Processor – Unix ELF
        • Android ARM Executables (.elf)
        • ARC Processor
        • ARM Processor EPOC App
        • ARM Processor EPOC PE File
        • ARM Processor EPOC ROMFile
        • EPOC SIS File Handler
        • ARM Processor iOS (iPhone): Unlock
        • ARM Processor iOS (iPhone): Objective-C metadata
        • ARM Processor iOS (iPhone): Objective-C Instance variables
        • ARM Processor iOS (iPhone): Parameter Identification & Tracking (PIT)
        • ARM Processor iOS (iPhone): Start
        • ARM Processor iOS (iPhone): Switch statements
        • ARM Processor iOS (iPhone): C++ signatures
        • ARM Processor iOS (iPhone): Write
        • ARM Processor: Linux ELF
        • ARM Processor: AOF SDK
        • ARM Processor: Windows CE COFF Format
        • ARM Processor: Windows CE PE Format
        • ATMEL AVR Disassembler
        • C166 Processor
        • C166 Processor with ELF file
        • Rockwell C39
        • Microsoft .NET CLI Disassembler. VisualBasic library
        • CR16
        • Android Dalvik Executables (.dex)
        • Microsoft .NET CLI Disassembler
        • DSP56K
        • Fujitsu FR (.elf)
        • Gameboy
        • H8 300: COFF FILE Format
        • H8 300s: COFF FILE Format
        • H8 500
        • HPPA Risc Processor: HP-UX SOM
        • i51
        • i860
        • Intel i960
        • Intel IA-64 (Itanium)
        • Java Bytecode
        • Angstrem KR 1878
        • Renesas/Hitachi M16C
        • Renesas/Hitachi M32R
        • M740
        • M7700
        • M7900
        • MIPS Processor: Nintendo N64
        • MIPS R5900 Processor : Sony bin
        • MIPS Processor: Sony ELF
        • MIPS Processor: Sony PSX
        • MIPS Processor: Sony PSX
        • MIPS Processor: Unix COFF File Format
        • MIPS Processor: Unix ELF File Format
        • MIPS Processor: Windows CE PE File Format
        • MIPS Processor: Windows CE PE2 File Format
        • Panasonic MN102
        • Atmel OAK DSP
        • 80×86 Architecture: DOS Extender
        • 80×86 Architecture: Watcom Runtime
        • 80×86 Architecture: Geos APP
        • 80×86 Architecture: Geos DRV
        • 80×86 Architecture: Geos LIB
        • 80×86 Architecture: GNU COFF Format
        • 80×86 Architecture: OS/2 Linear Executable Format
        • 80×86 Architecture: Netware NLM
        • 80×86 Architecture: QNX Executable
        • 80×86 Architecture: Watcom Runtime
        • 80×86 Architecture: Windows OMF
        • 80×86 Architecture: Windows Portable Executable Format
        • 80×86 Architecture: Windows Virtual Device Driver
        • 80×86 Architecture: Windows 16 bits DLL
        • X-Box Disassembler
        • PDP 11: SAV File
        • PIC
        • PIC 12xx
        • Power PC AIF ECOFF file Format
        • Power PC Linux ELF
        • Mac OS PEF File
        • Mac OS X File
        • Windows NT PE File
        • Hitachi SH-1 Processor
        • Hitachi SH-3 Processor: Windows CE COFF format
        • Hitachi SH-3 Processor: Windows CE PE format
        • Hitachi SH-4 Processor: ELF File Format
        • Hitachi SH-4 Processor: Windows CE PE File Format
        • Super Nintendo Entertainement System (SNES)
        • SPARC Solaris COFF
        • SPARC Solaris ELF
        • SPARC Sun ELF
        • SPARC Sun ELF SO
        • ST 20C4
        • ST 7
        • ST 9
        • Toshiba TLCS 900
        • TMS 320c2 COFF
        • TMS 320c5
        • TMS 320c54
        • TMS 320c6 COFF File Format
        • TRICORE
        • SunPlus unSP
        • NEC V850
        • Z180 COFF File Format
        • Z380 COFF File Format
        • Z8
        • Z80
      • Supported processors
      • Supported file formats
        • Windmp file loader
      • Bitfields
        • Bit Fields tutorial
      • Structures tutorial
      • Union tutorial
      • Variable length structures tutorial
      • Data types, operands and constructs
      • Packed executables
    • Decompiler
      • Prerequisites
      • Quick primer
      • Exception handler
      • Introduction to Decompilation vs. Disassembly
        • Comparisons of ARM disassembly and decompilation
        • Comparisons of PowerPC disassembly and decompilation
        • Comparisons of MIPS disassembly and decompilation
        • Hex-Rays v7.4 vs. v7.3 Decompiler Comparison Page
        • Hex-Rays v7.3 vs. v7.2 Decompiler Comparison Page
        • Hex-Rays v7.2 vs. v7.1 Decompiler Comparison Page
      • Interactive operation
        • Rename
        • Set type
        • Set number representation
        • Edit indented comment
        • Edit block comment
        • Hide/unhide C statements
        • Split/unsplit expression
        • Force call type
        • Set call type
        • Add/del variadic arguments
        • Del function argument
        • Add/delete function return type
        • Jump to cross reference
        • Jump to cross reference globally
        • Generate HTML file
        • Mark/unmark as decompiled
        • Copy to assembly
        • Show/hide casts
        • Reset pointer type
        • Convert to struct *
        • Create new struct type
        • Split variable
        • Select union field
        • Jump to paired paren
        • Collapse/uncollapse item
        • Map to another variable
      • Batch operation
      • Configuration
      • Third party plugins
      • Floating point support
      • Support for intrinsic functions
      • Overlapped variables
      • gooMBA
      • Failures and troubleshooting
      • FAQ
      • Limitations
      • Tips and tricks
    • Debugger
      • Instant debugger
      • Remote debugging
        • Remote iOS Debugger
        • Android debugger
        • Dalvik debugger
        • Remote GDB Debugger
          • Remote GDB Debugger options
          • Debugging with gdbserver
          • Debugging with VMWare
          • Debugging with OpenOCD
          • Debugging with QEMU
          • External programs and GDB Debugger
          • Debugging code snippets with QEMU
        • PIN debugger
          • Building the PIN tool
          • Connecting a remote PIN tool instance from IDA
          • PIN support for MacOSX
        • Replayer debugger
        • Bochs debugger
          • Bochs Disk Image operation mode
          • Bochs IDB operation mode
          • Bochs PE operation mode
          • Bochs debugger FAQ
      • Local debugging
        • WinDbg Debugger
        • Linux debugger
        • Intel/ARM macOS debugger
      • Debugger tutorials
        • Debugging Dalvik Programs
        • IDA Win32 Local Debugging
        • IDA Linux Local Debugging
        • IDA Linux to Win64 Debugging
        • IDA Win32 to Linux Debugging
        • Debugging Mac OSX Applications with IDA Pro
        • Debugging iOS Applications using CoreDevice (iOS 17 and up)
        • Debugging iOS Applications with IDA Pro
        • Debugging Linux Applications locally
        • Debugging Linux/Windows Applications with PIN Tracer module
        • Debugging Windows Applications with IDA Bochs Plugin
        • Debugging Windows Applications with IDA WinDbg Plugin
        • Using the Bochs debugger plugin in Linux
        • Debugging Windows Kernel with VMWare and IDA WinDbg Plugin
        • Debugging Linux Kernel under VMWare using IDA GDB debugger
        • Windows Debugger Hub
        • Linux Debugger
        • Debugging a Windows executable locally and remotely
        • Debugging the XNU Kernel with IDA Pro
        • Remote debugging with IDA Pro
        • IDA Scriptable Debugger: overview
          • IDA Scriptable Debugger: scriptability
        • Debugging code snippets with QEMU debugger (a la IDA Bochs debugger)
        • Trace Replayer and managing traces
        • Using IDA Pro's tracing features
        • Working with PIN
        • Appcall
    • Creating Signatures
      • FLIRT
        • IDA F.L.I.R.T. Technology: In-Depth
        • Generate FLIRT signature file
        • Supported Compilers
          • Turbo Pascal
          • Delphi
      • Makesig
    • Creating Type Libraries
      • IDAClang
      • TILIB
    • Configuration
      • Configuration files
      • Command line switches
      • Keyboard macros
      • UI/Fonts/Themes
      • Shortcuts
      • Customizing IDA
      • CSS-based styling
    • Teams
      • IDA Teams Licenses
      • Diffing and Merging Databases with IDA Teams
      • Teams lc command reference manual
      • hv command reference manual
      • Hex-Rays Vault’s visual client user manual
    • Lumina
      • lc command reference manual
    • Plugins
      • Open Plugin Architecture
      • Plugin options
      • Plugins Shipped with IDA
        • Swift plugin
        • Golang plugin
        • Rust plugin
        • picture_search
        • Objective-C Analysis Plugin
        • DYLD Shared Cache Utils
        • Borland RTTI descriptors plugin
        • DWARF plugin
        • Patfind plugin
        • IDA Feeds
          • FLIRT Signature Bundle
      • Plugin Contest
      • How to write your own plugin?
    • Helper Tools
    • idalib
  • Developer Guide
    • C++ SDK
      • Getting Started with C++ SDK
      • C++ SDK Reference
      • Using the Decompiler SDK: Decompiler plugin
      • C++ SDK examples
      • How to create a plugin in C++?
      • C++ SDK Porting Guide from IDA 8.x to 9.0
    • IDAPython
      • Getting started with IDAPython
      • IDAPython API Reference
      • IDAPython examples
      • How to create a plugin in IDAPython?
      • IDAPython Porting Guide from IDA 8.x to 9.0
    • IDC
      • Core concepts
        • Expressions
        • Statements
        • Functions
        • Variables
        • Constants
        • Exceptions
        • Classes
        • Predefined symbols
        • loader_input_t class
        • Slices
      • IDC API Reference
        • Index of debugger related IDC functions
        • Alphabetical list of IDC functions
          • is_member_id
          • load_type
          • get_member_by_idx
          • get_ordinal_limit
          • set_selector
          • enable_tracing
          • get_prev_fixup_ea
          • del_segm
          • get_bmask_cmt
          • end_type_updating
          • Find
          • toggle_bnot
          • patch_byte
          • get_module_info
          • set_member_name
          • create_float
          • del_struc_member
          • read_dbg_memory
          • get_enum_width
          • getn_thread_name
          • del_struc
          • filelength
          • set_manual_insn
          • is_value...() functions
          • get_ip_val
          • del_extra_cmt
          • create_insn
          • op_offset_high16
          • get_cmt
          • expand_struc
          • get_idb_path
          • set_frame_size
          • get_file_ext
          • has_value
          • readshort
          • sanitize_file_name
          • get_member_flag
          • create_struct
          • ARM specific
          • set_enum_member_cmt
          • rename
          • set_ida_state
          • get_member_size
          • msg
          • qbasename
          • get_enum_member_enum
          • auto_mark_range
          • plan_to_apply_idasgn
          • set_named_type
          • op_offset
          • rename_entry
          • strlen
          • get_extra_cmt
          • get_enum_flag
          • fgetc
          • op_stkvar
          • get_last_index
          • get_field_ea
          • get_struc_id
          • select_thread
          • create_array
          • get_struc_cmt
          • set_array_string
          • set_func_attr
          • set_storage_type
          • get_struc_size
          • demangle_name
          • get_next_fixup_ea
          • get_next_bmask
          • delattr
          • gen_simple_call_chart
          • patch_qword
          • get_enum_name
          • loader_input_t.getc
          • get_debugger_event_cond
          • read_dbg_qword
          • define_local_var
          • generate_disasm_line
          • add_idc_hotkey
          • tolower
          • del_selector
          • set_debugger_event_cond
          • get_imagebase
          • gen_file
          • get_entry
          • find_custom_data_format
          • get_debug_name_ea
          • add_default_til
          • set_func_end
          • exit_process
          • delete_array
          • xtol
          • get_exception_code
          • detach_process
          • set_enum_cmt
          • get_wide_word
          • put_bookmark
          • is_loaded
          • add_enum_member
          • parse_decls
          • readstr
          • get_entry_qty
          • ord
          • sprintf
          • get_root_filename
          • get_enum_member_cmt
          • create_word
          • set_func_flags
          • loader_input_t.tell
          • create_align
          • read_dbg_dword
          • next_addr
          • get_bytes
          • batch
          • start_process
          • process_config_line
          • del_user_info
          • qmakefile
          • set_struc_name
          • print_decls
          • create_custom_data
          • del_enum_member
          • format_cdata
          • get_fixup_target_sel
          • get_item_size
          • loader_input_t.gets
          • get_last_bmask
          • Step Tracing Options
          • selector_by_name
          • get_enum_cmt
          • next_not_tail
          • prev_head
          • set_color
          • set_numbered_type
          • get_member_name
          • auto_wait
          • get_enum_member_bmask
          • fseek
          • get_segm_start
          • attach_process
          • Trace file functions
          • get_enum_member_value
          • op_stroff
          • get_next_offset
          • set_processor_type
          • get_bookmark_desc
          • create_data
          • lastattr
          • get_operand_value
          • collect_stack_trace
          • toupper
          • get_fixup_target_dis
          • set_cmt
          • add_entry
          • set_segm_addressing
          • qmake_full_path
          • get_source_linnum
          • fputc
          • resume_thread
          • get_func_attr
          • get_first_enum_member
          • add_sourcefile
          • get_first_bmask
          • read_selection_start
          • hasattr
          • get_member_cmt
          • gen_flow_graph
          • get_array_element
          • get_tinfo
          • loader_input_t
          • tinfo_errstr
          • TRUNC
          • add_segm_ex
          • Local types information and manipulation helpers
          • set_source_linnum
          • get_next_enum_member
          • loader_input_t.readbytes
          • set_array_params
          • jumpto
          • get_bookmark
          • set_enum_bf
          • prev_not_tail
          • toggle_sign
          • loader_input_t.size
          • Trace events functions
          • get_func_flags
          • get_gotea
          • set_segm_attr
          • get_item_head
          • set_default_sreg_value
          • print_insn_mnem
          • set_member_cmt
          • get_ordinal_qty
          • set_target_assembler
          • add_user_stkpnt
          • set_local_type
          • Hidden ranges
          • del_items
          • compile_idc_text
          • Dalvik debugger extension functions
          • byte_value
          • create_dword
          • is_code
          • del_func
          • get_enum
          • make_array
          • rotate_left
          • recalc_spd
          • search_path
          • CommonBits
          • get_processor_name
          • set_func_cmt
          • get_prev_bmask
          • Hashes
          • split_sreg_range
          • process_ui_action
          • set_fixup
          • get_fixup_target_type
          • create_oword
          • get_flags
          • get_func_name
          • create_strlit
          • add_struc
          • atol
          • load_debugger
          • mkdir
          • sizeof
          • get_enum_member_by_name
          • save_database
          • guess_type
          • get_segm_name
          • print_operand
          • qisabspath
          • get_member_qty
          • set_struc_cmt
          • get_fixup_target_flags
          • idadir
          • object.retrieve
          • add_auto_stkpnt
          • get_numbered_type_name
          • get_enum_member_name
          • get_next_index
          • prev_addr
          • get_name_ea
          • get_sp_delta
          • set_bmask_cmt
          • readlong
          • set_segm_name
          • get_prev_offset
          • set_segm_alignment
          • get_strlit_contents
          • forget_exception
          • get_item_end
          • add_func
          • get_name
          • Asks
          • get_spd
          • Debugger: control
          • get_wide_byte
          • plan_and_wait
          • set_enum_flag
          • RunPythonStatement
          • del_sourcefile
          • find_selector
          • get_frame_regs_size
          • op_num
          • define_exception
          • create_double
          • create_byte
          • read_selection_end
          • OpTypes
          • op_plain_offset
          • move_segm
          • get_member_id
          • set_segm_combination
          • get_current_thread
          • trim
          • Debugger: options
          • getn_thread
          • get_frame_id
          • typeinfo.print
          • to_ea
          • rebase_program
          • add_struc_member
          • get_exception_qty
          • get_first_index
          • import_type
          • set_segm_type
          • find_custom_data_type
          • get_next_seg
          • find_func_end
          • get_last_enum_member
          • getattr
          • get_frame_size
          • get_screen_ea
          • loader_input_t.read
          • set_reg_value
          • Debugger: modules
          • create_pack_real
          • writestr
          • exec_idc
          • get_enum_size
          • set_enum_name
          • create_tbyte
          • sel2para
          • atoa
          • loader_input_t.close
          • add_enum
          • ltoa
          • substr
          • del_idc_hotkey
          • Breakpoint handling functions
          • loader_input_t.seek
          • cleanup_appcall
          • object.store
          • get_type
          • qexit
          • get_debug_name
          • get_array_id
          • Can't Open File
          • suspend_process
          • process_config_directive
          • get_entry_name
          • get_last_member
          • get_struc_name
          • clear_selection
          • fclose
          • firstattr
          • create_yword
          • dbg_appcall
          • get_qword
          • patch_dword
          • begin_type_updating
          • read_dbg_byte
          • get_fpnum
          • qsleep
          • get_first_member
          • get_nsec_stamp
          • del_stkpnt
          • eval
          • savefile
          • eval_python
          • Xrefs
          • strstr
          • writeshort
          • get_sreg
          • get_segm_end
          • get_func_off_str
          • set_func_start
          • del_array_element
          • get_full_flags
          • set_exception_flags
          • rename_array
          • get_frame_args_size
          • op_flt
          • get_min_spd_ea
          • apply_type
          • get_prev_index
          • loadfile
          • retrieve_input_file_md5
          • get_wide_dword
          • patch_dbg_byte
          • Functions provided by the WinDbg debugger
          • get_original_byte
          • get_member_strid
          • call_system
          • writelong
          • get_thread_qty
          • nextattr
          • send_dbg_command
          • get_first_seg
          • get_processes
          • patch_word
          • get_manual_insn
          • ftell
          • get_entry_ordinal
          • set_array_long
          • delete_all_segments
          • TO_LONG
          • Function chunk related functions
          • Debugger: events
          • get_prev_func
          • op_seg
          • validate_idb_names
          • fprintf
          • fopen
          • strfill
          • del_fixup
          • get_bmask_name
          • inf_attr
          • is_bf
          • read_dbg_word
          • qdirname
          • get_segm_attr
          • func_contains
          • del_source_linnum
          • get_sourcefile
          • clr_database_flag
          • set_name
          • Refresh Screen
          • op_enum
          • getn_enum
          • get_db_byte
          • setattr
          • get_forced_operand
          • op_bin
          • Functions provided by the replayer debugger
          • prevattr
          • update_extra_cmt
          • get_str_type
          • op_man
          • choose_func
          • set_bmask_name
          • get_curline
          • decode_insn
          • set_segment_bounds
          • set_segm_class
          • write_dbg_memory
          • get_exception_name
          • get_enum_member
          • is_mapped
          • del_enum
          • get_frame_lvar_size
          • get_operand_type
          • set_root_filename
          • compile_idc_file
          • typeinfo.size
          • get_local_tinfo
          • get_fixup_target_off
          • is_union
          • unlink
          • get_segm_by_sel
          • set_enum_width
          • take_memory_snapshot
          • exec_python
          • get_next_func
          • get_member_offset
          • get_func_cmt
          • parse_decl
          • create_qword
          • next_head
          • suspend_thread
          • loader_input_t.getz
          • get_color
          • get_reg_value
          • load_and_run_plugin
          • set_database_flag
          • set_enum_member_name
          • set_member_type
          • get_prev_enum_member
      • IDC examples
        • Analyzing encrypted code
  • Admin Guide
    • Lumina server
    • Teams server
    • License server
      • Hex-Rays License Server Migration Guide
  • Release Notes
    • IDA 9.0
    • IDA 8.4sp2
    • IDA 8.4sp1
    • IDA 8.4
    • IDA 8.3
    • IDA 8.2sp1
    • IDA 8.2
    • IDA 8.1
    • IDA 8.0sp1
    • IDA 8.0
    • IDA 7.7sp1
    • IDA 7.7
    • IDA 7.6sp1
    • IDA 7.6
    • IDA 7.5sp3
    • IDA 7.5sp2
    • IDA 7.5sp1
    • IDA 7.5
    • IDA 7.4sp1
    • IDA 7.4
    • IDA 7.3
      • IDA 7.3 Undo: IDA can do it
    • IDA 7.2
      • IDA 7.2 The Mac Rundown
    • IDA 7.1
      • IDA 7.1 Debugger API 7.1 Porting Guide
    • IDA 7.0sp1
    • IDA 7.0
      • Internationalization (i18n)
      • Automatic discovery of string literals
      • API 7.0 Porting Guide
      • IDAPython backward compatibility
    • IDA 6.95
    • IDA 6.9
    • IDA 6.8
    • IDA 6.7
    • IDA 6.6
    • IDA 6.5
    • IDA 6.4
    • IDA 6.3
    • IDA 6.2
    • IDA 6.1
    • IDA 6.0
    • IDA 5.7
    • IDA 5.6
    • IDA 5.5
      • 5.5 Gallery
      • 5.5 Comparison
    • IDA 5.4
    • IDA 5.3
    • IDA 5.2
    • IDA 5.1
    • IDA 5.0
    • IDA 4.9SP
    • IDA 4.9
    • IDA 4.8
    • IDA 4.7
    • IDA 4.6
    • IDA 4.x
    • IDA 3.x
    • Cumulative bugfix for IDA
  • Archive
    • IDA’s Windbg plugin
    • IDA’s Bochs debugger plugin
    • IDA’s Bochs debugger plugin 2
    • DosWin32
    • Hex-Rays v1.1 vs. v1.0 Decompiler Comparison Page
    • Hex-Rays v1.2 vs. v1.1 Decompiler Comparison Page
    • Hex-Rays v1.3 vs. v1.2 Decompiler Comparison Page
    • Hex-Rays v1.6 vs. v1.5 Decompiler Comparison Page
    • Hex-Rays v1.7 vs. v1.6 Decompiler Comparison Page
    • Costly Greetings – An Adventure In Hostile Code Analysis
    • An Adventure In Hostile Code Analysis: Description
    • An Adventure In Hostile Code Analysis: Disassembly
    • Improved code flow analysis
    • Program Navigation Bar
    • IDA Home Contest
    • Pimp My IDA: vote results
    • Turning off IDA 6.x compatibility in IDAPython
    • Porting guide for IDA 7.4 turning off IDA 6.x API backwards-compatibility by default
    • Porting guide for IDA 7.4 IDAPython and Python 3
    • IDAPython and Python 3
    • Porting guide for changes in IDAPython-on-Python-3 APIs
    • Debugging iOS Applications With IDA
    • IDA Win32 to Win32 Debugging
    • IDA Win32 to Win64 Debugging
    • Legacy license server: Floating Licenses
      • Installing on Linux
      • Installing on Windows
      • Installing on OS X
    • Decompiler Installation
    • Enumerated types tutorial
  • Bug Bounty
Powered by GitBook
On this page
  • IDA 9.0 Highlights
  • Licensing changes
  • Headless processing with idalib
  • New RISC-V Decompiler and Disassembler Extensions
  • WASM Disassembler and File Format Loader
  • nanoMIPS support
  • C++ Exceptions Support in the Decompiler
  • IDAPython Improvements
  • No more IDA32
  • UI Improvements
  • FLIRT Updates
  • Metadata Descriptors for Plugins
  • Watch what's new in IDA 9.0
  • Full list of changes and new features:
  • Processor modules
  • File formats
  • FLIRT / TILS / IDS
  • Standard plugins
  • Kernel/Misc
  • Scripting & SDK
  • UI
  • Decompilers
  • Bugfixes

Was this helpful?

Export as PDF
  1. Release Notes

IDA 9.0

Last updated 7 months ago

Was this helpful?

LogoLogo

Need Help?

  • FAQs
  • Support

Community

  • Forum
  • Plugins

Resources

  • Blog
  • Download center

© 2025 Copyright Hex-Rays

IDA 9.0.240925 September 30, 2024

Looking to try IDA 9.0? Find out how to upgrade now and request your IDA 9.0 trial.

IDA 9.0 Highlights

Licensing changes

  • Licenses are no longer bound to a specific platform. After buying one IDA license, it can be used on all supported platforms (Windows/Linux/macOS).

  • License packs with various decompilers are available

  • IDA Home 68K is retired and replaced by the new IDA Home RISCV (with cloud decompiler!)

  • IDA Teams and Private Lumina functionality are available as options and can be used with standard IDA Pro

  • IDA Teams users count is no longer limited by the seat count — only the concurrent usage is enforced according to IDA's license type

  • A custom Hex-Rays licensing server replaces the FlexNet licensing server for floating licenses

Headless processing with idalib

  • With idalib, both the C++ and Python APIs can be used from outside IDA to form standalone applications. The resulting program or script doesn’t have to be loaded inside IDA, but rather IDA's engine is used inside your application.

  • This makes developing against the IDA API much easier — if configured correctly, you get auto-completion and debugging in your favorite C++/Python IDE

  • NO RPC or IPC to an external IDA process means you get a native speed of execution

  • Almost any Python can be used: official CPython, Anaconda, Homebrew, etc.

New RISC-V Decompiler and Disassembler Extensions

  • New decompilers targeting 32- and 64-bit RISC-V code (HEXRV and HEXRV64) are now available

  • We extended the RISC-V processor module to support T-Head extension instructions (used in Xuantie and Allwinner processors)

WASM Disassembler and File Format Loader

  • With many apps shifting to client-side browser applications, we saw the need for a new disassembler for Web Assembly (WASM)

  • WASM code is embedded into its own binary file format hence we also ship a file loader that decodes the WASM file format

nanoMIPS support

  • Both the MIPS disassembler and decompiler now support nanoMIPS instructions

  • Despite the name, it's not a simple extension of the MIPS ISA but a completely new encoding of the existing MIPS instructions and addition of new ones, as well as a brand new calling convenion

  • nanoMIPS support is included in the MIPS decompiler (HEXMIPS), there is no need for an extra license

  • Firmware compiled for nanoMIPS often ships in md1rom format, which is why we added md1rom file loader to IDA (including parsing and applying of debug symbols, if available)

C++ Exceptions Support in the Decompiler

  • The decompiler can now emit try/catch blocks. As the first step, we implemented support for the C++ exception scheme in binaries compiled for x64 using Microsoft VC++.

IDAPython Improvements

  • Most IDAPython APIs now have type annotations, making the API less obstructive to use.

  • Python virtual environments (venvs) are now supported - simply run IDA from an activated virtual environment and it will pick up locally installed modules

  • Objects returned in the Python API are properly zero-initialized.

  • idapyswitch can now be used with read-only IDA installations (nothing is changed in the installation directory when picking a different Python version/install)

  • Auto-completion in IDA's CLI now disregards __magic_methods__ and auto-generated SWIG methods, reducing noise and helping to find a particular function faster

  • Auto-completing a method call shows its prototype with type annotaions and docstring (if available) in a pop-up hint

No more IDA32

  • We deprecated IDA32 a few versions ago. With IDA 9.0, just one IDA binary handles both 32- and 64-bit code.

  • The number of installed executable files is cut in half

  • An easier life for native plugin maintainers since only one version (__EA64__=1) needs to be maintained

  • The conversion of legacy IDB into the I64 file format is transparent and automatically performed by IDA

UI Improvements

  • The legacy Enums and Structures views are removed entirely and replaced by the Local Types.

  • This also means that struct.hpp and enum.hpp and their Python counterparts ida_struct and ida_enum disappear from the API. Replacement functionality for both headers/modules is now located (mostly) in typeinf.hpp / ida_typeinf. A porting guide is available.

  • It is now possible to specify fixed size for structures and to enable field packing easily

  • The function prototype editor (aka Y shortcut on a function name) now can toggle between the classic free-text one-line editor and a new multi-line editor featuring the usual shortcuts and controls.

  • At the same time, we added basic support for UI-based editing of argument locations, to make our custom __usercall syntax less of a hassle to remember.

  • The basic function prototype editor now indicates invalid prototypes via a red rectangle while typing

  • A refreshed set of shortcuts that better matches the modern OS conventions can now be selected instead of the traditional shortcuts

FLIRT Updates

  • We massively updated, modernized and extended the number of FLIRT signatures available for use with IDA

  • Signatures for modern languages like Golang and Rust, as well as updates for classic compilers (MSVC for Windows, GCC for Linux) are made available as a separate download due to their size

  • These signatures are generated and updated automatically with every new release of the compiler/language/library

  • A new plugin (FLIRT Manager) allows easy application of multiple signatures to the database and lets you see which one gives the best results

- Golang:
  - Versions: stable versions from 1.10.0 to 1.23
  - Operating Systems: Linux, Windows, MacOS
  - Architectures: arm64 (Windows, Linux, MacOS), arm (Windows, Linux, MacOS), x86 (Windows, Linux) , x86-64 (Windows, Linux)
- C/C++
  - Windows (MSVC):
    - Architectures: arm, arm64, i386, amd64
    - Packages: ATL, CRT, MFC, Windows SDK 10, Windows SDK 11
  - Linux:
    - Distribution: Ubuntu & Debian
    - Architectures: i386, amd64, arm64, armhf, armel, arm, s390x, mips64el, mipsel, mips, ppc64el
    - Packages: libc6, libselinux1, libpcre2, libidn2, libssl, zlib1g, lib32z1, libunistring, libcurl4-gnutls, libcurl4-nss, libcurl4-openssl, libnghttp2, libidn2, librtmp, libssh, libssh-gcrypt, libpsl, libldap, libzstd, libbrotli, libgnutls28, nettle, libgmp, comerr, libsasl2, libbrotli, libtasn1-6, libkeyutils, libffi, uuid, libprotobuf, heimdal-multidev, musl, libplib, libsdl1.2-bundle (libsdl-console, libsdl-sge, libsdl1.2, libsdl-ocaml, libsdl-image1.2, libsdl-kitchensink, libsdl-mixer1.2, libsdl-net1.2, libsdl-sound1.2, libsdl-ttf2.0, libsdl1.2-compat, libsdl-gfx1.2, libsdl-pango), libsdl2-bundle (libsdl2, libsdl2-gfx, libsdl2-image, libsdl2-mixer, libsdl2-net, libsdl2-ttf)
- Rust
  - Versions: 1.77 to 1.81
  - Architectures: arm64, arm, x86, x86-64
  - Operating Systems: Linux, Windows, MacOS
  - Compilers: GCC, LLVM, MSVC

Metadata Descriptors for Plugins

  • ida-plugin.json now offers a standardized entrypoint for plugins. This enables plugin authors to follow their own plugin directory structure, all they need to do is point IDA to the main plugin entry point. To maintain backward compatibility, IDA will keep loading plugins in the legacy way for a couple of releases.

    With the following directory structure:

plugins
└── ida_greeter
    ├── ida-plugin.json
    └── main.py

A possible ida-plugin.json could look as follows:

{
  "IDAMetadataDescriptorVersion": 1,
  "plugin" :
  {
    "name" : "greeter",
    "entryPoint" : "main.py"
  }
}
  • This approach allows for easy management of plugin's resources and bundled dependencies

Watch what's new in IDA 9.0

Curious about the new IDA? Watch the feature overview on the All Things IDA channel.

Courtesy of Elias Bachaalany (@allthingsida)

Full list of changes and new features:

Processor modules

  • 68K: added typical code start sequences

  • ARM: improved detection of targets of indirect jump instructions

  • ARM: improved prolog analysis to recognize and mark calls to chkstk_darwin

  • AVR: updated missing bit definitions for ATmega640

  • MIPS: support for NanoMIPS instruction set

  • RISCV: added support for legacy instruction sfence.vm

  • RISCV: added support for T-Head custom instructions

  • RISCV: fixed the frame analysis when s0 (FP) is saved

  • wasm: new processor module (Web Assembly)

  • RH850: added new instructions supported by RH850G4MH core (SIMD, FXU, etc.)

  • V850/RH850: convert two-instruction loads and stores into one macroinstruction

File formats

  • ELF: added support for nanoMIPS

  • ELF: ARM64: added support for R_AARCH64_P32_TLS_TPREL relocation type, used by ILP32

  • ELF: RISCV: added suport for R_RISCV_ALIGN relocation type

  • md1img: loader for Mediatek modem firmware images (nanoMIPS and MIPS16e2)

  • MACHO: support __chain_starts format 5 (DYLD_CHAINED_PTR_32_FIRMWARE)

  • MACHO: handle iOS18 DSC with zero-sized __OBJC_RO segment in libobjc

  • wasm: new file loader for Web Asembly modules

FLIRT / TILS / IDS

  • FLAIR: PCF: added support for ARM64 COFF files

  • FLAIR: PELF: proper handling of ELF32 for AArch64 (ILP32)

  • FLAIR: PELF: added support for most common relocation types for MIPS, MIPS64, ARM, AARCH64, PPC, PPC64, PARISC, SPARC, M86K

Standard plugins

  • eh_parse: skip leading and trailing zero entries in x64 .pdata for PE files (real binaries have them); improve recognition of exception dispatcher functions in debug builds

  • eh_parse: x64 exception handlers are now proper standalone functions and not function chunks

  • eh34: new plugin to handle c++ exceptions for the binaries built by msvc x64

  • ida_feeds: new plugin and standalone script for mass application of FLIRT signatures

  • makesig: add run() method which can be used to generate .sig (or just pat) from the database in batch mode

  • pdb: added an option to only load names (useful with large PDBs when you don't need types)

  • pdb: allow user to choose what to load for a module (types and/or names) during debugging

Kernel/Misc

  • goodname.cfg: improve simplification of MSVC STL classes

  • kernel: c/c++ keywords are now forbidden as struct fields

  • kernel: support for ida-plugin.json

  • kernel: improved strlit detection (short ones were converted to data items)

  • kernel: improved recognition of noret functions which call other noret functions indirectly

  • noret.cfg: added terminate, std_terminate to the list of non-returning functions

  • installer: macOS: install all contents into a single .app bundle

  • licensing: replaced FlexNet licensing server by custom Hex-Rays licensing server (floating licenses only)

Scripting & SDK

  • IDAPython: added find_binary and find_string

  • IDAPython: added detection of virtual environments (venv)

  • IDAPython: added more pointer wrappers for integer types defined in pro.h

  • IDAPython: added cli_t.OnFindCompletions replacing cli_t.OnCompleteLine

  • IDAPython: idapyswitch can now be used with read-only IDA installations

  • IDAPython: idapyswitch can now detect recent homebrew versions on macOS

  • IDAPython: Removed __magic_methods__ from CLI auto completion

  • IDAPython: zero-initialize C++ objects exposed in the Python API

  • IDAPython: simplify directory structure (got rid of '3', and 'ida_32|64' became 'lib-dynload')

  • IDAPython: loader_input_t.read() should return an empty bytes object upon read error, not None

  • SDK: added Visual Studio templates for plugins and loaders

  • SDK: added get_last_widget(mask)

  • SDK: added FUNC_UNWIND/FUNC_CATCH function flags to mark exception handlers, they will be ignored in decompilation

  • SDK: added pipe_process() to launch a process and establish a 2-way communication with it

  • SDK: added qlist::splice()

  • sdk: extended cli_t interface to allow retrieving function prototypes and docstrings on auto completion

  • sdk: introduced flags IRI_... to be used in is_ret_insn(), ev_is_ret_insn instead of bool strict

  • SDK: moved node_ordering_t to gdl.hpp

  • SDK: package decompiler's interface (hexrays.hpp) and samples as part of the SDK instead of inside IDA

  • SDK: published basic undo interface (create undo point, undo, redo)

  • SDK: renamed abstract_graph_t -> drawable_graph_t; mutable_graph_t -> interactive_graph_t

UI

  • UI: added an option to retain structure size (Fixed size structs)

  • UI: added "pack fields" checkbox to control gaps between fields for structs

  • UI: added syntax highlighting for user-defined types in the freetext editor

  • UI: command palette: fix wrong reports about "command failed"

  • ui: graphs: do not display a prompt when there's only one choice for jumping to a parent/child node

  • UI: handle export/import of Local types to IDC is in a more flexible way. User is able to select the different policies, for example: load the types and skip the equal.

  • UI: if IDA already has a file open, File > Open or dropping a file on its window opens it in a new IDA instance (configurable via OPEN_IDB_IN_NEW_WINDOW in idagui.cfg)

  • UI: it is now possible to inspect contents of base type libraries, by double-clicking on them in the "Type libraries" view

  • UI: introduced a new set of keyboard shortcuts better aligned with modern OS conventions

  • UI: got rid of "Structs" and "Enums" widgets

  • UI: new shortcuts: Alt- (and CMD-) to jump to a window

  • UI: enabled Wayland support on Linux

  • HVUI: added a new action "Convert IDB"; it converts the idb and replaces it with i64. bulk operation is also possible

Decompilers

  • decompiler: riscv: added RV32 and RV64 decompilers

  • decompiler: added try/catch ctree statement

  • decompiler: improved detection of variadic arg types

  • decompiler: introduced a new event: hxe_inlining_func

  • decompiler: published a few graph algorthims (pre/port ordering and dominator calculation)

  • decompiler: arm: added support for VSEL instruction (ARMv8-M)

  • decompiler: impoved structure copy recognition

  • decompiler: improved cfunc_t cache by introducing "saved_to_idb"; otherwise we were saving all decompiled functions upon each "save_database", again and again

  • decompiler: improved constant representation in comparisons with binary operators

  • decompiler: improved hexrays history to support c++ exception handlers

  • decompiler: improved the error message about the missing license: tell the user what license is missing

  • decompiler: mips: added support for movtz and movtn (MIPS16e2)

  • decompiler: ui: added "Jump to matching brace" action to the context menu

  • decompiler: removed welcome form, renamed menu entry to "Hex-Rays Decompiler Options"

Bugfixes

  • BUGFIX: ARM: analysis speed could be slow on large 32-bit firmware binaries

  • BUGFIX: ARM: comment for UBFIZ instruction was wrong

  • BUGFIX: ARM: fixed endless loop which could happen when analysing function chunk before main function entry

  • BUGFIX: ARM: fixed CF_JUMP/CALL flags for some instructions (e.g. BLR)

  • BUGFIX: ARM: stop decoding undefined MOV Wx, #imm variants (imm not fitting in 32 bits)

  • BUGFIX: cvt64: converting an old .idb to .i64 would fail if its path contained a space

  • BUGFIX: debugger: win32_remote.exe was unnecessarily requiring an API instroduced in Windows Vista and would not run on XP anymore

  • BUGFIX: debugger: win32: IDA's debugger could be detected by a file lock on the modules being loaded into the process

  • BUGFIX: debugger: bochs: added support for Bochs 2.8.0

  • BUGFIX: decompiler: decompilation of different syscalls in close sequence could be wrong

  • BUGFIX: decompiler: expressions with variable sized structures could be mishandled

  • BUGFIX: decompiler: IDA could complain "Could not find a matching license for product" when multiple decompilers were installed

  • BUGFIX: decompiler: internal errors triggered by UI-related code (e.g. generaing tooltips) could result in "Unknown C++ exception" fatal error

  • BUGFIX: decompiler: pressing F5 was not refreshing the pseudocode window in some cases; we were discarding the decompilation result

  • BUGFIX: decompiler: value range optimization could lead to code being wrongly removed

  • BUGFIX: DSCU: a GAP spanning multiple subcache files would fail to load

  • BUGFIX: kernel: IDA on Linux had an unnecessary hard dependency on libsecret and would refuse to run without it.

  • BUGFIX: IDA would not mark typical code sequences in raw binary files even if the processor module supported it

  • BUGFIX: navigating to a global name which matched a known type name would fail

  • BUGFIX: objc: NS*Block reference detection error would end up creating incoherent block structures over unrelated data

  • BUGFIX: PC: alloca_probe / chkstk_ms does not modify rsp or rax in x64 code, unlike x86

  • BUGFIX: PC: REX prefix could be incorrectly applied to 32-bit instructions

  • BUGFIX: PC: vmovw instruction was decoded as if using 16-bit registers (it actually uses 32-bit ones)

  • BUGFIX: PDB: importing types from some large PDBs would fail with "the maximum recursion level was reached"

  • BUGFIX: PDB: improved algorithm to extract anonymous(embedded) unions: gap members could be mis-ordered

  • BUGFIX: RISCV: fence.i instruction was not decoded

  • BUGFIX: SDK: fixed a debug/opt build incompatibility in reg_finder_t (due to embedded std::map member)

  • BUGFIX: SDK: set_all_bits() and clear_all_bits() would behave wrongly on bitmaps with size not a multiple of 8

  • BUGFIX: sometimes information about newly created range-like entities (segments/functions/...) could be lost during UNDO

  • BUGFIX: tinfo: xrefs to a deleted enum were not removed

  • BUGFIX: UI: default buttons in the 'dark' theme wouldn't stand out

  • BUGFIX: UI: editing type of items inside current function was not possible

  • BUGFIX: UI: fixed missing scrollbars in the "Output" window when long text was printed

  • BUGFIX: UI: large amounts of lines in the "Output" window could cause slowdowns

  • BUGFIX: UI: long strings could be truncated when using "Export data"

  • BUGFIX: UI: when using COLOR_INV color code (e.g. in a custom viewer), IDA would use default color for the text instead of the previous background color

  • BUGFIX: UI: quick filters would apply to hidden columns

Looking to try IDA 9.0? Find out how to upgrade now and request your IDA 9.0 trial.

Customer portal - licenses view
Screenshot of idalib
Screenshot of RISC-V disassembly
Screenshot of RISC-V decompilation
Screenshot of WASM disassembly
Screenshot of nanoMIPS disassembly/decompilation
Screenshot of C++ try/catch blocks in pseudocode
Screenshot of IDA run from venv
Screenshot of IDAPython completion hint
Screenshot of idb conversion prompt
Screenshot of new prototype editor
Screenshot of new prototype editor
Screenshot of new shortcuts
Screenshot of FLIRT Manager