Get more information without switching between forms: functions, names, graph view, hex-view
IDA and HexRays side by side
The default debugger layout.
Easily navigate between different windows. Very useful for keyboard lovers.
The debugger window can become floating, so you can move it to another monitor if you wish.
Dynamic decompilation with the debugger and HexRays side by side
If the old MDI interface is still preferred, it is always possible to float all windows.
Finally! Finally we drop the MDI user interface and switch to dockable windows. They are simpler to use, more flexible, waste less screen space. Well, you know it yourself. The new interface also includes the improved hex viewer and stack view. The new hex view is much easier to use, can display the data in various formats, allows editing in-place. There is a lot to discover, some screenshots can be checked in the gallery.
Probably the fastest thing to do is to visit the comparison page for more detail about processor modules. In the endless pursuit to improve the disassembly output, we continue to add new methods, tricks, and heuristic rules to IDA. This time the biggest changes are in the ARM and PC modules. The ARM module handles the stack frame, type information, call/jump instructions better than before. The PC module knows about more code patterns, like switch and position-independent code idioms, detects more exception handlers, etc.
Naturally, after adding Windbg support in v5.4, we had to add support for crash dumps. Just specify a crash dump file as the input file and IDA will create a database from it. The debugger can be βlaunchedβ to enter the familiar debugger environment with module, thread, and stack windows, where information can be retrieved the usual way. The only thing you cannot do is to resume the execution, that would be an overkill π
The previous addition required a big, hopefully invisible, change in the kernel, because the existing storage method could not handle huge gigabyte segments. Previous versions of IDA had a hard limit on the addressing space of the program: max 256MBytes in the default configuration. Modern programs routinely allocate much bigger memories, so we had to find a solution. Now, if a crash dump segment is bigger than a certain size, IDA automatically chooses the sparse storage method. Instead of storing information about every single byte of the program, IDA remebers only useful information. Thus, a 25MB uninitialized array requires just a few bytes of storage to describe it, not 100MB as before.
We would also explicitly mention and say βthank youβ to the users who contributed to this release of IDA. Bernhard Mueller from SEC Consult GmbH was very kind to investigate why the Symbian debugger was failing on new devices and contributed an improvement. Robert Krkic generously shared his IDS files for Symbian systems with all IDA users. Thank you guys, your contributions make IDA better and easier to use!
Do you remember that you can add emulated API functions to the Bochs debugger? Just provide an implementation in IDC/Python/C++ and your function is called. For example, you could provide an implementation of the socket() function that would open a socket on the host system or do something else. While this possibility is very useful and remains in place, we added more predefined functions. Now the Visual Studio and Borland C/C++ startup code can be executed without generating exceptions and you can focus on the βrealβ code.
In addition, we also added the βBochs rc file loaderβ. It really helps if you already have a bochsrc file and want to debug it with IDA. Just specify it as the input file and IDA will create a nice database for you. No need to create a dummy database, populate it with the code from the boot sector, etc.
Other, probably less visible, improvements include the PDB plugin, the type system, more SDK functions (check out the exec_request_t if you develop multithreaded plugins), etc. The full list is below:
Processor Modules
PC: added detection of CException destructor; this helps to detect exception handlers and ignore them during function epilog analysis
PC: added support for another variation of PIC code by GCC
PC: more switches recognized in unoptimized MSVC code
File Formats
BOCHRC file loader: it is now possible to start IDA with a bochsrc file as the input file
CRASH DMP file loader: it is now possible to start IDA with an MS Windows Crash dump file
COFF: segment permissions are imported for MS object files
Kernel
Added some common C++ ABI functions to noret.cfg
Added support for __usercall functions with variable number of arguments (β¦)
Added functions to handle floating point instructions for the decompiler
Scripts & SDK
IDC: added MoveSegm() and RebaseProgram() functions
IDC: added OpFloat() function
IDC: renamed segment modification functions to start with a verb. Old names continue to be available.
User Interface
UI: it is possible to add several types at once from the local types list (previously only the first one was added)
UI: it is possible to delete segment register change points from the βJump to segment registerβ dialog or βSegment registersβ view
UI: it is possible to set the base for array indexes display (decimal, hexadecimal, octal or binary)
Debugger
breakpoint condition is evaluated only after the breakpoint is hit
Symbian: added support for new AppTRK v3.0.8 (thanks to Bernhard Mueller from SEC Consult GmbH)
Bugfixes
BUGFIX: βmove segmentβ command could affect segments outside of selection
BUGFIX: βsearch for immediateβ would ignore unexplored dword values (except in some very rare cases)
BUGFIX: βload debug infoβ command was not available from the module list if the database was created by instant debugger
ARM: added support for switches implemented using TBB/TBH instruction
ARM: better detection of R7-based frames
ARM: LDMED can be used for return too
ARM: type info and argument names are propagated for local variables passed by reference
ARM: other unspecified improvements (we removed them to keep the list short and more readable)
ARM: LSL Rx, Ry, #0 and ADD Rx, Ry, #0 are simplified to
I51: i/o port names are accepted for all segments (before only FSR definitions were handled)
MIPS: of ELF files
SuperH: simplified display of pc-relative literal loads
ELF: handle dynamic symbols in MIPS files
ELF: some new SuperH relocations are supported
ELF: added support for ARM TLS relocations
EPOC: added support for multiple imports with the same ordinal
EPOC: user contribution: ids files for epoc6/9 from Robert Krkic
EPOC: since AppTRK does not report thread creation/deletion, IDA forcibly refreshes the thread list if an unknown thread id is encountered
PDB: added the possibility to manually load a specific PDB file; to load only types from the PDB
PDB: added support for anonymous unions. types with bitfields are handled more correctly: we replace them with a corresponding POD type; ida kernel cannot handle bitfields yet
PDB: added support for undefined enum types
PDB: better handling of C++ static methods and functions returning complex types.
PDB: better handling of string literals (??_C@β¦)
PDB: information about function argument names is applied, if available in the .pdb file
PDB: symbols can be loaded using EXE headers in the database, either from the module list during debugging or via File menu by specifying a valid base address
PE: added an option in pe.cfg to force loading of all PE file sections (usually .reloc and similar sections are skipped)
PE: if import and/or export tables lie outside .idata segment, they are parsed and formatted
Demangler: added support for the latest gcc4
Updated WinCE ARM ids files to Windows Mobile 6.0
SDK: added build_anon_type_name()
SDK: added build_func_type() to facilitate building of type strings that represent functions
SDK: added callbacks to AskUsingForm so that the dialog can be modified on the fly
SDK: added change_storage_type() to change the storage method of arbitrary address range. please note that the sparse storage method works well only with uninitialized areas with huge objects
SDK: added floating point conversion functions for 64bit values
SDK: added functions for working with imports (enum_import_names and others, see nalt.hpp)
SDK: added get_zero_areas() to retrieve info about huge zero inited ranges
SDK: added exec_request_t β class that allows for code execution in the main thread from any other thread
SDK: added more convenient areacb_t::for_all_areas2(), which accepts a functor instead of (function,data) pair
SDK: added qlist compiler-independent template
SDK: added qthread_self()
SDK: added set_process_options() to set debugger process options
SDK: added ui_enable_input_hotkeys notification to let plugins temporary disable alphanumeric hotkeys which can interfere with user input
SDK: added replace_wait_box()
SDK: added DBGINV_REDRAW bit to refresh the user interface while invalidating the debugger caches
SDK: bitfield definitions in type strings have been changed. since there was no support for bitfields in the parser, this change should not affect anybody
SDK: introduced dt_ldbl to represent long double types. long double is different from tbyte and can be 8,10,12, or 16 bytes depending on the compiler
SDK: is_sp_based() can now return information about operands which are substracted from stack pointer
SDK: patch_byte() and similar functions return success if they succeed in modifying either process memory or idb. before they were returning true only if both process memory and idb were modified
SDK: windbg kernel mode: added notion of virtual threads
UI: unicode strings: unprintable characters are grouped into arrays; extra trailing zeroes are omitted by default
BUGFIX: 8051: βxβ key didnβt work with named bit operands (like P35)
BUGFIX: apply_tinfo() could not apply array types correctly; also applying char[] types was not always producing nice results
BUGFIX: ARM: some Thumb2 instructions were not decoded
BUGFIX: attaching to a process that generates exceptions or any other non-white listed event would still generate an ATTACH event first
BUGFIX: autoanalysis could loop indefinitely in some rare cases
BUGFIX: bochs could hang while parsing a binary file as bochsrc text file
BUGFIX: bochs dbg/rc file selectors were using save dialog and not open dialog
BUGFIX: bochs debugger could not handle some malformed PE files
BUGFIX: bochs debugger PE files with no sections were handled incorrectly
BUGFIX: bochs debugger was not initializing the FPU before running the program
BUGFIX: bochs debugger: CR4.bit9 should be set otherwise an invalid opcode will be thrown if a program attempts to use any of SSE{n} instructions.
BUGFIX: CodeView debug information was applied to wrong addresses
BUGFIX: corrupted epoc executables could not be loaded
BUGFIX: deleting a segment from UI sometimes led to deletion of wrong segment
BUGFIX: demangler: Visual Age was always interpreted as GNU compiler
BUGFIX: ELF: if file had .got.plt section but no .got, IDA did not rename PLT import stubs
BUGFIX: equal_types() was considering floating point and integral types of the same size equal
BUGFIX: esp alignment in 32-bit programs is only 2 bytes, not 4 bytes (push ax/add esp, 2 are perfectly valid but ida was aligning esp to 4 bytes)
BUGFIX: fild/fistp qword operands are marked as floating point doubles
BUGFIX: fpval->integer conversion functions were broken since very long time
BUGFIX: generating html file with inverted colors would hang ida
BUGFIX: GetProcessQty() was failing if called before running the debugger
BUGFIX: huge (>2GB) areas could not be displayed in the navigation band in all zoom levels
BUGFIX: ida could complain about patched bytes at the start of a debugging session while no bytes had been patched
BUGFIX: ida was always asking for a confirmation of array creation if the first byte of the array was unexplored
BUGFIX: ida was not using export information from available DLLs due to a logic error in the code
BUGFIX: ida was silently failing to use dummy prefixes as new location names; now it displays a correct error message
BUGFIX: ida would crash in linux trying to display the debugger specific options dialog box
BUGFIX: IDACall GetProcAddress() was returning wrong addresses for forwarded entries
BUGFIX: idb2scr() was broken. it was impossible to edit comments with 8-bit ascii characters, the dialog box would display them as garbage
BUGFIX: IDC was not comparing floating point with integers correctly
BUGFIX: idc: fixed a typo in INF_SIZEOF_LDBL
BUGFIX: if attaching to multithreaded application, the thread window would not focus on the current thread (no thread would be selected)
BUGFIX: in some cases IDA was still showing the βIDA failed to stop/detach from the debugged programβ dialog even if the process was already terminated
BUGFIX: in some rare cases IDA could display an exception if βfull stack pointer analysisβ was enabled.
BUGFIX: it was impossible to refuse to import types from local type window to enum/structure windows
BUGFIX: it was impossible to debug a dll when two or more dlls of the same name are loaded
BUGFIX: it was impossible to suspend a process that keeps on generating masked exceptions.
BUGFIX: java module could crash trying to display an automatic comment for a long (multi-line) output
BUGFIX: linux debugger could interr if the input file name was incorrect in the process options
BUGFIX: long descriptions of local void and typedef types were lacking the βtypedefβ keyword
BUGFIX: LX: some LE files were not completely loaded (if the objectβs virtual size was less than the actual size)
BUGFIX: mac executables could not be used under Mac OS X 10.3
BUGFIX: mac os x debugger could exit with βcanΒt find dll nameβ error
BUGFIX: mips dmfc1/dmtc1 instructions were not supported
BUGFIX: mips module was requiring even fp register numbers for ldc1/sdc1 instructions; removed this limitation
BUGFIX: mips: clz/clo/plzcw/movf/movt instructions could not be disassembled in delay slots
BUGFIX: move_segm() would rebase offset expressions regardless of the MSF_NOFIX flag
BUGFIX: multiple problems with the linux debugger module have been fixed
BUGFIX: nlm loader was not populating the imports window
BUGFIX: noType() called on a tail byte could corrupt the database
BUGFIX: pausing execution in VMWare was reported as an exception
BUGFIX: PC: (x64) movq instruction was decoded as movd
BUGFIX: PC: fixed occasional inifinite loop during analysis
BUGFIX: PC: fpu instructions had wrong values in the dtyp field (fpu reg types are still set to be dt_double, ideally it should be dt_tbyte)
BUGFIX: PC: functions with _SEH_prolog were not analyzed properly when using PDB symbols
BUGFIX: PC: LAHF/SAHF instructions could not be disassembled in 64-bit mode
BUGFIX: PC: operands of the fcompp insn were displayed in reverse order; they are not displayed anymore if they are regular st, st(1)
BUGFIX: PC: some one-byte opcodes were decoded incorrectly in 64-bit mode. REX.B was not ignored for opcodes 05, 25 etc
BUGFIX: PDB plugin could create a circular dependency in type, which would later crash IDA
BUGFIX: PE: imports in files with zero sections were parsed incorrectly
BUGFIX: PE: several fixes to handle unusual alignment values (thanks to Ivan Teblin)
BUGFIX: PIC files were loaded with 8-bit βbytesβ by default
BUGFIX: pressing and holding F8 in bochs debugger could lead to a racing condition and deadlock
BUGFIX: SDK: c2ustr was returning a string with an extra terminating zero which was included in the string length
BUGFIX: SDK: for 16bit segmented memory, ida would set incorrect value for eip after a breakpoint (visible with third-party 16bit debugger plugins)
BUGFIX: SDK: open_hexdump_window() didnβt work in GUI version
BUGFIX: SDK: patch_word()/patch_long() did not work properly if the new value had some bytes matching the database
BUGFIX: set_offset_ex() with RVAOFF could fail randomly
BUGFIX: some symbian sisx files could not be loaded (ida crashed)
BUGFIX: some undefined types referenced by name were imported as βvoidβ
BUGFIX: structure alignment was sometimes wrong in types created by the pdb plugin
BUGFIX: structures with arrays of structures should not be displayed in terse form
BUGFIX: Symbian: file names in embedded sis files were displayed incorrectly
BUGFIX: the horizontal scrollbar in disassembly views was handled incorrectly
BUGFIX: tms6 module was incorrectly commenting branch/call targets under linux
BUGFIX: type system was not adding comments for arguments that were handled from generic code (gen_use_arg_types())
BUGFIX: u2cstr() was returning a string with an extra terminating zero which was included in the string length
BUGFIX: UI: ida could display βAccess deniedβ message when running in a remote desktop session and the session was minimized or closed
BUGFIX: unicode support in the mac version of ida was broken
BUGFIX: unix implementation of qsem() functions could crash on NULL pointer
BUGFIX: unpatched PIC GOT32/GOTOFF relocations were handled incorrectly
BUGFIX: validate_tofs() could not handle variable sized structures. modifying a byte of a variable sized structure could lead to interrs.
BUGFIX: win32 debugger would freeze trying to attach to a crippled program that would generate exceptions during attaching
BUGFIX: win7 rc has a hardcoded int3 instruction in LdrpDoDebuggerBreak() instead of a call to DbgBreakPoint() and IDA stops on it
BUGFIX: wince debugger could not attach to an already running process if the βdebugger->process options->input fileβ was specified
BUGFIX: WinCE debugger module could hang in some cases if ida_kdstub.dll was missing from IDA directory and the PocketPC
BUGFIX: wince debugger was causing system wide memory leaks on the PDA
BUGFIX: windbg debugger module (kernel mode) generates duplicate debug names each single step
BUGFIX: windbg debugger module was not enabled for drivers
BUGFIX: windbg was reverting the debugging tools path to the default at each process start
BUGFIX: wrong types with circular dependencies could crash ida (like typedef x x;)
Welcome to the IDA v5.5 comparison page! Below you will find side-by-side comparisons of IDA v5.4 and v5.5 disassemblies. Please maximize the window too see both columns simultaneously.
The following original exhibits are displayed on this page:
ARM: support for SUB Rx, R11, #fpoff stack variable references
ARM: floating-point constants in instructions
ARM: type info and argument names
ARM: simplified instructions
ARM: support for more switch idioms
PDB: function argument names
MIPS: much improved analysis
NOTE: these are just some selected examples, that can be illustrated as a side-by-side difference. IDA v5.5 includes are many other improvements and new features that are not mentioned on this page β simply because there was nothing to compare them with. For more information, please refer to .
ARM: support for SUB Rx, R11, #fpoff stack variable references
Please note that more stack variable references have been recognized. Previous versions of IDA could not handle negative stack offsets.ARM: floating-point constants in instructions
The code on the right is more readable, isnβt it?ARM: type info and argument names
We made numerous tiny improvements to the analysis engine. The above example illustrates just one particular case: function arguments that are passed by references are handled more properly. While there are lots of similar examples, we will limit ourselves to this single snippet. Anyway, you get the ideaβ¦ARM: simplified instructions
More instructions are simplified to MOVβs β easier to read.ARM: support for more switch idioms
This example illustrates analysis of TBB/TBH instructions.PDB: function argument names
Check the function prototype: IDA now knows about the exact locations of all input arguments and can propagate them through the database. The previous prototype can be even called misleadingβ¦MIPS: much improved analysis
This sample is very spectacular: we switch from inhuman names and hex addresses to a highly readable code. The transition is possible because we handle handle dynamic symbols in MIPS ELF files and improved the MIPS module in many ways.
; ββββββββββββββββββββββ SUB R0, R11, #-var_94 LDR R1, [R11,#var_58] BL _ZN6HBufC83DesEv ; HBufC8::Des(void) SUB R3, R11, #-var_94 SUB R0, R11, #-var_4C MOV R1, R3 LDR R2, [R11,#var_5C] LDR R3, [R11,#var_60] BL _ZNK6TDesC83MidEii ; TDesC8::Mid(int,int)
; ββββββββββββββββββββββ loc_30071630 ; CODE XREF: _log1pf+12Cj FLDS S14, =2.0 FLDS S13, =0.14798 FLDS S12, =0.15314
; ββββββββββββββββββββββ ADD R3, SP, #0x4B4+phkResult LDR R0, [SP,#0x4B4+hKey] ; hKey STR R3, [SP,#0x4B4+dwInitParam] ; phkResult MOV R2, #0 ; ulOptions MOV R3, #0 ; samDesired ADD R1, SP, #0x4B4+SubKey ; lpSubKey BL RegOpenKeyExW LDR R3, [SP,#0x4B4+phkResult]
; ββββββββββββββββββββββ MOVS R1, R6 MOVS R3, R4 MOVS R0, R5 MOVS R2, #2 BLX j____dtoa LDR R3, =0x270F MOVS R6, R0
CMP R4, #6 ; switch 6 cases BCS loc_46CD0A ; default ; jumptable 0046CC5E case 0 TBB.W [PC,R4] ; switch jump ; ββββββββββββββββββββββ jpt_46CC5E DCB 0x54 ; jump table for switch statement DCB 0x17 DCB 3 DCB 0x1E DCB 3 DCB 6 ; ββββββββββββββββββββββ loc_46CC68 ; CODE XREF: sub_46CC38+26j UXTH R4, R1 ; jumptable 0046CC5E cases 2,4 MOV R6, R0 B loc_46CC7C ; ββββββββββββββββββββββ loc_46CC6E ; CODE XREF: sub_46CC38+26j LDRB R0, [R5] ; jumptable 0046CC5E case 5 MOV R6, LR
; =============== S U B R O U T I N E ============================= ; Attributes: bp-based frame ; int __usercall genfname<eax>(char *fname<ecx>, unsigned int fnameSize, unsigned int tmp_max) genfname proc near ; CODE XREF: __tmpnam_helper+6Ep ; __tmpfile_helper+119p β¦ pext = byte ptr -0Ch var_4 = dword ptr -4 fnameSize = dword ptr 8 tmp_max = dword ptr 0Ch fname = ecx push ebp mov ebp, esp sub esp, 0Ch mov eax, ___security_cookie xor eax, ebp mov [ebp+var_4], eax push ebx push esi push edi mov edi, fname push 2Eh ; c push edi ; str call __mbsrchr mov esi, eax push 20h ; ibase xor ebx, ebx inc esi push ebx ; endptr push esi ; nptr call _strtoul
; ββββββββββββββββββββββ la $t9, get_terminal_width_height move $a0, $0 addiu $a1, $sp, 0x40+var_28 jalr $t9 ; get_terminal_width_height move $a2, $0 lw $gp, 0x40+var_30($sp) lw $v1, 0x40+var_28($sp) la $v0, bb_msg_full_version la $a0, 0x460000 la $t9, printf addiu $v1, β0x14 lw $a1, (bb_msg_full_version β 0x463E8C)($v0) sw $v1, 0x40+var_28($sp) jalr $t9 ; printf addiu $a0, (aSUsageBusyboxF β 0x460000) # β%s\n\nUsage: busybox [function] [argumentββ¦ lw $gp, 0x40+var_30($sp) la $v0, 0x460000 la $t9, printf addiu $s4, $v0, (asc_45AB68 β 0x460000) # β\tβ la $v0, 0x460000 la $s1, applets la $s6, 0x460000 la $s5, 0x460000 move $s2, $t9 b loc_406644 addiu $s3, $v0, (asc_45EEA8 β 0x460000) # β, β