IDA 4.9SP
Major features
Introduction of the debugger for Windows CE 5.0 for customers of the Windows CE/ARM Remote debugging module.
Bug Fixes
The 'Window popup' keyboard key (F10) was not working in the disassembly listing window
COM files were loaded at the segment 0 which made impossible to add PSP
64-bit debugging could fail with latest version of Windows XP Professional x64 Edition
address expressions containing middle spaces were not parsed correctly in the 'jump to address' command.
Alt-K was not closing dialog forms anymore
AMD64: 16bit instructions with 66 prefix which are 64-bit by default were disassembled with the 66 prefix in a separate line
any IDC error before a function definition might cause an access violation.
ASCSTR_C was missing in idc.idc
TMS320C55 binaries were loaded in little-endian mode; coff files were loaded correctly
changing the target assembler could lead to a crash if the comment sequences for the current and new assemblers were of different length
comments at the end of line in plugins.cfg were causing syntax errors
the operand size of cwde was wrong (not visible in the listing)
calling a synchronous command from a debugger notification handler was cancelling the eventual current asynchronous command.
debugging for WinCE: if the input file was not present on the device and IDA proposed to copy it, and the user accepted, then the startup directory parameter would be set wrongly to the input file name. This does not really matter since this parameter was not used in WinCE (it has no concept of the current directory)
deleting the last entries from the sorted problem list could cause an internal error.
DelFunction(ea) where ea is not equal to the function beginning was not deleting the function from the list but was deleting the function description
DLL rebasing was not working when attaching to a process
create_flow_chart() could display wrong graph because function tail iterators could become invalid after several calls to the kernel. A workaround for this has been added in the form of reset_func() function
gui: some options set in the classic 'load file' were not taken into account.
The CommentEx() IDC function help page was wrong.
The help pages erroneously stated that win32_remote uses -p switch for the password. It is -P.
hex views and watches were not refreshed in the debugger
IBM PC pop instruction was never using 'small' keyword
IDA could endlessly loop during final pass of the analysis
IDA was unable to copy the debugger server to WinCE 5.0 because this OS requires the numberOfWritten bytes parameter to CeWriteFile to be non zero
IDA up to 4.9 was not saving ARM specific options in the database. The problem has been corrected the old databases use the default settings from the configuration files (as before)
IDA was loading M68K COFF files with wrong byte endianness
IDA was not automatically loading PDB information for 64-bit PE files (manually loading them was working)
IDA was not aware that in the Watcom __fastcall calling convention a stack parameter prevents the remaining parameters to be passed in the registers
IDA would complain that some manual operands did not match the original operand value
ida_kdstub.dll was missing in the arm debugger
idagui.cfg was missing some hotkey definitions
IDC: it was impossible to use Comment() and RptCmt() functions
IDC: SetDefReg() was truncating the register value to be 16-bits
if the user refused to upgrade his database, temporary files were not deleted
The input fields of the 'user defined offset' dialog box were cleared each time - this made it more difficult to use.
It was impossible to delete the type of an unnamed item.
It was impossible to patch an uninitialized byte with 0xFF
It was impossible to start the debugger for a remote file with full path because the input file path would be stripped away
The M68K module was erroneously complaining about missing names for near typed references
The MIPS HI16 relocation was not handled properly in some cases. This fix is a best guess.
The navigation band range was not refreshed when one database was closed and another opened
NTSTATUS error codes were missing in ntddk.til and wdm.til
PC: 8F D8 was incorrectly disassembled as an instruction; it is an invalid opcode
PC: memory operand of "mov mem, segreg" is always 16-bit
PC: movsxd instruction was disassembled as movsx (the difference is important for 16- bit source operand)
PC: xchg rax, r15 was disassembled incorrectly
The PE header segment would also contain the contents of the first segment.
The PE loader could cause an access violation if the input file had wrong debug information offset.
The PPC module was sign extending absolute addresses to 64-bit in the 64-bit version of IDA
pro.h could not be used with VS2005
processor specific options were not always correctly saved into the database
rebasing the program could lead to access violations
SDK: qvector assign() method was incorrect
SDK: select_thread() was not working if called from a debugger notification handler
segment names were not recognized in the 'jump to address' command
struct and member repeatable comments were not displayed in structure variable definitions
SUPER10: all jmpt instructions were disassembled with cc_UC condition
The confirmation dialog box was not resized correctly for big fonts; the same problem with the chart builder plugin
The exception code in the 'edit exception' dialog box was displayed incorrectly
The types of local names were not displayed in the listing
Unloading type information from the database to an idc file could produce wrong idc file in some cases (structure members of enum type would not have the closing quote after the enum name)
the vc8extra.sig was named "VC7 Extra (technology) library"
Very long comments (>1KB) were not correctly displayed
Visual Studio 'vftable' mangled names were demangled incorrectly
When converting operand types IDA was not considering ds:### numbers as immediate values which for example could lead to a strange selection of structure offset fields
When detaching the debugger from a process ida would presume that detaching failed and not switch to normal desktop
xrefs from structure instances to structure type definitions were not created for terse structures
Last updated
