LogoLogo
IDA 9.1
IDA 9.1
  • Welcome to Hex-Rays docs
    • What's new?
  • Getting Started
    • Install IDA
    • Licensing
    • Basic Usage
    • What's next?
  • User Guide
    • User Interface
      • Menu Bar
        • File
          • Load file
          • Script File
          • Script command
          • Produce output files
          • Invoke OS Shell
          • Take database snapshot
          • Save database
          • Save database as...
          • Abort IDA
          • Exit IDA
        • Edit
          • Export data
          • Undo an action
          • Redo an action
          • Clear undo history
          • Disable undo
          • Convert to instruction
          • Convert to data
          • Convert to string literal
          • Convert to array
          • Undefine a byte
          • Give Name to the Location
          • Operand types
            • Offset
            • Number
            • Perform en masse operation
            • Convert operand to character
            • Convert operand to segment
            • Complex Offset Expression
            • Convert operand to symbolic constant (enum)
            • Convert operand to stack variable
            • Change operand sign
            • Bitwise negate operand
            • User-defined operand
            • Set operand type
          • Comments
          • Functions
          • Structs
          • Segments
          • Patch core
          • Other
            • Rename Any Address
          • Plugins
        • Jump
          • Center current line in window
          • Problems List
        • Search
          • REGULAR EXPRESSION SYNTAX SUMMARY
        • View
          • Open subviews
          • Graphs
          • Arrows window
          • Database snapshot manager
          • Highlighting identifiers
          • Browser options
          • Lumina options
          • Assembler level and C level types
          • C++ type details
          • Bookmarks window
          • Calculator
          • View segment registers
          • View Internal Flags
          • Hide
          • Unhide
          • Del hidden range
          • Hide all items
          • Unhide all items
          • Setup hidden items
        • Debugger
          • Debugger window
          • Process Control
            • Start process
            • Process options
            • Pause process
            • Terminate process
            • Step into
            • Step into (backwards)
            • Step over
            • Step over (backwards)
            • Run to cursor
            • Run to cursor (backwards)
            • Run until return
            • Attach to process
            • Detach from process
            • Set current ip
            • Show application screen
          • Breakpoints
          • Watches
          • Tracing
          • Source code view
            • Watch view (source level)
          • Process Memory
            • Take memory snapshot
            • Manual memory regions
            • Refresh memory
          • Thread list
          • Module list
          • Stack trace
          • Exceptions
          • Debugger options
          • Switch debugger
        • Lumina
        • Options
          • Low & High Suspicious Operand Limits
        • Windows
          • Rename a stack variable
          • Miscellanous Options
          • Environment variables
          • Reset Hidden Messages
          • Various dialog help messages
          • Output window
        • List of all menu options
      • Desktops
      • Command line
      • License Manager
      • How To Use List Viewers in IDA
      • Database conversion from idb to i64
    • Disassembler
      • Interactivity
      • Background Analysis
      • Graph view
        • Graphing tutorial
      • Proximity view
      • Navigation
        • Anchor
        • How to Enter a Segment Value
        • How to Enter a Number
        • How to Enter an Identifier
        • How to enter text
        • How to Enter an Address
      • Disassembly Gallery
        • Philips 51XA-G3
        • 6502 and 65C02 Disassembler
        • 6301, 6303, 6800, 6801 and 6803 Disassembler
        • 68040, Amiga
        • 6805 Disassembler
        • 6808 Disassembler
        • 6809 OS9 Flex Disassembler
        • 6809 Disassembler
        • 6811 Disassembler
        • 68HC12 Disassembler
        • 68HC16 Disassembler
        • 68k Amiga Disassembler
        • 68k Mac OS
        • 68k Palm Pilot
        • Unix COFF
        • NEC 78k0 and 78k0s Processor
        • 80196 Processor
        • 8051 Disassembler
        • Analog Devices 218x.
        • Alpha Processor – NT COFF
        • Alpha Processor – Unix ELF
        • Android ARM Executables (.elf)
        • ARC Processor
        • ARM Processor EPOC App
        • ARM Processor EPOC PE File
        • ARM Processor EPOC ROMFile
        • EPOC SIS File Handler
        • ARM Processor iOS (iPhone): Unlock
        • ARM Processor iOS (iPhone): Objective-C metadata
        • ARM Processor iOS (iPhone): Objective-C Instance variables
        • ARM Processor iOS (iPhone): Parameter Identification & Tracking (PIT)
        • ARM Processor iOS (iPhone): Start
        • ARM Processor iOS (iPhone): Switch statements
        • ARM Processor iOS (iPhone): C++ signatures
        • ARM Processor iOS (iPhone): Write
        • ARM Processor: Linux ELF
        • ARM Processor: AOF SDK
        • ARM Processor: Windows CE COFF Format
        • ARM Processor: Windows CE PE Format
        • ATMEL AVR Disassembler
        • C166 Processor
        • C166 Processor with ELF file
        • Rockwell C39
        • Microsoft .NET CLI Disassembler. VisualBasic library
        • CR16
        • Android Dalvik Executables (.dex)
        • Microsoft .NET CLI Disassembler
        • DSP56K
        • Fujitsu FR (.elf)
        • Gameboy
        • H8 300: COFF FILE Format
        • H8 300s: COFF FILE Format
        • H8 500
        • HPPA Risc Processor: HP-UX SOM
        • i51
        • i860
        • Intel i960
        • Intel IA-64 (Itanium)
        • Java Bytecode
        • Angstrem KR 1878
        • Renesas/Hitachi M16C
        • Renesas/Hitachi M32R
        • M740
        • M7700
        • M7900
        • MIPS Processor: Nintendo N64
        • MIPS R5900 Processor : Sony bin
        • MIPS Processor: Sony ELF
        • MIPS Processor: Sony PSX
        • MIPS Processor: Sony PSX
        • MIPS Processor: Unix COFF File Format
        • MIPS Processor: Unix ELF File Format
        • MIPS Processor: Windows CE PE File Format
        • MIPS Processor: Windows CE PE2 File Format
        • Panasonic MN102
        • Atmel OAK DSP
        • 80×86 Architecture: DOS Extender
        • 80×86 Architecture: Watcom Runtime
        • 80×86 Architecture: Geos APP
        • 80×86 Architecture: Geos DRV
        • 80×86 Architecture: Geos LIB
        • 80×86 Architecture: GNU COFF Format
        • 80×86 Architecture: OS/2 Linear Executable Format
        • 80×86 Architecture: Netware NLM
        • 80×86 Architecture: QNX Executable
        • 80×86 Architecture: Watcom Runtime
        • 80×86 Architecture: Windows OMF
        • 80×86 Architecture: Windows Portable Executable Format
        • 80×86 Architecture: Windows Virtual Device Driver
        • 80×86 Architecture: Windows 16 bits DLL
        • X-Box Disassembler
        • PDP 11: SAV File
        • PIC
        • PIC 12xx
        • Power PC AIF ECOFF file Format
        • Power PC Linux ELF
        • Mac OS PEF File
        • Mac OS X File
        • Windows NT PE File
        • Hitachi SH-1 Processor
        • Hitachi SH-3 Processor: Windows CE COFF format
        • Hitachi SH-3 Processor: Windows CE PE format
        • Hitachi SH-4 Processor: ELF File Format
        • Hitachi SH-4 Processor: Windows CE PE File Format
        • Super Nintendo Entertainement System (SNES)
        • SPARC Solaris COFF
        • SPARC Solaris ELF
        • SPARC Sun ELF
        • SPARC Sun ELF SO
        • ST 20C4
        • ST 7
        • ST 9
        • Toshiba TLCS 900
        • TMS 320c2 COFF
        • TMS 320c5
        • TMS 320c54
        • TMS 320c6 COFF File Format
        • TRICORE
        • SunPlus unSP
        • NEC V850
        • Z180 COFF File Format
        • Z380 COFF File Format
        • Z8
        • Z80
      • Supported processors
      • Supported file formats
        • Windmp file loader
      • Bitfields
        • Bit Fields tutorial
      • Structures tutorial
      • Union tutorial
      • Variable length structures tutorial
      • Data types, operands and constructs
      • Packed executables
    • Decompiler
      • Prerequisites
      • Quick primer
      • Exception handler
      • Introduction to Decompilation vs. Disassembly
        • Comparisons of ARM disassembly and decompilation
        • Comparisons of PowerPC disassembly and decompilation
        • Comparisons of MIPS disassembly and decompilation
        • Hex-Rays v7.4 vs. v7.3 Decompiler Comparison Page
        • Hex-Rays v7.3 vs. v7.2 Decompiler Comparison Page
        • Hex-Rays v7.2 vs. v7.1 Decompiler Comparison Page
      • Interactive operation
        • Rename
        • Set type
        • Set number representation
        • Edit indented comment
        • Edit block comment
        • Hide/unhide C statements
        • Split/unsplit expression
        • Force call type
        • Set call type
        • Add/del variadic arguments
        • Del function argument
        • Add/delete function return type
        • Jump to cross reference
        • Jump to cross reference globally
        • Generate HTML file
        • Mark/unmark as decompiled
        • Copy to assembly
        • Show/hide casts
        • Reset pointer type
        • Convert to struct *
        • Create new struct type
        • Split variable
        • Select union field
        • Jump to paired paren
        • Collapse/uncollapse item
        • Map to another variable
      • Batch operation
      • Configuration
      • Third party plugins
      • Floating point support
      • Support for intrinsic functions
      • Overlapped variables
      • gooMBA
      • Failures and troubleshooting
      • FAQ
      • Limitations
      • Tips and tricks
    • Debugger
      • Instant debugger
      • Remote debugging
        • Remote iOS Debugger
        • Android debugger
        • Dalvik debugger
        • Remote GDB Debugger
          • Remote GDB Debugger options
          • Debugging with gdbserver
          • Debugging with VMWare
          • Debugging with OpenOCD
          • Debugging with QEMU
          • External programs and GDB Debugger
          • Debugging code snippets with QEMU
        • PIN debugger
          • Building the PIN tool
          • Connecting a remote PIN tool instance from IDA
          • PIN support for MacOSX
        • Replayer debugger
        • Bochs debugger
          • Bochs Disk Image operation mode
          • Bochs IDB operation mode
          • Bochs PE operation mode
          • Bochs debugger FAQ
      • Local debugging
        • WinDbg Debugger
        • WinDbg: Time Travel Debugging
        • Linux debugger
        • Intel/ARM macOS debugger
      • Debugger tutorials
        • Debugging Dalvik Programs
        • IDA Win32 Local Debugging
        • IDA Linux Local Debugging
        • IDA Linux to Win64 Debugging
        • IDA Win32 to Linux Debugging
        • Debugging Mac OSX Applications with IDA Pro
        • Debugging iOS Applications using CoreDevice (iOS 17 and up)
        • Debugging iOS Applications with IDA Pro
        • Debugging Linux Applications locally
        • Debugging Linux/Windows Applications with PIN Tracer module
        • Debugging Windows Applications with IDA Bochs Plugin
        • Debugging Windows Applications with IDA WinDbg Plugin
        • Using the Bochs debugger plugin in Linux
        • Debugging Windows Kernel with VMWare and IDA WinDbg Plugin
        • Debugging Linux Kernel under VMWare using IDA GDB debugger
        • Windows Debugger Hub
        • Linux Debugger
        • Debugging a Windows executable locally and remotely
        • Debugging the XNU Kernel with IDA Pro
        • Remote debugging with IDA Pro
        • IDA Scriptable Debugger: overview
          • IDA Scriptable Debugger: scriptability
        • Debugging code snippets with QEMU debugger (a la IDA Bochs debugger)
        • Trace Replayer and managing traces
        • Using IDA Pro's tracing features
        • Working with PIN
        • Appcall
    • Creating Signatures
      • FLIRT
        • IDA F.L.I.R.T. Technology: In-Depth
        • Generate FLIRT signature file
        • Supported Compilers
          • Turbo Pascal
          • Delphi
      • Makesig
    • Types
      • Creating Type Libraries
        • IDAClang
        • TILIB
    • Configuration
      • Configuration files
      • Command line switches
      • Keyboard macros
      • UI/Fonts/Themes
      • Shortcuts
      • Customizing IDA
      • CSS-based styling
    • Teams
      • Diffing and Merging Databases with IDA Teams
      • Teams lc command reference manual
      • hv command reference manual
      • Hex-Rays Vault’s visual client user manual
    • Lumina
      • lc command reference manual
    • Plugins
      • Plugin options
      • Plugins shipped with IDA
        • Swift plugin
        • Golang plugin
        • Rust plugin
        • picture_search
        • Objective-C Analysis Plugin
        • DYLD Shared Cache Utils
        • Borland RTTI descriptors plugin
        • DWARF plugin
        • Patfind plugin
        • IDA Feeds
          • FLIRT Signature Bundle
      • Publishing your plugins
    • Helper Tools
    • idalib
    • Third-Party Licenses
      • Apache License for Ghidra
      • Apache License for LLVM
      • Common Public License Version 1.0
      • APPLE PUBLIC SOURCE LICENSE
      • PCRE2 LICENCE
      • GNU Lesser General Public License v2.1 for libiberty
    • Floating licenses
  • Developer Guide
    • C++ SDK
      • Getting Started
      • Reference
      • Using the Decompiler SDK: Decompiler plugin
      • Examples
      • How to create a plugin?
      • Porting Guide from IDA 8.x to 9.0
    • IDAPython
      • Getting Started
      • Reference
      • Examples
      • How to create a plugin?
      • Porting Guide from IDA 8.x to 9.0
    • IDC
      • Core concepts
        • Expressions
        • Statements
        • Functions
        • Variables
        • Constants
        • Exceptions
        • Classes
        • Predefined symbols
        • loader_input_t class
        • Slices
      • Reference
      • Examples
        • Analyzing encrypted code
  • Admin Guide
    • Lumina server
    • Teams server
    • License server
      • Hex-Rays License Server Migration Guide
      • Hex-Rays License Server on WSL
  • Release Notes
    • IDA 9.1
    • IDA 9.0sp1
    • IDA 9.0
    • IDA 8.5
    • IDA 8.4sp2
    • IDA 8.4sp1
    • IDA 8.4
    • IDA 8.3
    • IDA 8.2sp1
    • IDA 8.2
    • IDA 8.1
    • IDA 8.0sp1
    • IDA 8.0
    • IDA 7.7sp1
    • IDA 7.7
    • IDA 7.6sp1
    • IDA 7.6
    • IDA 7.5sp3
    • IDA 7.5sp2
    • IDA 7.5sp1
    • IDA 7.5
    • IDA 7.4sp1
    • IDA 7.4
    • IDA 7.3
      • IDA 7.3 Undo: IDA can do it
    • IDA 7.2
      • IDA 7.2 The Mac Rundown
    • IDA 7.1
      • IDA 7.1 Debugger API 7.1 Porting Guide
    • IDA 7.0sp1
    • IDA 7.0
      • Internationalization (i18n)
      • Automatic discovery of string literals
      • API 7.0 Porting Guide
      • IDAPython backward compatibility
    • IDA 6.95
    • IDA 6.9
    • IDA 6.8
    • IDA 6.7
    • IDA 6.6
    • IDA 6.5
    • IDA 6.4
    • IDA 6.3
    • IDA 6.2
    • IDA 6.1
    • IDA 6.0
    • IDA 5.7
    • IDA 5.6
    • IDA 5.5
      • 5.5 Gallery
      • 5.5 Comparison
    • IDA 5.4
    • IDA 5.3
    • IDA 5.2
    • IDA 5.1
    • IDA 5.0
    • IDA 4.9SP
    • IDA 4.9
    • IDA 4.8
    • IDA 4.7
    • IDA 4.6
    • IDA 4.x
    • IDA 3.x
    • Cumulative bugfix for IDA
  • Archive
    • IDA’s Windbg plugin
    • IDA’s Bochs debugger plugin
    • IDA’s Bochs debugger plugin 2
    • DosWin32
    • Hex-Rays v1.1 vs. v1.0 Decompiler Comparison Page
    • Hex-Rays v1.2 vs. v1.1 Decompiler Comparison Page
    • Hex-Rays v1.3 vs. v1.2 Decompiler Comparison Page
    • Hex-Rays v1.6 vs. v1.5 Decompiler Comparison Page
    • Hex-Rays v1.7 vs. v1.6 Decompiler Comparison Page
    • Costly Greetings – An Adventure In Hostile Code Analysis
    • An Adventure In Hostile Code Analysis: Description
    • An Adventure In Hostile Code Analysis: Disassembly
    • Improved code flow analysis
    • Program Navigation Bar
    • IDA Home Contest
    • Pimp My IDA: vote results
    • Turning off IDA 6.x compatibility in IDAPython
    • Porting guide for IDA 7.4 turning off IDA 6.x API backwards-compatibility by default
    • Porting guide for IDA 7.4 IDAPython and Python 3
    • IDAPython and Python 3
    • Porting guide for changes in IDAPython-on-Python-3 APIs
    • Debugging iOS Applications With IDA
    • IDA Win32 to Win32 Debugging
    • IDA Win32 to Win64 Debugging
    • Legacy license server: Floating Licenses
      • Installing on Linux
      • Installing on Windows
      • Installing on OS X
    • Decompiler Installation
    • Enumerated types tutorial
  • Bug Bounty
Powered by GitBook
LogoLogo

Need Help?

  • FAQs
  • Support

Community

  • Forum
  • Plugins

Resources

  • Blog
  • Download center

© 2025 Copyright Hex-Rays

On this page

Was this helpful?

Export as PDF
  1. Release Notes

IDA 5.5

Last updated 2 months ago

Was this helpful?

Highlights

Finally! Finally we drop the MDI user interface and switch to dockable windows. They are simpler to use, more flexible, waste less screen space. Well, you know it yourself. The new interface also includes the improved hex viewer and stack view. The new hex view is much easier to use, can display the data in various formats, allows editing in-place. There is a lot to discover, some screenshots can be checked in the .

Probably the fastest thing to do is to visit the for more detail about processor modules. In the endless pursuit to improve the disassembly output, we continue to add new methods, tricks, and heuristic rules to IDA. This time the biggest changes are in the ARM and PC modules. The ARM module handles the stack frame, type information, call/jump instructions better than before. The PC module knows about more code patterns, like switch and position-independent code idioms, detects more exception handlers, etc.

Naturally, after adding Windbg support in v5.4, we had to add support for crash dumps. Just specify a crash dump file as the input file and IDA will create a database from it. The debugger can be ‘launched’ to enter the familiar debugger environment with module, thread, and stack windows, where information can be retrieved the usual way. The only thing you cannot do is to resume the execution, that would be an overkill 😉

The previous addition required a big, hopefully invisible, change in the kernel, because the existing storage method could not handle huge gigabyte segments. Previous versions of IDA had a hard limit on the addressing space of the program: max 256MBytes in the default configuration. Modern programs routinely allocate much bigger memories, so we had to find a solution. Now, if a crash dump segment is bigger than a certain size, IDA automatically chooses the sparse storage method. Instead of storing information about every single byte of the program, IDA remebers only useful information. Thus, a 25MB uninitialized array requires just a few bytes of storage to describe it, not 100MB as before.

We would also explicitly mention and say ‘thank you’ to the users who contributed to this release of IDA. Bernhard Mueller from SEC Consult GmbH was very kind to investigate why the Symbian debugger was failing on new devices and contributed an improvement. Robert Krkic generously shared his IDS files for Symbian systems with all IDA users. Thank you guys, your contributions make IDA better and easier to use!

Do you remember that you can add emulated API functions to the Bochs debugger? Just provide an implementation in IDC/Python/C++ and your function is called. For example, you could provide an implementation of the socket() function that would open a socket on the host system or do something else. While this possibility is very useful and remains in place, we added more predefined functions. Now the Visual Studio and Borland C/C++ startup code can be executed without generating exceptions and you can focus on the ‘real’ code.

In addition, we also added the ‘Bochs rc file loader’. It really helps if you already have a bochsrc file and want to debug it with IDA. Just specify it as the input file and IDA will create a nice database for you. No need to create a dummy database, populate it with the code from the boot sector, etc.

Other, probably less visible, improvements include the PDB plugin, the type system, more SDK functions (check out the exec_request_t if you develop multithreaded plugins), etc. The full list is below:

Changelist

Processor Modules

  • PC: added detection of CException destructor; this helps to detect exception handlers and ignore them during function epilog analysis

  • PC: added support for another variation of PIC code by GCC

  • PC: more switches recognized in unoptimized MSVC code

  • ARM: added support for SUB Rx, R11, #fpoff stack variable references

  • ARM: added support for switches implemented using TBB/TBH instruction

  • ARM: better detection of R7-based frames

  • ARM: LDMED can be used for return too

  • ARM: type info and argument names are propagated for local variables passed by reference

  • ARM: other unspecified improvements (we removed them to keep the list short and more readable)

  • ARM: LSL Rx, Ry, #0 and ADD Rx, Ry, #0 are simplified to

  • I51: i/o port names are accepted for all segments (before only FSR definitions were handled)

  • MIPS: of ELF files

  • SuperH: simplified display of pc-relative literal loads

File Formats

  • BOCHRC file loader: it is now possible to start IDA with a bochsrc file as the input file

  • CRASH DMP file loader: it is now possible to start IDA with an MS Windows Crash dump file

  • COFF: segment permissions are imported for MS object files

  • ELF: accept PPC64 ELF files

  • ELF: handle dynamic symbols in MIPS files

  • ELF: some new SuperH relocations are supported

  • ELF: added support for ARM TLS relocations

  • EPOC: added support for multiple imports with the same ordinal

  • EPOC: user contribution: ids files for epoc6/9 from Robert Krkic

  • EPOC: since AppTRK does not report thread creation/deletion, IDA forcibly refreshes the thread list if an unknown thread id is encountered

  • PDB: added the possibility to manually load a specific PDB file; to load only types from the PDB

  • PDB: added support for anonymous unions. types with bitfields are handled more correctly: we replace them with a corresponding POD type; ida kernel cannot handle bitfields yet

  • PDB: added support for undefined enum types

  • PDB: better handling of C++ static methods and functions returning complex types.

  • PDB: better handling of string literals (??_C@…)

  • PDB: information about function argument names is applied, if available in the .pdb file

  • PDB: symbols can be loaded using EXE headers in the database, either from the module list during debugging or via File menu by specifying a valid base address

  • PE: added an option in pe.cfg to force loading of all PE file sections (usually .reloc and similar sections are skipped)

  • PE: if import and/or export tables lie outside .idata segment, they are parsed and formatted

Kernel

  • Added some common C++ ABI functions to noret.cfg

  • Added support for __usercall functions with variable number of arguments (…)

  • Added functions to handle floating point instructions for the decompiler

  • Improved the browsing speed for big databases when autoanalysis is busy: moving around in huge databases is much better

  • Demangler: added support for the latest gcc4

  • Updated WinCE ARM ids files to Windows Mobile 6.0

Scripts & SDK

  • IDC: added MoveSegm() and RebaseProgram() functions

  • IDC: added OpFloat() function

  • IDC: renamed segment modification functions to start with a verb. Old names continue to be available.

  • SDK: added append_buf() and unpack_buf(), append_obj() and unpack_obj()

  • SDK: added build_anon_type_name()

  • SDK: added build_func_type() to facilitate building of type strings that represent functions

  • SDK: added callbacks to AskUsingForm so that the dialog can be modified on the fly

  • SDK: added change_storage_type() to change the storage method of arbitrary address range. please note that the sparse storage method works well only with uninitialized areas with huge objects

  • SDK: added floating point conversion functions for 64bit values

  • SDK: added functions for working with imports (enum_import_names and others, see nalt.hpp)

  • SDK: added get_zero_areas() to retrieve info about huge zero inited ranges

  • SDK: added exec_request_t – class that allows for code execution in the main thread from any other thread

  • SDK: added more convenient areacb_t::for_all_areas2(), which accepts a functor instead of (function,data) pair

  • SDK: added qlist compiler-independent template

  • SDK: added qthread_self()

  • SDK: added set_process_options() to set debugger process options

  • SDK: added ui_enable_input_hotkeys notification to let plugins temporary disable alphanumeric hotkeys which can interfere with user input

  • SDK: added replace_wait_box()

  • SDK: added DBGINV_REDRAW bit to refresh the user interface while invalidating the debugger caches

  • SDK: bitfield definitions in type strings have been changed. since there was no support for bitfields in the parser, this change should not affect anybody

  • SDK: introduced dt_ldbl to represent long double types. long double is different from tbyte and can be 8,10,12, or 16 bytes depending on the compiler

  • SDK: is_sp_based() can now return information about operands which are substracted from stack pointer

  • SDK: patch_byte() and similar functions return success if they succeed in modifying either process memory or idb. before they were returning true only if both process memory and idb were modified

  • SDK: windbg kernel mode: added notion of virtual threads

User Interface

  • UI: it is possible to add several types at once from the local types list (previously only the first one was added)

  • UI: it is possible to delete segment register change points from the “Jump to segment register” dialog or “Segment registers” view

  • UI: it is possible to set the base for array indexes display (decimal, hexadecimal, octal or binary)

  • UI: hex view supports in-place editing, various data formats and unicode strings

  • UI: unicode strings: unprintable characters are grouped into arrays; extra trailing zeroes are omitted by default

Debugger

  • breakpoint condition is evaluated only after the breakpoint is hit

  • Symbian: added support for new AppTRK v3.0.8 (thanks to Bernhard Mueller from SEC Consult GmbH)

Bugfixes

  • BUGFIX: ‘move segment’ command could affect segments outside of selection

  • BUGFIX: ‘search for immediate’ would ignore unexplored dword values (except in some very rare cases)

  • BUGFIX: “load debug info” command was not available from the module list if the database was created by instant debugger

  • BUGFIX: 68K: immediate floating-point operands were displayed incorrectly

  • BUGFIX: 8051: ‘x’ key didn’t work with named bit operands (like P35)

  • BUGFIX: apply_tinfo() could not apply array types correctly; also applying char[] types was not always producing nice results

  • BUGFIX: ARM: some Thumb2 instructions were not decoded

  • BUGFIX: attaching to a process that generates exceptions or any other non-white listed event would still generate an ATTACH event first

  • BUGFIX: autoanalysis could loop indefinitely in some rare cases

  • BUGFIX: bochs could hang while parsing a binary file as bochsrc text file

  • BUGFIX: bochs dbg/rc file selectors were using save dialog and not open dialog

  • BUGFIX: bochs debugger could not handle some malformed PE files

  • BUGFIX: bochs debugger PE files with no sections were handled incorrectly

  • BUGFIX: bochs debugger was not initializing the FPU before running the program

  • BUGFIX: bochs debugger: CR4.bit9 should be set otherwise an invalid opcode will be thrown if a program attempts to use any of SSE{n} instructions.

  • BUGFIX: CodeView debug information was applied to wrong addresses

  • BUGFIX: corrupted epoc executables could not be loaded

  • BUGFIX: deleting a segment from UI sometimes led to deletion of wrong segment

  • BUGFIX: demangler: Visual Age was always interpreted as GNU compiler

  • BUGFIX: ELF: if file had .got.plt section but no .got, IDA did not rename PLT import stubs

  • BUGFIX: equal_types() was considering floating point and integral types of the same size equal

  • BUGFIX: esp alignment in 32-bit programs is only 2 bytes, not 4 bytes (push ax/add esp, 2 are perfectly valid but ida was aligning esp to 4 bytes)

  • BUGFIX: fild/fistp qword operands are marked as floating point doubles

  • BUGFIX: fpval->integer conversion functions were broken since very long time

  • BUGFIX: generating html file with inverted colors would hang ida

  • BUGFIX: GetProcessQty() was failing if called before running the debugger

  • BUGFIX: huge (>2GB) areas could not be displayed in the navigation band in all zoom levels

  • BUGFIX: ida could complain about patched bytes at the start of a debugging session while no bytes had been patched

  • BUGFIX: ida was always asking for a confirmation of array creation if the first byte of the array was unexplored

  • BUGFIX: ida was not using export information from available DLLs due to a logic error in the code

  • BUGFIX: ida was silently failing to use dummy prefixes as new location names; now it displays a correct error message

  • BUGFIX: ida would crash in linux trying to display the debugger specific options dialog box

  • BUGFIX: IDACall GetProcAddress() was returning wrong addresses for forwarded entries

  • BUGFIX: idb2scr() was broken. it was impossible to edit comments with 8-bit ascii characters, the dialog box would display them as garbage

  • BUGFIX: IDC was not comparing floating point with integers correctly

  • BUGFIX: idc: fixed a typo in INF_SIZEOF_LDBL

  • BUGFIX: if attaching to multithreaded application, the thread window would not focus on the current thread (no thread would be selected)

  • BUGFIX: in some cases IDA was still showing the “IDA failed to stop/detach from the debugged program” dialog even if the process was already terminated

  • BUGFIX: in some rare cases IDA could display an exception if “full stack pointer analysis” was enabled.

  • BUGFIX: it was impossible to refuse to import types from local type window to enum/structure windows

  • BUGFIX: it was impossible to debug a dll when two or more dlls of the same name are loaded

  • BUGFIX: it was impossible to suspend a process that keeps on generating masked exceptions.

  • BUGFIX: java module could crash trying to display an automatic comment for a long (multi-line) output

  • BUGFIX: linux debugger could interr if the input file name was incorrect in the process options

  • BUGFIX: long descriptions of local void and typedef types were lacking the ‘typedef’ keyword

  • BUGFIX: LX: some LE files were not completely loaded (if the object’s virtual size was less than the actual size)

  • BUGFIX: mac executables could not be used under Mac OS X 10.3

  • BUGFIX: mac os x debugger could exit with “can’t find dll name” error

  • BUGFIX: mips dmfc1/dmtc1 instructions were not supported

  • BUGFIX: mips module was requiring even fp register numbers for ldc1/sdc1 instructions; removed this limitation

  • BUGFIX: mips: clz/clo/plzcw/movf/movt instructions could not be disassembled in delay slots

  • BUGFIX: move_segm() would rebase offset expressions regardless of the MSF_NOFIX flag

  • BUGFIX: multiple problems with the linux debugger module have been fixed

  • BUGFIX: nlm loader was not populating the imports window

  • BUGFIX: noType() called on a tail byte could corrupt the database

  • BUGFIX: pausing execution in VMWare was reported as an exception

  • BUGFIX: PC: (x64) movq instruction was decoded as movd

  • BUGFIX: PC: fixed occasional inifinite loop during analysis

  • BUGFIX: PC: fpu instructions had wrong values in the dtyp field (fpu reg types are still set to be dt_double, ideally it should be dt_tbyte)

  • BUGFIX: PC: functions with _SEH_prolog were not analyzed properly when using PDB symbols

  • BUGFIX: PC: LAHF/SAHF instructions could not be disassembled in 64-bit mode

  • BUGFIX: PC: operands of the fcompp insn were displayed in reverse order; they are not displayed anymore if they are regular st, st(1)

  • BUGFIX: PC: some one-byte opcodes were decoded incorrectly in 64-bit mode. REX.B was not ignored for opcodes 05, 25 etc

  • BUGFIX: PDB plugin could create a circular dependency in type, which would later crash IDA

  • BUGFIX: PE: imports in files with zero sections were parsed incorrectly

  • BUGFIX: PE: several fixes to handle unusual alignment values (thanks to Ivan Teblin)

  • BUGFIX: PIC files were loaded with 8-bit ‘bytes’ by default

  • BUGFIX: pressing and holding F8 in bochs debugger could lead to a racing condition and deadlock

  • BUGFIX: SDK: c2ustr was returning a string with an extra terminating zero which was included in the string length

  • BUGFIX: SDK: for 16bit segmented memory, ida would set incorrect value for eip after a breakpoint (visible with third-party 16bit debugger plugins)

  • BUGFIX: SDK: open_hexdump_window() didn’t work in GUI version

  • BUGFIX: SDK: patch_word()/patch_long() did not work properly if the new value had some bytes matching the database

  • BUGFIX: set_offset_ex() with RVAOFF could fail randomly

  • BUGFIX: some symbian sisx files could not be loaded (ida crashed)

  • BUGFIX: some undefined types referenced by name were imported as ‘void’

  • BUGFIX: structure alignment was sometimes wrong in types created by the pdb plugin

  • BUGFIX: structures with arrays of structures should not be displayed in terse form

  • BUGFIX: Symbian: file names in embedded sis files were displayed incorrectly

  • BUGFIX: the horizontal scrollbar in disassembly views was handled incorrectly

  • BUGFIX: tms6 module was incorrectly commenting branch/call targets under linux

  • BUGFIX: type system was not adding comments for arguments that were handled from generic code (gen_use_arg_types())

  • BUGFIX: u2cstr() was returning a string with an extra terminating zero which was included in the string length

  • BUGFIX: UI: ida could display “Access denied” message when running in a remote desktop session and the session was minimized or closed

  • BUGFIX: unicode support in the mac version of ida was broken

  • BUGFIX: unix implementation of qsem() functions could crash on NULL pointer

  • BUGFIX: unpatched PIC GOT32/GOTOFF relocations were handled incorrectly

  • BUGFIX: validate_tofs() could not handle variable sized structures. modifying a byte of a variable sized structure could lead to interrs.

  • BUGFIX: win32 debugger would freeze trying to attach to a crippled program that would generate exceptions during attaching

  • BUGFIX: win7 rc has a hardcoded int3 instruction in LdrpDoDebuggerBreak() instead of a call to DbgBreakPoint() and IDA stops on it

  • BUGFIX: wince debugger could not attach to an already running process if the “debugger->process options->input file” was specified

  • BUGFIX: WinCE debugger module could hang in some cases if ida_kdstub.dll was missing from IDA directory and the PocketPC

  • BUGFIX: wince debugger was causing system wide memory leaks on the PDA

  • BUGFIX: windbg debugger module (kernel mode) generates duplicate debug names each single step

  • BUGFIX: windbg debugger module was not enabled for drivers

  • BUGFIX: windbg was reverting the debugging tools path to the default at each process start

  • BUGFIX: wrong types with circular dependencies could crash ida (like typedef x x;)

gallery
comparison page
MOV Rx, Ry
much improved analysis