IDA 7.2
Last updated
Was this helpful?
IDA 9.0sp1
Last updated
Was this helpful?
IDA 7.2.181105 November 5, 2018
Welcome to IDA 7.2!
We have many news this time, but let us start with the most desired and requested one: support for ARM v8.3 instructions. With the advent of the new iPhone XS many reverse engineers started to stumble on these new instructions. Besides, they include a new security mechanism: Pointer Authentication Code. It makes exploiting software vulnerabilities much more difficult but it requires modifications in our file parsing and analysis methods. And yes, the upcoming IDA Pro supports it nicely:
The decompiler supports them too and can show the PAC verifications in the output code as compiler intrinsics, or hide them, which is the default behaviour:
The new iOS 12 dyld caches and kernel caches with tagged pointers are handled nicely too.
When loading an iOS12 kernelcache in IDA 7.1, many pointers lead nowhere and kexts are not detected.
In IDA 7.2, pointers are resolved correctly and kexts are marked up.
Speaking of dyld caches, one of the common complaints we've had that usually you have to choose to load either a complete cache to see all modules (which takes forever), or a single module (and see pointers leading nowhere when they point to other, unloaded modules). We've tried to address it with the "load module with dependencies" option but it turned out to be quite limited in practice.
Now you don't have to choose anymore! Even if you load a single module and see a red-colored pointer denoting non-existing memory, just right-click it to load the mising module into the database:
Wait a little for load to finish, repeat as necessary for other addresses:
...and navigate to the destination to continue analysis!
Naturally this only works as long as you still have the original cache file present, but it still should speed up your work.
By the way, for Apple software we also implemented recognition of blocks. We support both global and local (stack based) blocks. The objc plugin parses block descriptors and automatically makes structures representing local context captured by the block. Now the decompiler output looks like this:
In fact there are many other Objective-C improvements, see them all in a submenu:
Note: some of this functionality only works if you have the decompiler for the platform being analyzed.
Our debugger can handle many new OSX and iOS features and can debug iOS 12 applications, including stack unwinding in code using PAC instructions:
For more a more in-depth look at the new mac specific features, see IDA 7.2 - The Mac Rundown.
But enough about Apple. An improvement that Linux and Mac users will love: native support for PDB files. Yes, we implemented a full PDB parser and now IDA on Unix can load information from PDB files without any MS Windows computer. You can even do tricks like
and IDA will automatically download PDB files for you! A screenshot is not descriptive in this case but please note that it was done on Linux:
We use our own PDB parser on all platforms but it is possible to switch back to MS DIA if there is a need.
A completely new processor module for the 16-bit PIC24 and dsPIC processors from Microchip:
It supports PIC24/30/33 series and comes with an extensive configuration file.
We've also extended the classic 8-bit PIC series with support for the "Enhanced Mid-range" (PIC1XF1XXX) instructions. IDA automatically tracks changes to the bank registers made with movlb and movlp, which is useful when analyzing big programs spread over multiple banks.
The NEC 850 processor module has been extended to handle new addressing modes and instructions for V850E2M and RH850 from Renesas. For example, we decode the full set of instructions for working with single- and double-precision floating point:
Many new RH850 instructions such as bit operations or long-range conditional branches are supported as well:
We improved our type system with the notion of a shifted pointer. This notion is useful when a pointer points to the middle of a structure. Now the output looks so neat that one of our users said "__shifted pointers are awesome, Delphi code never looked this sexy!"
The decompiler knows about C++ class hierarchies and virtual functions. We support even multiple (but not virtual) inheritance! The output that looked like this in IDA v7.1:
now looks crystal clear:
Here "C" is a complex class with multiple base classes, which in turn has multiple base classes, etc...
In fact there are tons of other improvements to the decompiler. We plan to prepare a separate web page with more details, but yet one more big improvement deserves mentioning right now. Now the decompiler has a powerful value-range analysis engine. More than that, it can be used from the Decompiler SDK. The value-range analysis improves the decompilation quality and will also be used to improve the analysis performed by IDA. On the left side is the decompiler output of v7.1, on the right side the decompiler output of v7.2:
Among other decompiler improvements: a method to handle multiple stack variables that occupy the same stack slot, better optimization engine, better handling of cast operators, better type derivation, more aggressive C expression simplification, for-loop recognition, many subtle bugs are gone, etc. We hope that working with the decompiler will be more pleasant and seamless.
We also improved the microcode API that was initially published in v7.1. Unfortunately we had to shuffle so many things that the new API is not compatible with the old one but we promise that we will try to keep it stable from now on.
Finally, with IDA v7.2 we introduce a new (experimental) Lumina server. Think of it as about a public storage of popular function patterns. The lumina server holds metadata about functions (like names, comments, prototypes, operand representation, etc). IDA can ask Lumina to recognize functions in the current database and apply the corresponding metadata. It is like FLIRT but it is dynamic, stores more information, and can recognize functions that FLIRT cannot.
(yes, you guessed it right, green means lumina :)
Any user can push information to Lumina. Currently the Lumina database is not very big but we hope it will get populated and become useful very fast. So do not get disappointed too fast if it does not recognize all your standard functions yet, but we will work on it!
Processor Modules
+ 68k: print pc-relative operands with explicit "(pc)" suffix; it seems gas accepts both forms, and having an explicit suffix is a good thing
+ ARC: improved switch recognition
+ ARM : added ARM-v8.3a PAC (Pointer Authentication Code) instructions
+ ARM: added support for A64 basic crypto instructions (AES, SHA1, SHA2)
+ ARM: improve detection of ARM64 imported function stubs in Mach-O and PE binaries
+ ARM: simplify A64 instruction aliases MUL, MNEG, SMULL, SMNEGL, UMULL, UMNEGL
+ DWARF source-level debugging is now availalble on Android platforms
+ H8*: improved switch recognition
+ MC6812: track SP register changes
+ NEC850: added V80E2M and RH850 floating-point instructions (and many others)
+ PIC: added decoding of more 16F1x and 12F1x instructions
+ PIC24: new processor module
+ PC: added yet one more prolog pattern
+ PC: improved detection of 'push ecx' as part of the function prolog
+ PC: reduced number of incorrectly created offset expressions
+ PC: improved recognition of the gcc vararg prolog
+ PIC16: added processor module for PIC24,30,33 families
+ PPC: enhanced switch recognition
+ PPC: improved switch recognition
+ SH3: improved sp analysis
+ SH3: improved switch recognition
+ SPARC: improved switch recognition
+ TMS320C28X: improved switch recognition
+ V850: improved switch recognition
File Formats
+ CLI: corrupted files with bad LUT table can be loaded now
+ DEX: added support for VDEX file format
+ ELF: ability to load external symbols from companion file (even when DWARF info is missing.)
+ ELF: added annotation of NT_PRSTATUS and NT_PRPSINFO notes for core files
+ ELF: added support for packed android relocations (APS2 format)
+ ELF: allow independent loading of PHT and SHT in loader options
+ ELF: detect loading of inconsistent overlapping data from PHT
+ MACHO: allow the user to load a given module from a dyld_shared_cache on-command
+ MACHO: always use segment prefixes for kernelcache files, even when not splitting by KEXTs
+ MACHO: improve XML parsing for __PRELINK_INFO in kernelcache files
+ MACHO: support ARM64_32. only in ida64 (for now)
+ MACHO: support loading of iOS 12 prelinked kernelcaches
+ MACHO: support loading of new dyld cache format for arm64e architecture (e.g. iPhone XS)
+ MACHO: when loading a single dyldcache module, apply the relevant symbols from the cache's symbol table
+ MACHO: store segment protections in the database (previously they were ignored)
+ PE: label guard call check function if present in the load config directory
+ PE: added annotation for IMAGE_DEBUG_TYPE_REPRO
Debugger
+ support debugging on iOS devices with ARMv8.3-A extensions (iPhone XS, XS Max, XR)
+ support watchpoints in the Remote iOS Debugger
+ iOS: improve compatibility with older devices (the oldest we've thoroughly tested is an armv7 iPhone 4 with iOS 6.0.1)
+ dalvik: use "track-jdwp" service instead of "jdwp", it uses more reliable protocol
+ ios_deploy: added "afc" phase
+ ios_deploy: added "battr" phase
+ ios_deploy: added "dattr" phase
+ ios_deploy: added "debug" phase. this allows us to easily troubleshoot issues when launching/attaching to a process
Kernel/Misc
+ CFG: removed obsolete config parameter CHECK_MANUAL_ARGS
+ FLIRT: ICL: Added signatures for icl177 (Intel C++ 17.7)
+ FLIRT: ICL: Added signatures for icl178 (Intel C++ 17.8)
+ FLIRT: ICL: Added signatures for icl182 (Intel C++ 18.2)
+ FLIRT: ICL: Added signatures for icl183 (Intel C++ 18.3)
+ FLIRT: ICL: Added signatures for icl190 (Intel C++ 19.0)
+ FLIRT: VC: Added signatures for vc1413 (Visual Studio 2017.6)
+ FLIRT: VC: Added signatures for vc1414 (Visual Studio 2017.7)
+ FLIRT: VC: Added signatures for ucrt 17134 (Windows 10 April 2018 Update SDK)
+ FLIRT: VC: Added signatures for vc1415 (Visual Studio 2017.8)
+ improved code detection heuristic rules
+ improved sp analysis
+ introduced -8align4 abi option for arm/pc
+ added support for parsing simple c++ classes with virtual functions
+ strlit comments: try to print them even for references to pointers to strings
+ types: improved til <-> IDB structure synchronizing
Objective-C
+ OBJC: added OBJC_LAZY_MODE to objc.cfg, which prevents IDA from parsing objc data at load-time
+ OBJC: allow user to pass options to objc plugin via -Oobjc:
+ OBJC: improve analysis of block functions by detecting Block_layout objects allocated on the stack
+ OBJC: improve type propagation in the pseudocode; specifically across ARC-related functions (objc_retain, objc_retainAutoreleasedReturnValue, etc.)
+ OBJC: introduce submenu for objc features. See Edit>Other>Objective-C
+ OBJC: parse __block_literal_global structures when loading mach-o files
+ OBJC: parse pre-optimized data structures in __objc_opt_ro
+ OBJC: support regular expressions in the selector string for the JumpSelector action
User Interface
+ ui/qt: added the ability to restore custom widgets when a desktop layout is loaded (through the 'ui_create_desktop_widget' notification)
+ ui/qt: added user interface for borrowing and returning floating licenses (available under menu Options-Floating Licenses in floating license IDA versions)
+ ui/qt: any widget that was last closed when floating (alone) and reopened with WOPN_RESTORE will now be restored as a float, in its previous position
+ ui/qt: custom data types & formats registered by the user now appear in the context menu
+ ui/qt: entries in the "Exports" window will now have different icons according to their type (function, data, undefined, ...)
+ ui/qt: in the proximity view, one can now add nodes by from addresses, instead of having access to (non-dummy-) named items only
+ ui/qt: introduced 'get_window_id(const char *name=NULL)' to retrieve the underlying OS-specific window ID
+ ui/qt: some specific floating widgets geometries/positions will now be restored when re-opening (e.g., the "Script snippets")
+ ui/qt: watch views: it was impossible to specify an idc expression as in expressions with a cast: (type)expr
+ ui/qt: when implementing 'ui_get_custom_viewer_hint' in a plugin, it is now possible to ask IDA to inject its "regular" hints anywhere in the returned text
+ ui: "Binary search" now allows tabs instead of spaces, between different items (e.g., 0x89\t0xE5), allowing easier copy-paste from tools such as GDB
+ ui: API: adding navband ea_t <-> pixel conversions
+ ui: added shortcuts Ctrl+Shift+Up/Ctrl+Shift+Down to jump to the start of the previous/next function
+ ui: create segment: if the end address of the segment is not specified, split the segment that is located at the specified start address
+ ui: pressing <Shift+Enter> in "jump" choosers (i.e., Ctrl+P, Ctrl+X, Ctrl+L, Ctrl+E, ...) will jump without closing the chooser, thereby working as a preview/quick navigation
+ ui: show demangled names by default in the module debug name list
+ ui: when a new idb cannot be created because of permissions, propose to create it in the home directory
+ ui: when creating structures from data, the structure will be named "struc_<addr>" (where 'addr' corresponds to the address of the start of the selection), instead of having an unrelated numeric suffix
+ ui: improved application of bitfield enums to operands
Scripts & SDK
+ IDAPython: added Hexrays_Hooks, providing a better abstraction on top of the hexrays_event_t (methods are typed, and bindings are automatically generated, meaning that it'll follow additions to the C++ SDK)
+ IDAPython: all functions not marked as THREAD_SAFE in the C++ SDK, will now check that they are being called from the main thread, avoiding possible corruption or crashes
+ IDAPython: ida_dbg: expose memory_info_t(), meminfo_vec_t(), set_manual_regions()
+ IDAPython: ability to provide user hints for edges of user graphs
+ IDC: added __IDAVER__ as a numeric version number
+ IDC: added debugger registers as variable names
+ SDK: added GN_NOT_DUMMY bit for get_name()
+ SDK: added UTF-8 aware qrmdir()
+ SDK: added calc_func_size()
+ SDK: added idb_event::bookmark_changed
+ SDK: added support for shifted pointers
+ SDK: added the item_color_changed and colee_addr_changed events
+ SDK: append_cmt() does not append the comment if it is already present at the end of the existing comment
+ SDK: deleting a segment register now sends a 'sgr_deleted' event
+ SDK: exported copy_named_type()
+ SDK: renamed regex functions to not conflict with POSIX symbols (qregcomp/qregerror/qregexec/qregfree)
+ SDK: introduced the INSN_64BIT bit
+ SDK: added bitcount()
+ SDK: make request_refresh(), clear_request_refresh() and is_refresh_requested() accept 64-bit masks
Decompilers
+ hexrays: ARM: support RRX addressing mode
+ hexrays: added support for magic divisions in 64-bit code
+ hexrays: added "force new variable" command; it can be used to force the decompiler to create a new aliasable stack variable at the specified location
+ hexrays: added "variable is possibly undefined" warning
+ hexrays: added MAX_STRLIT_LEN configuration parameter
+ hexrays: added a new rule to simplify some ternary operators
+ hexrays: added a new rule: (x ^ y) & 1 => x != y if x,y are booleans
+ hexrays: added hxe_cmt_changed notification
+ hexrays: added logic to remove exception handling code (SjLj)
+ hexrays: exported idaloc2vd and vd2idaloc
+ hexrays: get rid of limitation on number of internal microregisters
+ hexrays: get rid of virtual registers in microoperands
+ hexrays: handle ARMv8.3 Pointer Authentication instructions
+ hexrays: improved handling of some switch idioms
+ hexrays: improved handling of union expressions
+ hexrays: improved propagation of odd parts of constant values
+ hexrays: improved recognizing of register arguments in called functions
+ hexrays: improved function prototype parser: take into account the return type is able to contain parentheses
+ hexrays: improved detection of read-only data in dyldcaches. this can heavily simplify the pseudocode
+ hexrays: slightly improved recognition of magic divisions
+ hexrays: x86: added recognition of gnu mcount()
+ hexrays: calls of virtual functions are decompiled in a nice way
+ hexrays: added support for 64bit character constants
+ hexrays: it was impossible to decompile a call that returns an udt of an odd size (!is_valid_size)
+ hexrays: sdk: added macro HEXRAYS_MEMORY_ALLOCATION_FUNCS() and functions hexrays_alloc/hexrays_free
+ hexrays: sdk: added new flags CVAR_NOPTR, LVINF_NOPTR, use them to indicate that a variable should have a non-pointer type
+ hexrays: sdk: added external blocks (BLT_XTRN). they greatly improve snippet decompilation
+ hexrays: sdk: lvars are taken into account when calculating use/def lists; exported 2 more mlist related functions
+ hexrays: sdk: cleaned up the API; we will try to maintain compatibility from now on
BUGFIXES
BUGFIX: "Produce file > Dump database to IDC file..." would generate IDC scripts whose 'create_strlit' directives had erroneous 'length' parameter
BUGFIX: "Suspend on debugging start" option was broken for GDB-based debuggers
BUGFIX: "ida -B" was not performing the final pass over the input file and this could lead to huge ranges of unexplored bytes in the output listing
BUGFIX: 68K: some Coldfire-specific instructions were not decoded in the "MC68xxx universal emulator" mode
BUGFIX: COFF: some XCOFF64 files could be loaded incorrectly
BUGFIX: Copying to the clipboard from the graph view, could result in text being shifted
BUGFIX: DWARF: C++ exceptions could be issued by the plugin during source-level debugging, and not be caught, causing IDA to exit
BUGFIX: DWARF: Golang types containing readonly or writeonly channels, would be turned into anonymous types
BUGFIX: DWARF: Structures with a variable sized last member consisting of an array of arrays, would fail being properly handled
BUGFIX: EH: parsing of exception data in arm32 Mach-O binaries could produce bogus " bad try block information" warnings
BUGFIX: ELF: ARM: some files with ARM-mode entrypoint could be disassembled incorrectly in Thumb mode
BUGFIX: ELF: loading big-endian ARM files would display "ARM Little-endian" in the "Load file dialog". Similarly, loading little-endian PPC files would show "Power-PC big endian" instead of "Power-PC little endian"
BUGFIX: ELF: parsing SHT_NOTE could yield invalid contents
BUGFIX: GDB: serialized conversation (for troubleshooting purposes) could contain unescaped '\' characters
BUGFIX: GDB: IDA could crash when attaching to gdbserver if the bitness was misdetected
BUGFIX: GDB: some android aarch64 stubs could be misdetected as 32-bit arm
BUGFIX: GDB: when using snippet mode debugging with QEMU, segments starting with undefined bytes could have data zeroed out at runtime
BUGFIX: GDB: IDA could crash when attaching to QEMU i386 or x86_64 (starting with version 2.10)
BUGFIX: IDA could INTERR 40029 when using the gdb debugger
BUGFIX: IDA could hang trying to load some psx images
BUGFIX: IDA could crash trying to parse bad objc metadata
BUGFIX: IDA could crash when deleting a local type
BUGFIX: IDA could die with interr 40193 when trying to recover from a fatal network error during remote debugging
BUGFIX: IDA could misdetect the compiler as gcc
BUGFIX: IDA would become very slow when the debugger was active and the debugged application was running freely
BUGFIX: IDA would crash when parsing tryblk info
BUGFIX: IDA would not demangle names from exported from a dll during a debugging session
BUGFIX: IDA would print empty character constant if the character could not be converted from the source encoding
BUGFIX: IDA would crash with code 1004 if a scattered location with stack components was specified
BUGFIX: IDAPython: 'reg' member of action_update_ctx_t & action_activation_ctx_t, was virtually unusable as it corresponds to debugger registers, which have different numbers than processor module-provided ones. It has been replaced with 'regname'
BUGFIX: IDAPython: (low-level function) 'set_numbered_type()' wouldn't work with the 'sclass_t' argument returned by 'get_numbered_type()'
BUGFIX: IDAPython: 695 compat's 'ida_kernwin.get_highlighted_identifier()' could cause IDA to crash
BUGFIX: IDAPython: IDP_Hooks::ev_get_bg_color() was not usable w/o resorting to using ctypes
BUGFIX: IDAPython: calc_thunk_func_target() would crash IDA if 'None' was passed to it as first argument
BUGFIX: IDAPython: exceptions happening in timer callbacks wouldn't be reported immediately (and could fail being reported altogether)
BUGFIX: IDAPython: get_member_by_id() & get_member_by_fullname() were returning garbage instead of a proper 'struc_t *' instance
BUGFIX: IDAPython: ida_hexrays.ccase_t.values was not usable
BUGFIX: IDAPython: ida_lines.get_extra_cmt() would return None for empty stings, even though more comments lines exist after it
BUGFIX: IDAPython: idaapi.py's 'set_func_start' and 'set_func_end' coming from 'ida_funcs' were overriden with constants coming from 'ida_idp'
BUGFIX: IDAPython: it was impossible to retrieve the selection from an embedded chooser after its parent form has been accepted
BUGFIX: IDAPython: load_plugin() could crash IDA with a segmentation violation
BUGFIX: IDAPython: op_t.addr couldn't be used as a value to 'get_stkvar' although the documentation mentions it
BUGFIX: IDAPython: setting members of the cinsn_t's union without first setting the 'op' type, would silently fail
BUGFIX: IDAPython: some PLFM_* constants were not exported
BUGFIX: IDAPython: unexpected (and improperly handled) "wait dialogs" could show while some other modal dialog was activated, in case a timer fired in the background
BUGFIX: In the "Structures" view, IDA could display multiple times the header text in case structures were corrupted/deleted
BUGFIX: KERNEL: qfindfirst/qfindnext did not work for non-ASCII paths on Windows
BUGFIX: MC68K: instuctions referring to addresses with high bit set could be printed incorrectly in IDA64
BUGFIX: MC68K: some valid instructions would not be decoded in "MC68xxx universal emulator" mode
BUGFIX: MIPS: in mips16 mode, instructions ADDIUPC and LWPC situated in a delay slot could be disassembled using wrong PC value
BUGFIX: MinGW/Cygwin-produced PE x64 files could show __fastcall's as __usercall, even though the code does respect Microsoft's x64 ABI convention
BUGFIX: NEC850: xrefs to high addresses would not be created for some instructions when using IDA64
BUGFIX: On Windows, with the "windows" style and on Hi-DPI monitors, the check marks in checkboxes would look tiny
BUGFIX: PC: IDA sometimes was too aggressive in creating functions after multiple nop instructions
BUGFIX: PPC: some paired single load/store instructions could not be decoded if they used odd displacement values
BUGFIX: Showing enum values of negated values, would show the list of matching enums for the original value
BUGFIX: The DWARF plugin could complain on some Rust types (i.e., '()')
BUGFIX: The DWARF would stop early if it failed loading some debug information when parsing functions data, while it could keep going and try parsing the following functions
BUGFIX: UI: IDA on Windows could not open filenames not representable in current ANSI character set
BUGFIX: UI: On Windows, IDA could print network-related error messages in wrong encoding, resulting in unreadable text
BUGFIX: When debugging a Linux/ELF application, symbols coming from "debuglink"-provided companion files wouldn't be available in IDA
BUGFIX: When requested, the segment name wouldn't appear in the line prefixes in graph mode
BUGFIX: Win32: during debugging, it was impossible to open the list of exports for an .exe
BUGFIX: Win32: when attaching to a process for debugging, IDA could fail loading PDB information associated with the executable file
BUGFIX: arm: ida64 would not truncate addresses to 32bit when decoding 32bit code
BUGFIX: debugger action objc:RunUntilMessageReceived could fail for multithreaded Objective-C apps
BUGFIX: debugger: calling get_event_module_name() in an IDC condition could crash if debug event was not of correct type (PROCESS_STARTED, PROCESS_ATTACHED or LIB_LOADED). now it's also supported for LIB_UNLOADED, and an IDC exception is thrown in other cases
BUGFIX: debugger: win32: "SEH list" functionality did not work for wow64 processes when using local debugging
BUGFIX: debugger: win32: IDA could hang when debugging a 32-bit (WOW64) process on Win10
BUGFIX: excessively big shift counts were handled incorrectly (e.g. "shl eax, 33" should not produce 0)
BUGFIX: file names coming from AR archives could be garbled due to an incorrect assumption about their encoding
BUGFIX: fixed a crash when loading corrupted LE files
BUGFIX: fixed interr 50863 that could occur in corrupted idbs
BUGFIX: gas for arm requires lowercase instruction conditions but ida was not always using lowercase for them
BUGFIX: get_strlit_contents() could overflow the range of bytes it was asked to retrieve
BUGFIX: get_strlit_contents() shouldn't stop at codepoint zero, but rather keep going until the 'len'gth is reached
BUGFIX: in some cases it was impossible to set the "bp-based frame" function attribute, ida would immediately reset it
BUGFIX: it was impossible to correctly specify prototype of a thiscall function that returns a big struct
BUGFIX: it was possible for the mac debugger to load debug names from a file that didn't match an image in memory
BUGFIX: kernel: IDA could hang on exit when using borrowed licenses and license server was not accessible anymore
BUGFIX: ldr/coff: don't use a DT_NON symbol to describe a section, if a procedure is planned there and a non-dummy name has been set
BUGFIX: m65816: abs,x/abs,y addressing could fail to create xrefs
BUGFIX: mac debugger could fail to load for databases that were created from scratch
BUGFIX: mac debugger could fail to single step when source-level debugging in multithreaded environments
BUGFIX: mac debugger could fail to update the thread list properly, which could then cause IDA to fail to add/delete a hardware breakpoint
BUGFIX: mac debugger could produce duplicate debug names in a module's name list
BUGFIX: mac debugger could trigger erroneous SIGBUS signals after setting a software breakpoint on OSX 10.14
BUGFIX: mac debugger would fail to set user-defined hardware breakpoints in newly-created threads
BUGFIX: mach-o loader could erroneously truncate segments in iOS 11 kernel caches
BUGFIX: mach-o loader would not properly load files with a __TEXT segment with a nonzero file offset
BUGFIX: mips: fixed analyzing of the mips16e 'addiu' insn
BUGFIX: no events were generated when the user toggled the operand sign or bitwise negated it
BUGFIX: objc plugin could ask to parse Objective-C info when in fact no such info was present in the database
BUGFIX: pc: ida could loop endlessly if a finally handler was belonging to 2 different functions
BUGFIX: pdp-11: offset expressions were not creating xrefs
BUGFIX: pdp-11: removed obsolete PDP_XLAT_ASCII parameter from ida.cfg
BUGFIX: range change was wrong for ANALYSIS, ANALYSIS2, and some other bitmask config parameters
BUGFIX: rtti comments would be duplicated upon reanalysis
BUGFIX: rtti type descriptor names starting with '*' were not recognized
BUGFIX: rtti type descriptor names starting with *Z were not recognized
BUGFIX: scripted loaders had to seek to the beginning of the file at the beginning of the load_file() function
BUGFIX: sdk: tinfo_visitor_t::apply_to() could spoil type modifiers (const/volatile) and attributes when editing the type
BUGFIX: segmentation info could be lost when opening very old databases (created before 2001)
BUGFIX: set_fixup() has 6 arguments but the docs were claiming there there are 5 arguments
BUGFIX: setting the struct member type as "int[]" (without specifying the array size) could lead to an array of arrays (int[][])
BUGFIX: simplecustviewer_t::OnPopup wouldn't allow receiving the 'widget' and 'popup_handle' as other widgets would
BUGFIX: some corrupted mach-o files could crash ida
BUGFIX: some flowchart edges could be missing (could occur in the presence of xrefs into the middle of an instruction)
BUGFIX: sometimes 'overflow' bit would be calculated incorrectly after cmp or sub instructions
BUGFIX: stack unwinding could break analysis for prefixed call instructions
BUGFIX: stopped to modify the function in the 'ev_is_jump_func' event
BUGFIX: the linux debugger could cause INTERR 20099 with corrupted ELF files
BUGFIX: the mac debugger could create an incorrect memory layout after attaching to a process with ASLR enabled
BUGFIX: the win32 debugger server would fail to retrieve pdb files from symbol servers
BUGFIX: ui/qt: IDA could easily deadlock if more than 1 thread was using logging.py, or simply attempting to print anything in the console while holding any other lock that both threads might require
BUGFIX: ui/qt: IDA could show the wrong bookmarks contents for the "Jump > Clear mark..." action
BUGFIX: ui/qt: added "Add watch" to the (old-style) watchlist context menu
BUGFIX: ui/qt: background color for lines could fail to be applied in some cases
BUGFIX: ui/qt: changing segment register values wouldn't cause the "Segment registers" chooser to refresh
BUGFIX: ui/qt: deleting (or modifying) segment register ranges could leave the disassembly view(s) outdated
BUGFIX: ui/qt: don't show "(null)" in the collapsed area footer, if the description is missing
BUGFIX: ui/qt: during debugging, the "flags" registers column could be made partly invisible (depending on the display DPI)
BUGFIX: ui/qt: given a sufficiently long list of functions in "Functions window", deleting ranges of functions could cause IDA to crash
BUGFIX: ui/qt: hex views would show bogus characters when bytes were decoded as UTF-8 and yielded surrogate codepoints
BUGFIX: ui/qt: moving IDA between monitors with different resolutions, could result in the graph view showing garbage
BUGFIX: ui/qt: on HiDPI displays (e.g., 4k), hints could end up being partly truncated
BUGFIX: ui/qt: the 'COLOR_DEFAULT' for prefixes of simpleline_t would result in portions of that line marked as COLOR_PREFIX, to be invisible
BUGFIX: ui/qt: when 2 widgets were placed next to one another within the same tab, closing the leftmost one, could cause the rightmost one to disappear as well (without being destroyed.)
BUGFIX: ui/qt: when jumping between nodes in graph view, the animation could end up in the wrong place
BUGFIX: ui/qt: when stopping a debugging session, it might happen that some line rendering options (number of opcode bytes, indent, ...) would not be properly restored to what it should be
BUGFIX: ui/qt: when using line top/bottom paddings, the graph view could show artifacts for e.g., highlighting
BUGFIX: ui: "Strict ASCII" option in the "Strings window" was not working
BUGFIX: ui: calling set_view_renderer_type() on the TWidget returned from open_disasm_window(), would crash IDA
BUGFIX: ui: in the "Structures" view, the "Shrink structure" action would be available on alignment bytes, yet incapable of actually removing those
BUGFIX: ui: some string literals part of structure instances in the address space, could fail to show in the "Strings window"
BUGFIX: ui: when attaching to a process, it could be impossible to load PDB or DWARF debug information right away (but would work after detaching & re-attaching)
BUGFIX: user info would be stored in the idb even when STORE_USER_INFO was turned off
BUGFIX: user-specified 'manual instruction' for data items was ignored
BUGFIX: using -DTRICORE_DEVICE in the command line would lead to warnings
BUGFIX: hexrays: "(x>>8)&1" would be represented as "x>>8" in some cases
BUGFIX: hexrays: 'jl (N-x), x' would be decompiled incorrectly
BUGFIX: hexrays: 1-byte functions could not be decompiled
BUGFIX: hexrays: 64bit multiplication was not correctly recognized in some cases
BUGFIX: hexrays: In some cases the decompiler could not represent zero constant as a enum member
BUGFIX: hexrays: an assignment to a global variable could be incorrectly optimized away in some cases
BUGFIX: hexrays: append_use_list() could give wrong result in case of Big Endian platform
BUGFIX: hexrays: arm: some multiple registers/memory transfer instructions were not marked in the microcode as multimove sequences
BUGFIX: hexrays: decompiler could generate wrong offset for accessing a part of variable having user-defined type
BUGFIX: hexrays: decompiler would consider .text segments as readonly even if their permissions would say otherwise
BUGFIX: hexrays: find_def/find_use were working correctly only for register operands; other operand types were handled poorly
BUGFIX: hexrays: fixed a bug in set_to_le_ge()
BUGFIX: hexrays: fixed an endless loop (fortunately, a rare thing)
BUGFIX: hexrays: fixed bug in combine_hinsn_mov()
BUGFIX: hexrays: fixed many interrs
BUGFIX: hexrays: in some cases "smod power2" rule could produce wrong operands in the generated microinstruction
BUGFIX: hexrays: in some cases the decompiler could lose 'default:' branch of a switch statement
BUGFIX: hexrays: in some rare cases some comparisons would be decompiled incorrectly
BUGFIX: hexrays: incorrect partial operand propagation in some rare cases on Big Endian platforms
BUGFIX: hexrays: offsetof(type,field) may have empty field name in some rare cases
BUGFIX: hexrays: pc: incorrect handling of loope/loopne instructions
BUGFIX: hexrays: signed modulo 2 was sometimes recognized with wrong size
BUGFIX: hexrays: some 64bit comparisons would be decompiled wrongly
BUGFIX: hexrays: stack pointer could be miscalculated when decompiling a mixed range that contained code both inside and outside functions
BUGFIX: hexrays: the "lxe_lvar_type_changed" could provide outdated lvar_t information
BUGFIX: hexrays: the BACKPROP_CC rule could invert an 'if' condition
BUGFIX: hexrays: the rule "~x > 0" => "x <= 0" was too aggressive
BUGFIX: hexrays: the type of guard_dispatch_icall() coud interfere when guessing the protype of the called function
BUGFIX: when calling 'set_member_tinfo()', the struc_member_changed event would be sent before the tinfo_t object is actually applied
BUGFIX: when parsing omf files ida was storing wrong extdef name length in the idb
BUGFIX: when using the "Suspend on debugging start" option with the mac debugger, /usr/lib/dyld would be missing from the module list
BUGFIX: win32: ida was mistakenly setting a borland debug hook in some cases; this would change the program execution
BUGFIX: win32: if the debugged application erased a software breakpoint, appcall would stop working
BUGFIX: windbg: IDA could crash with interr 1491 when loading a 32-bit minidump of a process with DLLs loaded above the 2GB mark (0x80000000)
BUGFIX: wrong function prototypes could cause an interr
BUGFIX: 68000: ida would not truncate function and instruction addresses to 24-bit
BUGFIX: IDA could crash for choosers with empty title
BUGFIX: IDAPython: GraphViewer.AddEdge() could crash IDA if the source or destination nodes were out-of-bounds
BUGFIX: hints could not show up for user graphs
BUGFIX: debugger: win32: IDA could crash on win10 preview with interr 1419 when debugging a 32-bit process
BUGFIX: fixed interr 40372 (ida would die if a conditional bpt was present in the idb and idapython was disabled or not present)
BUGFIX: hexrays: if multple windows with the same function were present, an inactive one could be used for jump targets
BUGFIX: mips: fixed delay slot processing
BUGFIX: print_operand() would print data operands incorrectly for big endian processors (this function is not used to generate the disassembly listing)
BUGFIX: IDA could crash when trying to open a registers view in the GDB debugger
BUGFIX: enumplace_t::adjust() was not working properly with bitfields + serials
BUGFIX: ios debugger was broken for old iOS versions (< 9.0)
BUGFIX: the "Currently:" button text in the String Literals dialog was difficult to read on OSX
