IDA 7.6
Last updated
Last updated
IDA 7.6.210319 March 22, 2021
IDA for macOS is now available as a native ARM64 binary which can make full use of the M1 chip's incredible performance.
It is hard to overstate just how much IDA benefits from the new speed boost. Autoanalysis completes much quicker, the UI is noticeably snappier, and almost every other feature in IDA seems smoother when running on M1. Our beta testers reported that IDA 7.6 is "incredibly stable" and "way faster" on Apple Silicon - so it seems our excitement is not misplaced.
Debugging native arm64 processes is also supported on M1, including arm64e:
See the updated macOS debugging tutorial here
The Go language (aka golang) from Google is getting popular thanks to its ease of use, performance, and self-contained binaries not requiring dependencies. Due to some of the language designers' decisions the golang binaries are quite different from those produced by other compilers and some changes were required in IDA to properly support its peculiarities.
Among additions:
parsing of golang-specific metadata to recover function names and boundaries
support for stack-based parameters and return values even on platfoms that usually use registers (ARM, x64)
detection of golang-specific string literals
Here's an example of how a stripped golang binary for ARM looks like in IDA 7.5:
and in 7.6:
Almost twice as many functions were recovered and named.
automatic renaming of variables
Although interactivity is IDA's selling point, it still tries to do as much as possible to automate mundane tasks. With this release the decompiler will try to automatically assign names to variables and structure fields based on assignments and function calls.
See two snippets from decompilation of the same binary. Left: IDA 7.5, right: 7.6.
improved recognition of stack arrays
arrays on stack can be difficult to detect automatically since usually only their first elements are referenced explicitly. We have added heuristics which recover arrays in many typical situations, reducing the need for manual intervention.
empty lines for better readability
If you add GENERATE_EMPTY_LINES = YES to hexrays.cfg, the decompiler will add extra empty lines between compound statements and before labels, which improves readability of long functions.
Our processor selection contiues to expand steadily.
RISC-V is an open ISA which is starting to become available in various hardware such as the latest iteration of the Espressif Systems wireless platform, ESP32-C3.
RL78 from Renesas is a 16-bit descendedant of the 8-bit NEC 78k0(s) family previously supported by IDA and is used in various automotive and consumer applications.
We also added some new functionality to enrich bookmarks management in the UI.
As before, you can use Alt-M/Ctrl-M to add/jump to a bookmark, but now you can also use Ctrl-Shift-M to bring up a separate bookmarks view with the global list of bookmarks that can be grouped into folders:
Also, bookmarked addresses will now be highlighted in the disassembly. You can use Options>Colors to change the highlight color to whatever you want:
Processor list in the Load File dialog is now organized using folder view which can be filtered using Ctrl-F
You can now use cut&paste in folder views instead of dragging things with the mouse
The Strings list is now cached in the database. The Strings window is one of the most commonly used views in IDA for quick reconnaissance. However, depending on the settings it can take a long to to scan the whole database which had to be repeated each time on reopening the window or reloading the database. Now we cache the list so opening it the second time is almost instant.
In the recent iOS and macOS versions, the kernelcache files are compressed. Although there are tools available which can decompress them, it's one more thing to remember. Now IDA handles the standard compressed formats transparently so you can simply load them as standard Mach-O files. Since IDA can also handle ZIP files, you can open them directly from the IPSW updates!
Retpoline (return trampoline) is a compile-time mitigation against the Spectre speculative execution vulnerability disclosed in 2017. Binaries compiled with this option use special thunk functions for indirect jumps which tend to break standard control flow analysis. IDA now detects and handles these thunks transparently, resulting in nice and clean function graphs and pseudocode.
Example binary using retpoline thunks.
In IDA 7.5:
and 7.6:
Python 3.9 was released after IDA 7.5 and changed the layout of some internal structures leading to crashes in scripts or plugins using PyQt. IDA 7.6 adds official support for 3.9 (while still supporting previous 3.x versions and 2.7). Python 3.9.1 is also officially available for macOS on ARM64 and can be used by IDA there.
NB: some items may have been already mentioned in IDA 7.5 SP1-3 release notes
6502: disassemble 65C02-specific opcodes STP and WAI
68K: display ranges of Dx and Ax registers explicitly in the movem instruction
ARM: add support for ARMv8.4-RCPC instructions (LDAPUR, STLUR)
ARM: add support for golang ABI
ARM: added support for parsing ARM64 exception handler information in PE files
ARM: condition flags (ZF, CF etc.) can be used as argument locations
ARM: decode ARMv8.5-A BTI instruction
ARM: decode ARMv8.5 barrier instructions
ARM: fixed switch with CSEL
ARM: improve detection of functions in binaries using PAC or BTI
ARM: improve propagation of pointer types and names loaded using LDR(literal) instructions
ARM: improve switch detection in Thumb code produced by ARM 5.x MDK compiler
ARM: support ARMv8.5-A Memory Tagging Extension (MTE) instructions
ARM: support half-precision floating (FP16) operands
AVR: support AVR XMEGA family chips which do not have general-purpose registers in data memory (contributed by Lukas Kuzmiak from insighti)
AVR: print operands for instructions movw, adiw, sbiw as register pairs
MIPS: add support for EABI32
MIPS: support EVA load/store instructions (LBE, LBUE, LHE, LHUE, LWE, SBE, SHE, SWE, CACHEE, PREFE, LLE, SCE, LWLE, LWRE, SWLE, SWRE).
MIPS: support interAptiv custom instructions (MIPS16e2 COPYW/UCOPYW, MIPS32 SAVE/RESTORE)
MIPS: support the MIPS16e2 Application-Specific Extension instructions (used in the InterAptiv core)
PC: add FXSAVE64 and FXRSTOR64 instructions
PC: add support for AVX512 VAES (EVEX-encoded AES-NI instructions)
PC: add support for stack-based golang abi
PC: add VGF2P8AFFINEINVQB, VGF2P8AFFINEQB and VGF2P8MULB instructions
PC: decode sysenter and sysexit instructions in long mode (they're supported on Intel processors)
PC: recognize and handle calls to retpoline thunks (__x86_indirect_thunk_rXX)
PPC: add support for EFP(Embedded Floating Point) 2.0 instructions efdmin, efdmax, efdsqrt, efdcfh, efdcth
PPC: improved recognition of position-independent switches
PPC: improved recognition of switches that use clrlwi to mask off the number of cases
RISCV: new processor module (initially supporting RV32GC and RV64GC)
RL78: new processor module
DWARF: fix detection of golang files, improve use of golang-specfic DWARF info
DWARF: support batch-loading dwarf files from a macOS11 KDK into an MH_FILESET kernelcache idb
ELF: mips: handle the most frequently used microMIPS relocations
ELF: mips: process MIPS16 relocations
ELF: .gnu_debugdata (MiniDebugInfo) sections are now recognized and parsed
MACHO: handle dyld slide info v4 (used in WatchOS dyld_shared_cache_arm64_32)
MACHO: handle LC_DYLD_EXPORTS_TRIE in macOS11/iOS14 binaries
MACHO: ignore the dummy symbol radr://5614542 that may be added by the strip(1) tool
MACHO: improve analysis of dyldcache files from macOS11/iOS14
MACHO: improve handling of threaded pointers in iOS kernelcaches
MACHO: introduce type libraries for MacOSX11.0.sdk and iPhoneOS14.0.sdk
MACHO: native support for compressed kernelcaches (lzfse, lzss, lzvn), optionally wrapped in img4 container
MACHO: parse LC_DYLD_CHAINED_FIXUPS for arm64e binaries. this should heavily improve the analysis for iOS 14 binaries compiled with Xcode 12
MACHO: support new MH_FILESET kernelcache format from macOS 11
MACHO: support symbolication of macOS11 kernelcaches that link against the boot/sys kext collection
PE: rename standard dummy control flow guard thunks (_guard_check_icall_nop, _guard_dispatch_icall_nop)
bochs: updated ida to support bochs 2.6.11
dalvik: added device connection string (ADB_CONNECT), to simplify Corellium usage
dalvik: added option JDWP_WAIT_FOREVER to wait for JDWP reply infinitely, this helps to debug the shared library of Dalvik application
debugger: don't exit IDA if creating a debugger segment fails
debugger: win32: add 'Stack' column and 'Follow in stack view' context menu to the "SEH list" window
debugger: macOS: add servers for debugging arm64 and arm64e applications on Apple Silicon
improved handling of corrupted IDBs: detect when a function object is missing and try to fix it
kernel: support variable-sized structures in unions
types: allow specification of stack offsets of function arguments (with __usercall); also, return location can be on the stack
types: if applying a function type to data which can be a pointer (e.g. dword or qword) then convert the type to a function pointer
TIL: add _PEB_LDR_DATA to the standard "undocumented" structures for mssdk_* tils
TIL: added type libraries for xnu-7195
UI: added a database cache for the strings list
UI: added NAVBAND_FORCE_GAPS option (defaults to NO), to control whether the navigation band should display gaps between adjacent segments
UI: added the "Clear..." action to the string list window
UI: automatically sync new enum types to the idb
UI: bookmark list can be opened as separate non-modal view which supports folders
UI: bookmarked lines are highlighted with their own customizable overlay color
UI: debugger hints would override decompiler hints
UI: in folders, add cut & paste as an alternative means of moving items around
UI: it is now possible to expand/collapse multiple folders at once, using Ctrl+Numpad+/Ctrl+Numpad-
UI: shortened names of many additional views
UI: save the xrefs window position in the text UI
UI: the navigation band now highlights the segment the mouse is currently hovering
UI: the quick filter (in the tabular, or folders views) can be targeted to only 1 column, or all of them (the default)
UI: The "Create Struct From Data" command will now use demangled method names for the new structure members if used on a vtable (list of function pointers)
UI: themes: implement @ifdef/@ifndef/@else/@endif preprocessing directives for our .css files
UI: Using T(structure offset) on a struct member and picking another struct, sets its type to "struct *"
golang: new plugin to parse and use metadata produced by the Go compiler and Go-specific idioms (pclntab, fixed-length string literals)
eh_parse: improve EH metadata parsing for x64 and ARMv7/ARM64 PE files
OBJC: fixed objc:RunUntilMessageReceived action for macOS11/iOS14
OBJC: improve Objective-C metadata parsing for macOS11/iOS14 (specifically __objc_methlist structures)
OBJC: plugin will now put all decoded Objective-C types in an "objc" folder in the Local Types view
PDB: Network communications while looking for PDB file can be restricted (option PDB_NETWORK in pdb.cfg)
PDB: support new UDT tags generated by VS2019
swift: enabled swift plugin for elf files too, since they can be encountered in the wild
TDS: improved handling of long names
decompiler: "set call type" is available in more situations
decompiler: add an intrinsic function for the x87 fbstp instruction
decompiler: added a rule 'and (x|y), #n => or (x&#n), (y&#n)'
decompiler: added action "Quick rename"
decompiler: added an option to decompile library functions too
decompiler: added convenience functions: locate_lvar(), rename_lvar()
decompiler: added create_cfunc()
decompiler: added GENERATE_EMPTY_LINES; it improves readability by introducing empty lines between blocks of code
decompiler: added global xrefs to entire structs/unions
decompiler: added hints to 'goto LABEL' instruction
decompiler: added hxe_build_callinfo: plugins now can provide call prototypes dynamically
decompiler: added mba_t::set_maturity, it can be used to skip some decompilation passes (to be used with caution)
decompiler: added new function mba_t::build_helper_call
decompiler: added new methods to codegen_t: store_operand(), load_effective_address()
decompiler: added option AUTO_UNHIDE - automatically unhide collapsed items in the pseudocode view when jumping to them
decompiler: added option HO_NON_FATAL_INTERR: permit decompilation after an internal error
decompiler: added the distribution rule for or/and
decompiler: do not use 'l' and 'll' and the loop index names anymore
decompiler: extended 'split expression' to support 64-bit 'not equal' operator
decompiler: extended the functionality of global xrefs to all local types, not only to udts and enums
decompiler: improve decompilation of ternary operator expressions
decompiler: improve recognition of array stack variables
decompiler: improved detection of bool return value
decompiler: improved detection of optimized array references like &buf[i-1]
decompiler: improved handling of imagebase relative addressing
decompiler: improved management of guessed types
decompiler: improved recognition of some signed divisions
decompiler: improved recognition of x64 strcmp
decompiler: improved use of return statements, now we create more of them
decompiler: mips: add support for EABI32
decompiler: never automap variables having a potentially undefined value
decompiler: now the decompiler replaces unused call arguments with UNUSED_ARG(); the unused arguments can be marked with the "__unused" keyword
decompiler: optimize bit test operations on variables with a known set of values
decompiler: pc: decompile bit operations (bt, bts, btr) on 16-bit operands as custom intrinsics (e.g. _bittest16).
decompiler: print too long function prototypes on multiple lines
decompiler: rename local variables more aggressively, to get more meaningful names
decompiler: slightly improved goto elimination
decompiler: user-defined cross-references can be used to inform the decompiler about the target of an indirect branch
Scripts & SDK:
idapyswitch: add Anaconda 2020.02/11 to the ignore list
IDAPython: added an example showing how to color a chooser according to its contents
IDAPython: added an example showing how to toggle pseudocode lines' background using UI hooks
IDAPython: added an example showing how to use ida_kernwin.create_menu() to create toplevel menus, or submenus
IDAPython: added an example showing how to use custom_viewer_jump()
IDAPython: added an example of using ida_bytes.bin_search()
IDAPython: provide an index page for the examples
IDAPython: exposed ida_ieee module, to deal with internal representation of floating values
IDAPython: ida_gdl.gdl_graph_t (& subclasses) are now available
IDAPython: prepare for Python 3.10
SDK: added DP_SZHINT (and WOPN_DP_SZHINT) for set_dock_pos() to let plugin writers specify a desired size for plugin widgets
SDK: added set_vftable_ea() to tie a vftable type and the address of its instance in the idb
SDK: file2base() and mem2base() change storage type to non-sparse
SDK: IDA now sends a 'ui_desktop_applied' event after a desktop has been applied
SDK: improved create_align() to accept length=0; it will be inferred from the alignment exponent in this case
SDK: introduced fpvalue_t that represents floating point values in internal format. it replaces ushort[6], which means that the source code of some plugins may require changes. however, binary compatibility is maintained
SDK: introduced processor_t::ev_update_call_stack
SDK: renamed confusing inf_is_32bit() -> inf_is_32bit_or_higher(); added inf_is_32bit_exactly(), inf_is_16bit(), inf_get_app_bitness()