IDA 9.4

IDA 9.4.260714

Welcome to the IDA 9.4 release highlights, and thank you to all our beta testers for joining us during the beta phase! You can get your 9.4 installers in the Download Center of My Hex-Rays portal. Prefer a quick overview? Watch the IDA 9.4 Highlights video.

What's in this release

Highlights

The marquee features: new Dyld Shared Cache infrastructure, Swift ABI recognition, SVE2, Hexagon & MCore processors, the Pathfinder widget, deep links, and Git-based Teams.

Higher Level Languages

Better Rust and Go analysis, plus Objective-C ARC handling.

Swift

Swift ABI recognition, runtime-function typing, and recovery of throwing calls and swiftcall arguments on stripped binaries.

Decompiler

New actions and many pseudocode/microcode output-quality improvements.

Disassembler

New and improved processor support: ARM SVE2/SME, TriCore, RISC-V, and MCore.

Loaders

ELF/COFF/OMF/PSX improvements, compilation-unit grouping, and Linux kernel modules.

Debuggers

A broadly modernized GDB remote backend, Win32/WinDbg fixes, and RISC-V debugging.

Plugins, SDK & API

A new IDA Domain API release, IDAPython enhancements, and a large set of new (EA-based) SDK APIs.

UI & UX

Pathfinder, the redesigned Xrefs Graph, the unified Scripts window, and Jump Anywhere as the default jump action.

Performance

Faster loading and lower memory use for DWARF and large databases.

Deprecations

Features and components removed or slated for removal in this release.

Bugfixes

Comprehensive fixes across every subsystem.

Highlights

New Apple Dyld Shared Cache Infrastructure

Read more about the new DSC workflows in the IDA 9.4: Apple Dyld Shared Cache workflow improvements blog post.

IDA 9.4 completely overhauls the approach to analyzing Dyld Shared Caches:

dedicated widgets
specialized workflows & actions
seamless navigation between shared cache components
improved (& correct) analysis

Apple ecosystem reversers should have a much easier time with the new system. See the documentation on the general concepts & workflows!

Swift ABI Recognition

Read more about the Swift work in the IDA 9.4: Improved analysis of compiled Swift binaries blog post.

The decompiler and type system now understand the Swift calling convention. Add __swiftself to a function argument to declare it being passed in x20 (arm64) / r13 (x86-64). The function-level attributes __swiftasync and __swiftthrows cause the decompiler to rewrite accesses to/from the designated registers as intrinsics.

Example 1 — Throwing method: `BankAccount.withdraw(_:)`

Showcases __swiftself, __swiftthrows, the swift error-register (x19) plumbing, and more runtime types (Swift::BoxPair). (Also notice how the undefined variable warnings disappear.)

Before

Swift::Int __swiftcall __spoils<...> BankAccount.withdraw(_:)(
        Swift::Int a1)
{
  _QWORD *v1; // x20
  __int64 (*v3)(void); // x23
  unsigned __int64 v4; // x0
  __int64 v5; // x1
  Swift::Int result; // x0
  __int64 v7; // x8
  bool v8; // vf
  Swift::Int v9; // x8
  _BYTE v10[24]; // [xsp+8h] [xbp-38h] BYREF

  v3 = *(__int64 (**)(void))(*v1 + 96LL);
  if ( v3() >= a1 )
  {
    result = swift_beginAccess(v1 + 14, v10, 1, 0);
    v7 = v1[14];
    v8 = __OFSUB__(v7, a1);
    v9 = v7 - a1;
    if ( v8 )
    {
      __break(1u);
    }
    else
    {
      v1[14] = v9;
      return ((__int64 (__fastcall *)(Swift::Int))v3)(result);
    }
  }
  else
  {
    v4 = lazy protocol witness table accessor for type AppleError and conformance AppleError();
    swift_allocError(&type metadata for AppleError, v4, 0, 0);
    *(_OWORD *)v5 = xmmword_100008C50;
    *(_BYTE *)(v5 + 16) = 1;
    return swift_willThrow();
  }
  return result;
}
// 100001F9C: variable 'v1' is possibly undefined
// 100001FF0: variable 'v5' is possibly undefined

After

// NEW: Prototype carries __swiftthrows and __swiftself keywords
Swift::Int __swiftcall __swiftthrows BankAccount.withdraw(
        void *__swiftself self,
        Swift::Int a2)
{
  void *error; // x19
  __int64 (*v4)(void); // x23
  Swift::Int v5; // x0
  __int64 v6; // x1
  const void *v7; // x2
  const Swift::WitnessTable *v8; // x0
  // NEW: v9 is typed via the return assignment from the now-known swift_ runtime function prototype
  Swift::BoxPair v9; // kr00_16
  Swift::Int result; // x0
  __int64 v11; // x8
  bool v12; // vf
  Swift::Int v13; // x8
  _BYTE buffer[24]; // [xsp+8h] [xbp-38h] BYREF

  // NEW: Custom intrinsic to signal error register access
  error = __swift_get_error();
  // NEW: self recognized as function argument and accessed here
  v4 = *(__int64 (**)(void))(*(_QWORD *)self + 96LL);
  v5 = v4();
  if ( v5 < a2 )
  {
    v8 = lazy protocol witness table accessor for type AppleError and conformance AppleError(v5, v6, v7);
    v9 = swift_allocError((const Swift::Metadata *)&type metadata for AppleError, v8, nullptr, false);
    error = v9.object;
    *(_OWORD *)v9.value = xmmword_100008C50;
    *((_BYTE *)v9.value + 16) = 1;
    // NEW: Custom intrinsic to signal error register access
    __swift_set_error(v9.object);
    swift_willThrow(self);
LABEL_5:
    __swift_set_error(error);
    return result;
  }
  swift_beginAccess((char *)self + 112, buffer, (void *)1, nullptr);
  v11 = *((_QWORD *)self + 14);
  v12 = __OFSUB__(v11, a2);
  v13 = v11 - a2;
  if ( !v12 )
  {
    *((_QWORD *)self + 14) = v13;
    result = v4();
    goto LABEL_5;
  }
  __break(1u);
  return result;
}

Example 2 — Async function

Showcases __swiftasync and the typed async_context (x22).

Before

__int64 actorSampler()()
{
  __int64 v0; // x22
  __int64 v1; // x20
  __int64 result; // x0
  __int64 v3; // x8
  bool v4; // vf
  __int64 v5; // x8
  __int64 v6; // x8
  __int64 (*v7)(); // x16
  __int64 v8; // [xsp+18h] [xbp-8h]

  v1 = *(_QWORD *)(v0 + 48);
  result = swift_beginAccess(v1 + 112, v0 + 16, 1, 0);
  v3 = *(_QWORD *)(v1 + 112);
  v4 = __OFADD__(v3, 100);
  v5 = v3 + 100;
  if ( v4 )
  {
    __break(1u);
    goto LABEL_11;
  }
  *(_QWORD *)(*(_QWORD *)(v0 + 48) + 112LL) = v5;
  v4 = __OFADD__(v5, 50);
  v6 = v5 + 50;
  *(_QWORD *)(v0 + 56) = v6;
  if ( v4 )
  {
LABEL_11:
    __break(1u);
    goto LABEL_12;
  }
  *(_QWORD *)(*(_QWORD *)(v0 + 48) + 112LL) = v6;
  if ( v6 + 0x4000000000000000LL < 0 )
  {
LABEL_12:
    __break(1u);
    return result;
  }
  if ( v6 > 74 )
  {
    *(_QWORD *)(*(_QWORD *)(v0 + 48) + 112LL) = v6 - 75;
    v7 = actorSampler();
  }
  else
  {
    v7 = actorSampler();
  }
  if ( ((v8 ^ (2 * v8)) & 0x4000000000000000LL) != 0 )
    __break(0xC471u);
  return swift_task_switch(v7, 0, 0);
}
// 10000239C: variable 'v0' is possibly undefined
// 100002434: variable 'v8' is possibly undefined

After

// NEW: Prototype carries __swiftasync keyword
void __swiftcall __swiftasync actorSampler()()
{
  // NEW: Explicit, user-typable local async context variable
  struct actorSampler$AsyncCtx *async_context; // x22
  _QWORD *v1; // x20
  __int64 v2; // x8
  bool v3; // vf
  __int64 v4; // x8
  __int64 v5; // x8
  void (__swiftcall __swiftasync *v6)(); // x16

  // NEW: Custom intrinsic to denote async reg access
  async_context = __swift_get_async_context();
  // NEW: Relative async reg accesses recognized as struct accesses
  v1 = async_context->field_30;
  swift_beginAccess(v1 + 14, &async_context->field_10, (void *)1, nullptr);
  v2 = v1[14];
  v3 = __OFADD__(v2, 100);
  v4 = v2 + 100;
  if ( v3 )
  {
    __break(1u);
    goto LABEL_9;
  }
  *((_QWORD *)async_context->field_30 + 14) = v4;
  v3 = __OFADD__(v4, 50);
  v5 = v4 + 50;
  async_context->field_38 = (void *)v5;
  if ( v3 )
  {
LABEL_9:
    __break(1u);
    goto LABEL_10;
  }
  *((_QWORD *)async_context->field_30 + 14) = v5;
  if ( v5 + 0x4000000000000000LL < 0 )
  {
LABEL_10:
    __break(1u);
    return;
  }
  if ( v5 > 74 )
  {
    *((_QWORD *)async_context->field_30 + 14) = v5 - 75;
    v6 = actorSampler();
  }
  else
  {
    v6 = actorSampler();
  }
  swift_task_switch(v6, nullptr);
}

SVE2 Support

ARM SVE2 and SME extensions are now fully disassembled.

Decompiler Strings

Strings recovered during decompilation now automatically show up in the list of strings. Note that the list is filled lazily and only contains strings of functions that were previously decompiled.

Qualcomm Hexagon Disassembler & Loader

A brand-new Hexagon (QDSP6) processor module brings Qualcomm DSP firmware into reach, paired with a Qualcomm MBN boot-image loader (SBL/XBL containers, multi-ELF, hash validation).

See the Hexagon disassembler reference for details on packet-based execution, ISA coverage, processor-specific display options, and loading Hexagon binaries.

MCore/CSkyV1 Disassembler

A new processor module for the MCore aka CSky V1 architecture.

Read more about Pathfinder, Jump Anywhere, and other navigation improvements in the IDA 9.4: Smarter Navigation and Quality-of-Life Improvements blog post.

How does execution get from here to there? IDA 9.4 can now answer that directly: the new Pathfinder widget (View > Open subviews > Pathfinder, Shift-F9) finds call paths between functions:

pick two or more waypoints - paths are found segment by segment, visiting them in order
add the function under the cursor as a waypoint with Ctrl-Shift-F9, straight from a disassembly or pseudocode view
exclude functions to keep known noise (logging helpers, generic wrappers) out of the results
tune the search: include data xrefs, shortest path only, maximum depth
view the results as a pre-expanded cross-references tree, or as an Xrefs Graph with the path highlighted

Pathfinder graphs are regular Xrefs Graphs: they are saved with your database and organized in the new graph manager (see the Xrefs Graph section). Find out what it can answer about your binary!

Share work without shipping files around. Deep links navigate to a specific location in a database and can be opened in an already-running IDA through a new local IPC channel (also usable by external tooling such as HCLI).

Git-Based Teams Server

The “Teams” add-on for IDA Pro can now run with Git servers too… Share IDB files with your team using the Git provider you already use e.g. GitHub, GitLab, Bitbucket, or self-hosted. No server to deploy. No new credentials to issue. Just clone, analyze, commit, push.

Further Teams improvements in this release:

git ida works in terminals, via an automatically managed global Git configuration
the Teams status-bar info can be enabled or disabled from settings (on by default)
the Git account settings dialog offers credential fields

A few guides to help you get started or migrate:

Migrating from Vault? See the Vault to Git Migration tutorial.
Need a self-hosted Git server? See our recommended Gitea setup.
Already have a Git repository? See the setup guide and the everyday tasks walkthrough.

Jump Anywhere Becomes the Default Jump Action

Jump Anywhere is now bound to the default g shortcut, replacing the legacy jump-to-address dialog with a unified, type-ahead navigator:

index and jump to function comments
accept IDC/Python expressions like cpu.EIP
live previews as disassembly, pseudocode, or hex
jump history with previews

IDA Domain API: new release

A new version of the IDA Domain API is available. The latest release (v0.5.0) adds microcode and pseudocode access along with object store/retrieve APIs. See What's new in the IDA Domain API for details.

ARM64 Windows Build of IDA

IDA is now available as a native ARM64 build for Windows-on-ARM.

Compilation Units Folders

Functions can now be grouped in the Functions list by the compilation unit they came from. The compilation-unit structure is reconstructed from COFF, PSX, OMF, TDS, DWARF, PDB and GO, mirroring the original source-file layout of the binary. It's also reconstructed from any user loader that calls add_sourcefile().

Unified "Scripts" Window

Replaces the old "Execute script" / "Snippets" dialog with a single dockable "Scripts" window. The window hosts four vertical tabs, each backed by an independent tree widget:

"Execute script"/"Snippets" - IDB-resident snippets, now exposed as a tree
"Recent scripts" - externally-loaded scripts (filesystem paths), with single-child folder chains coalesced and per-row extlang icons.
"Examples" (NEW) - IDAPython-shipped examples.
"Search" (NEW) - allows searches across the three sources above

Xrefs Graph: UI Improvement

Xrefs Graph can now display call paths found by the new Pathfinder (see above): the path spine and waypoints are highlighted with dedicated colors, and a path-aware aligned layout keeps the route readable.

The xrefs graph interface has been significantly redesigned in IDA 9.4:

A new graph manager for managing graphs, following the same paradigm as the other views
Headers have been added to nodes, containing quickly readable information about comments, bookmarks, breakpoints, and missing references
Redesigned widgets: some of them have been moved out of the overlay for improved usability
The settings have been redesigned so that they are now less cluttered and organized more logically

See the Xref Graph reference for the full picture.

Xrefs Graph is now more consistent with the rest of IDA and easier to use - try it!

Watch what's new in IDA 9.4

Watch the feature overview of the 9.4 release on the All Things IDA channel.

Courtesy of Elias Bachaalany (@allthingsida)

Higher Level Language Support

rust: display the detected rust version and used crates in the header
rust: type panic locations, detect rustc version and crate list
rust: add CM_CC_RUST calling convention
golang: add configuration var GOLANG_MAX_ANON_NAME_SIZE
golang: parse buildinfo module dependencies for Go 1.18+
golang: improve pclntab discovery for PIE ELF binaries
golang: remove zero-sized fields from Go struct types
golang: derive return type for runtime.newobject from RTYPE arg
golang: dwarf: inject hidden dictionary parameter for Go generic functions
golang: improve detection of stack arguments (vs spill space)
golang: improve detection of standard go arguments and return types
improve transforming of duffcopy/duffzero calls
objc: add possibility to show / hide objective-C ARC functions and recognize iOS16+ ARC helpers
objc: type _objc_{retain,release}_x<N> ARC stubs as __usercall
swift: auto-type swift_ runtime-functions and thunks
swift: recover throwing calls and functions on stripped binaries
swift: recover stack-spilled arguments at swiftcall sites
swift: recover __swiftcall on stripped functions
swift: report Swift as the compiler in the output header
swift: implement __swiftasync function annotation
swift: implement __swiftthrows function annotation
swift: implement __swiftself argument annotation

Decompiler

vd: introduce Edit type... action (hotkey e) to edit a type from the decompiler
ui: render argument names at the callsite (Edit -> Plugins -> Hex-Rays Decompiler Options -> Options 3 -> Argument name hints to configure/disable)
ui: add possibility to collapse code blocks in the interactive ui (chevrons on the left)
ui: add possibility to invert then-else for if statement
stkvars: more aggressive array detection
x64: dereference references to read-only memory
vd: add Add cast action for decompiler expressions
vd: convert 0/1 to true/false in bool contexts and 0 to nullptr when HO_CPP_CONSTANTS is enabled
vd: collapse trailing v = x; return v; inside try/catch bodies
vd: recognize fabs/negation from IEEE 754 sign-bit manipulation
vd: fold constant rol/ror/bswap operations
vd: prefer explicit comparison against zero for non-bool conditions
vd: structure phi-arm diamond merges as if-then-else instead of gotos
mbui: support for microcode xrefs to registers, stack/local variables, and blocks
mbui: hints describe the subinsn under the cursor
cbui: add a (very basic) c-tree viewer
vd: invert short if (cond) goto L; ...; L: forward jumps
vd: transform memcpy() calls to simple assignments when possible
vd: more aggressive application of scattered variables
vd: better recognition of big function arguments (UDTs, arrays in golang/rust)

Disassembler

Read more about the new and improved processor modules in the IDA 9.4: Wider Processor and Platform Support blog post.

arm: SVE2/SME support
arm: add SVE/SME architecture detection and UI support for options
arm: recognize more switch case constructs observed in modern console SDKs
tricore: integrate new regfinder
tricore: better switch table recognition
tricore: full type system support
tricore: support byte- and word-sized registers in tricore.cfg
tricore: add relocations support
tricore: respect memory mapping during switch handling
tricore: add tc45x, tc48x, tc49xN and tc4Dx register maps
tricore: improve register def/use analysis for register pairs and 16-bit sub-registers
riscv: support Hazard3 (RP2350) extensions
riscv: support compressed instructions Zcmp/Zcmt/Zclsd
riscv: support Soteria extensions
riscv: support shXadd for jump table detection
riscv: print c. prefix for compressed instructions
v850: recognize more switch patterns
mcore: add stack pointer tracking and automatic stack variable creation
mcore: improve disassembly output quality and fix the decoding of various instructions

Loaders

elf: compact relative-relocation support (DT_RELR)
coff: omf: psx: group functions in dirtree according to compilation units
elf: recognize and improve loading of Linux kernel modules, add modinfo to listing header
elf: arm: infer hardfloat ABI from ELF .ARM.attributes Tag_ABI_VFP_args

Debuggers

gdb: general modernization of gdb remote protocol implementation
gdb: retrieve loaded libraries from remote on startup
riscv: add riscv debugging support for GDB backend

Plugins, SDK & API

ida-domain: new release (v0.5.0) adds microcode and pseudocode access plus object store/retrieve APIs
idapython: detect/support pythons managed by uv/anaconda/homebrew
idapython: warn on libpython/venv version mismatch
idapython: expose ida_loader.import_module()
idapython: expose ida_lines.add_sourcefiles batch API
idapython: expose ida_indexer API (backend of "Jump Anywhere")
idalib: automatically activate idalib during installation
idalib: add support for async event processing and execute_sync()
installer: package idalib with IDA Home
installer: bundle analysis.idc with IDA Home (enables the -B switch)
sdk: new header dscu.h (and corresponding module ida_dscu) for programmatic access to the new dyld shared cache infrastructure
sdk: add color codes used in tiplace_t
sdk: add support for extlang custom icons
sdk: expose user-defined microinstruction in the api (user_minsn_t, user_minsn_action_t, minsn_locator_t)
sdk: add new events ev_query_unmapped_address, ev_load_unmapped_address, ev_sanitize_name, ev_should_handle_switch
sdk: new codegen_t::should_handle_switch() hook for processor modules
sdk: new methods mba_t::get_numform/set_numform/clr_numform
sdk: add new struct field string_info_t::decompiler_string
sdk: add EA-based method tinfo_t::get_func_frame()
sdk: new ea-based APIs avoiding ida-allocated pointers -- see the porting guide (segments, funcs/frames, decompiler decompile_function/decomp_ranges_t, hidden_range_info_t, get_sourcefile_by_ea(), qflow_chart_ea_t)
sdk: new event ev_get_stkarg_parts for multi-slot stkarg stores
sdk: add set_func_flag() to set/clear individual function flags
sdk: add is_name_defined_locally_ea() ea-based API
sdk: add get_prev_function_addr()/get_next_function_addr() ea-based API
sdk: add set_function_name_if_jumpfunc() ea-based API
sdk: add read-only accessors for func_t internal array fields
sdk: add outctx_t::gen_function_header/gen_function_footer
sdk: add ev_out_function_header/ev_out_function_footer events
sdk: add new API function add_regarg_ea()
sdk: add new API class function_item_iterator_t
sdk: add new API class function_parent_iterator_t
sdk: add new API class function_tail_iterator_t
sdk: add get_segment_ea_by_num() to look up a segment's start address by number
sdk: set_segment_info() accepts ADDSEG_* flags
sdk: allow processor modules to mark outlined functions (FUNC_OUTLINE)

UI & UX

pathfinder: new widget to find call paths between functions (Shift-F9)
pathfinder: multi-waypoint paths, function exclusions, data-xref/shortest-path/depth options
pathfinder: view results as a cross-references tree or a path-highlighted Xrefs Graph
pathfinder: allow non-function addresses as waypoints and exclusions
xref-graph: Sugiyama-style layered graph
xref-graph: visual cues on nodes (xrefs, bookmarks, breakpoints, comments)
xref-graph: new graph management widget
xref-graph: display and highlight call paths found by Pathfinder
xref-graph: improve UI
jump anywhere: make the expression-evaluation language selectable
jump anywhere: highlight matched text in name/data/string results
jump anywhere: highlight all query matches, also on selected rows
jump anywhere: replace the hex preview with the real hex view
jump anywhere: add an option to restore the last query results on reopen
ui: show release notes on first launch
scripts: new "export headless" action for exporting script snippet as idalib standalone script
ldr: modernize image base/segment ux in initial load dialog
ldr: render referenced shared object for imported symbol names
licensing: improve workflows when using borrowed floating licenses

Performance

dwarf: speed up loading (including line-number import) and reduce memory usage on large DWARF files
kernel: speed up loading of files which added a large amount of names (e.g. Dyld shared caches)
btree: reduce cache and free-page cleanup overhead
pc: speed up frame analysis
pc: add write xref cache
kdata: faster get_db_byte analysis hotpath
performance: skip the upper-32 flag fetch on hot paths
swift: mark swiftcall callers incrementally instead of rescanning per analysis wave
eh: speed up loading MSVC PE binaries with heavy use of C++ exception handling
eh_parse: optimize xref traversal in get_xref_info_for_ea()

Deprecations

idaclang: migrated to tilib with the new clang parser

Bugfixes

Higher Level Languages

vd: wrong argument optimization in golang functions
golang: some Go types were not recognized in certain databases
golang: fix itablinks processing for Go 1.18+
golang: dwarf: fix wrong prototypes for Go functions returning a function or tuple
vd: fix a hang in duffcopy/duffzero handling

Decompiler

mbui: structural analysis action did not show intermediate reduction steps in non-debug builds
mbui: xref-to chooser could jump to block header instead of instruction line
mbui: double-click in graph mode failed to follow the entity under the cursor
mbui: failed decompilation when opening mbui would result in the viewer being leaked
mbui: graph rendering mode was lost across desktop save/restore
mbui: cached microcode could remain stale after edits to other functions
mbui: comments could be duplicated if neighboring minsns had the same ea
vd: "create new struct type" was not working in ILP32 binaries
vd: use correct operand size for division when split optimization shrunk subtraction
vd: reject FP comparisons in 64-bit subtraction carry pattern
vd: the field offset displayed in the hint could be wrong
vd: skip corrupted user microinstructions during deserialization
vd: missing return statement for functions using push rax for stack allocation
vd: arm: fix INTERR 50920 for ARM64 NGCS instruction
vd: pc: fix INTERR 50708 for pointer-to-array dereference in assignments
vd: pc: fix INTERR 52368/53023 on x64 chained switches sharing a default
vd: arm: fix INTERR 50920 for ARM64 SME MOVA instructions
vd: arm: PC reference inside an unsupported insn could trigger INTERR 50920
vd: arm: PC reference inside SMLAL-family insn could trigger INTERR 50920
vd: arm: MOVT PC could trigger INTERR 50920
vd: arm: STRD storing the LR,PC register pair could trigger INTERR 50920
vd: fix INTERR 51264 on functions with conditional add of side-effecting value
vd: fix wrong decompilation when user splits a call's return value
vd: fix INTERR 50757 on deep low/high slicing of UDT scatters
vd: -Ohexrays could not handle Windows paths with drive letters
vd: fix INTERR 50757 on m_low/m_high slicing memfunc mov into non-power-of-2 size
vd: fix INTERR 50709 on wide-mop high-half access with cot_cast lvalue
vd: fix INTERR 50708 on memcpy restored from a call source
vd: fix INTERR 53023 in combine_sar_sar with intermediate uses of low half
vd: avoid INTERR 52368 when a plugin injects edges into a kreg jtbl
vd: reject memcpy when source is any non-addressable mop_d
vd: preserve udt flag when replacing scattered operand
vd: refuse 64-bit add/sub/mul combine when cins's def is used between cins and dins
vd: do not propagate fpinsn from embedded sub-insns to the combined struct copy
vd: do not unpack scattered packing when kreg destination has uncovered bytes
vd: convert array=array assignment to memcpy to avoid INTERR 50708
vd: outlined code that accesses the caller's stack frame was inlined at the wrong stack offset
vd: fix error message printing for invalid deserialization
vd: fix wrong OPROP_UDT flag in operands
vd: fix resolve_pair() breaking 64-bit multiplication patterns
vd: ppc spe: wrong handling of helper args wider than 4 bytes
vd: permit propagation of void-returning memcpy calls
vd: INTERR 50710 (casting to array is forbidden) for usercall functions
vd: conflict between scattered local var and arguments
vd: risc-v: fix minor spec mismatches in the microcode
vd: reset decompilation failures if config is changed
vd: fix a crash in the Display chains microcode view action
vd: fix an empty stkvar du-ud chooser in the microcode view
vd: fix the Edit type action for types from a TIL
vd: opaque Windows types were not replaced by their typedefs (like HWND)
vd: renaming a structure field accessed through a typedef had no effect
vd: garbage pseudocode restored from the database for functions with try/catch
vd: function roles were not serialized
vd: write -dump/-cdump2 files next to the IDB when IDA_DUMPDIR is unset
vd: fix an endless loop
vd: always align the argument area by double slot size
vd: spoiled VARNUM in chain allocation
vd: swift: fix INTERR 30734 when decompiling functions whose return is wider than one register
vd: fix INTERR 473 when correcting pointer arithmetic into a union field
vd: fix INTERR 50312 on switches with a sign/zero-extended index
vd: fix INTERR 50318 when a callee prototype's argument type could not be applied to a caller stack variable
vd: fix INTERR 50342 after switch improving
vd: fix INTERR 50531 (inlined external insn was missing from extinsns)
vd: fix INTERR 50629 when a switch preserves a wide vector register
vd: fix INTERR 50708 on storing a floating-point constant
vd: fix INTERR 50757 when decompiling large structure copies
vd: fix INTERR 50757 on propagating a struct-returning indirect call
vd: fix INTERR 50920 (3-operand ARM STREXD left implicit Rt2=PC untranslated)
vd: fix INTERR 52368 on x64 switches inside exception regions
vd: fix INTERR 52724 caused by int3 traps in x64 code
vd: fix INTERR 52870 in chain lvar allocation
eh34: harden the prologue validation introduced for INTERR 52724

Disassembler

pc: also apply ds-segreg flatten rule in the switch-detector path
pc: don't shift [imm32] by auto-tracked ds in 32-bit code
arm: recognize STM SP as a stkarg store
arm: fix INTERR 51312 when decompiling SVE-encoded XAR
arm: fix SVE/MVE setting for metarm;
arm: fix analyzing UDF for AArch64
arm: fix infinite loop with self-referential frame pointer
ppc: fix INTERR 2765 which could happen in SPE files with sign extended addresses
ppc: VLE displacement operands with r0 base were incorrectly converted to direct address accesses
ppc: fix wrong data offsets on register-based displacements
analysis: stack args' types or comments could be wrong when sequential calls reused stack slots
80196: fix handling of indirect and indexed addressing modes
arc, mips: fix indirect register being modified in the delay slot
arc: fix decoding of dbnz and xbfu
risc-v: fix a bunch of decoding bugs
risc-v: improve fence instruction printing
risc-v: fix c.addiw with rd = x0 being decoded
risc-v: fix spurious 'alternative name' being shown for every symbol
risc-v: handle pair operands correctly
risc-v: fix bug with sign extension on RV64 ADDIW
risc-v: fix alternative extension comments
risc-v: fix bug with auipc getting merged too eagerly

Debug Info

dwarf: import C++ classes that reuse base-class tail padding
dwarf: import SIMD vector types as struct/union members
dwarf: ignore post-prolog spill locations for arglocs
dwarf: fix handling of duplicated Go formal parameters
dwarf: render AArch64 reg 31 as canonical SP, not literal XSP
dwarf: fix handling of 0-address symbols
dwarf: skip line numbers with out-of-range addresses
dwarf: incorrect handling of DW_OP_bit_piece
dwarf: incorrect parsing of xmm register locations on x86_64
dwarf: also treat ELF/Mach-O magic at low_pc=0 as a tombstone

Type System

tinfo: guard unpack_typestr against NULL from unpack_str
types: removing a __shifted type's parent could crash IDA
types: structure xrefs to stack variables with dotted member names showed raw netnode keys
tinfo: stale frame cache hit tripped INTERR 955
tinfo: do not save empty tinfo
tinfo: PRTYPE_DEF need to be reset after usage
frame: function return address frame slot should not be overlapped
parser: instantiate the enumeration declared within a template
parser: do not duplicate the name for a typedef
parser: honor the Microsoft ABI for member pointers

Core

network: Windows TLS: 'Failed to load baked-in Root Certificate'
funcs dirtree: Windows source paths were not properly supported
analysis: opening a large database could hang while propagating function argument names
idb: fix a crash at the database closing time
idb: in a corrupted database, a function may contain another function as a tail
eh_parse: MS C++ cleanup handlers created spurious try blocks outside their scope
kernel: take into account a flow cref for function tail
demangler: fix INTERR 1223 on deeply nested mangled names
fix INTERR 640 caused by a corrupt argument location in the database
fix INTERR 2765 that could occur while analyzing 32-bit x86 PE files

Loader

dsc: fix crash when loading a module from a filtered list
dsc: recognize and rename iOS 27 selector stubs coming from the new libobjcMsgSend* modules
dsc: objc: method prototypes that were missing in recent dyld shared caches
dsc: no more spurious "is already loaded" prompt during analysis
mach-o: keep the entry-point segment visible even when it has no sections
mach-o: decrypt Apple-protected segments located past the unprotected header

Plugins, API & SDK

idc.py: trailing commas turned constants into tuples
idat: support -Ohexrays:-Dname=value in parse_options
cli: fix completion crash, redundant hints, and hint placement on multi-screen wayland
ui: fix IDA crash at exit when a plugin held PySide6 widgets in Python globals
idapython: a failed ida_* module import made all of IDAPython unusable
idapython: prevent crash when IDAPython initialization fails halfway
idapython: don't crash on launch when Python is not configured
idapython: replace old contact email with github link
idapython: fix idc.get_min_spd_ea() implementation
idapython: declare lines range SWIG dep so sourcefile_t inherits start_ea/end_ea
idapython: add proper ownership handling for cif and cloop
idapython: fix gen_microcode() memory leak (mba_t.release)
kernel: duplicate warning when a fixed plugin failed to init
idalib: parse_tagged_line_sections() was not available
idalib: flush database on process exit
idalib: honor -Olicense:... when passed via open_database(args=...)
idalib: suppress spurious "bad hotkey" warning in headless/text mode
idalib: print to stderr in verror_impl
idalib: bring gen_disasm_text back to life
idalib: tests: improve utils
installer: fix the idalib activation page for IDA Home and when Python is already installed
installer: fix the Linux desktop entry
installer: idapython: mac: idapyswitch -a now keeps the currently-selected Python
sdk: forbid an ordinal name as argument for copy_named_type()

UI & UX

ui: jump anywhere: restore focus around Jump Anywhere modal exec()
ui: jump anywhere: stop the Jump Anywhere preview from being picked as a jump fallback
ui: jump anywhere: clamp negative-underflow offsets in JumpAnywhere local-type expr
ui: jump anywhere: a trailing space in the query no longer clears the result list
ui: jump anywhere: result list no longer flickers when refining a query
ui: jump anywhere: drive history mirror from explicit gestures
ui: jump anywhere: improve history list contrast across themes
ui: jump anywhere: only select the mirrored input at dialog open
ui: jump anywhere: keep history selection across an empty-input round trip
ui: graph view: a hint no longer reappears over empty space after clicking a name
ui: about dialog: show the version / build-type line without bold
ui: about dialog: bottom groupbox border was clipped by the buttons and artwork on some platforms
ui: snippets: get_cur_snippet() returns a pointer, null when cur idx is stale
ui: xref graph: minimap froze IDA when two graphs were visible
ui: xref graph: zooming could get stuck when fit-to-view left the graph beyond the zoom limits
ui: xref graph: fix color for dark mode on macOS
ui: jumping to a structure from the pseudocode, could fail to place the cursor at the right type/offset
ui: IDA could UAF accessing freed line_data_t instances
ui: restore Dalvik chooser widgets when applying desktop
ui: status bar analysis indicator now updates synchronously when toggled
ui: fix possible wrong matches and internal error when quick-filtering a list whose item is filed under several folders
ui: in the License Manager dialog, retrying a failed borrow could crash IDA
ui: crash when using chooser actions dispatched via command palette
ui: jump to stack memory on dbl-click of stack var under debugger
ui: navbar click on data did not switch from pseudocode to IDA-View
ui: fix INTERR 40567 when switching from graph to flat view
ui: hint popup title was unreadable on macOS in dark mode with the default theme
ui: adaptive (theme-aware) "Scripts" icons and palette-driven theming
ui: dark theme fixes for the Windows 11 style
ui: assorted UI fixes and small improvements
ui: bookmarks from databases created before 7.0 showed garbage addresses after upgrade
pathfinder: waypoint names now recolor on OS theme change
pathfinder: Pathfinder and forms UX polish
links: add icons for the "Copy link" and "Jump to link" menu actions

Licensing

licensing: a local borrowed license still produced a connection attempt to the license server
licensing: don't INTERR on borrowed license with an unsigned hexlic
licensing: borrowed license stuck in License Manager when Return failed
licensing: switching the license server silently kept using a borrow from the previous one
licensing: remove license as a requirement for update check
licensing: fix "error retrieving user info" in the IDA View header

Debugger

win32/windbg: fix incorrect TEB segment labeling and add PEB segment
core: fix bug with duplicate debugger names
dbg: elf: make executable libs runnable
dbg: pin: fix appcalls and exception handling
dbg: pin: improve exception handling in the pintool
dbg: gdb: auto-resume threads that hit breakpoints during a step
dbg: gdb: fix memory reads where the first byte is 0xE0-0xEF
dbg: gdb: log unexpected SIGTRAP from threads not resumed by client
dbg: gdb: prefer wildcard vCont to avoid common stub bug
dbg: gdb: fix gdb test listing and disable pc_gdb_notepad_replay
dbg: gdb: fallback step packets for older stubs
dbg: gdb: avoid redundant vCont;Cxx;c continue packets for bad servers
dbg: gdb: perform multiple qSupported probes for bad servers
dbg: gdb: fix broken X-write fallback to M writes
dbg: gdb: fix error handling in qGetTIBAddr probe
dbg: gdb: properly handle swbreak and hwbreak in gdb server
dbg: gdb: fix crashing gdbserver on Windows
dbg: gdb: refactor the way pausing and stepping is handled
dbg: gdb: fix duplicate/empty modules
dbg: gdb: send default continue action for other threads
dbg: gdb: handle library stop reason
dbg: gdb: get the image base from the TIB in setup_exeimg
dbg: gdb: attempt qGetTIBAddr for every thread
dbg: gdb: fix missing multiprocess gdb feature
dbg: gdb: do not time out when running monitor commands (matches GDB)
dbg: gdb: derive segment bitness from the image when possible
dbg: gdb: use fs_base/gs_base registers for navigation when available

Teams

teams: don't show the status bar or enable actions on non-git-ida Git repos

Last updated 1 month ago

Was this helpful?

IDA 9.4.260714

What's in this release

Highlights

New Apple Dyld Shared Cache Infrastructure

Swift ABI Recognition

Example 1 — Throwing method: BankAccount.withdraw(_:)

Example 2 — Async function

SVE2 Support

Decompiler Strings

Qualcomm Hexagon Disassembler & Loader

MCore/CSkyV1 Disassembler

New Pathfinder Widget

IDB Deep Links & Snippet Sharing

Git-Based Teams Server

Jump Anywhere Becomes the Default Jump Action

IDA Domain API: new release

ARM64 Windows Build of IDA

Compilation Units Folders

Unified "Scripts" Window

Xrefs Graph: UI Improvement

Watch what's new in IDA 9.4

Higher Level Language Support

Decompiler

Disassembler

Loaders

Debuggers

Plugins, SDK & API

UI & UX

Performance

Deprecations

Bugfixes

Higher Level Languages

Decompiler

Disassembler

Debug Info

Type System

Core

Loader

Plugins, API & SDK

UI & UX

Licensing

Debugger

Teams

Example 1 — Throwing method: `BankAccount.withdraw(_:)`