Previous Versions

Historical What's New list

IDA Pro 4.6 SP1

Main Improvements

  • remote debugging module for MS Windows
  • debugger: performance improvements, up to 10 times for certain operations.
  • debugger: attach/detach from process (detach only available on XP/2K3)
  • conditional breakpoints in the debugger specified as IDC expressions
  • new processors: DSP563xx, DSP566xx
  • Processor Modules

  • MC68K: "link" instructions are recognized as function starters
  • ARM: analysis is improved in many cases; the ARM_ARCHITECTURE_5 configuration option has been introduced. If this option is on, the low bits of values loaded to PC are treated as the thumb bit. This option is off for old databases and on for new databases.
  • TMS320C54: it is possible to specify the data segment address in the processor specific options dialog box
  • DSP56K: pc relative addressing is displayed as such; dsp566xx data segments are 16-bit
  • File Formats

  • COFF: slightly better handling of SCO UNIX files; SCO relocations are still far from perfect
  • ELF: invalid sections at the address zero in the executable files do not stop the loading process
  • ELF: IDA asks about each section of the file in the manual load - to load or not to load
  • ELF: load exception handlers in the PPC relocatable ELF files despite incorrect flags (no SHF_ALLOC)
  • PDB: IDA tries to download PDB symbol files from the Microsoft Symbol Server
  • ELF: H8/300 files can be loaded
  • ELF: ida loads only sections marked with SHF_ALLOC
  • Alpha: the disassembly of object files is improved
  • Palm: IDA automatically converts A5 based references to nice offsets
  • User Interface

  • 'Highlight background color' option moved from 'General'options dialog box to 'Colors' options dialog box
  • a name is displayed for valid addresses on the stack
  • breakpoints are displayed as only one red line
  • commands to change colors of instructions and hidden areas are added
  • command to convert debugger segments to normal segments and vice versa is added
  • double clicking on a struct/enum name in a struct/enum view collapses or uncollapses it
  • enum member/bitfield values are added/edited using their default radix (hexadecimal, decimal, octal, binary & character)
  • graphs use background colors of functions or instructions if defined
  • gui: the chooser does not ignore characters before '/' and '\' anymore
  • it is possble to modify the mask of enum bitfields
  • it is possible to use IDC expressions in the "jump to address" command
  • max alignment available from the user interface is 4096
  • the user can specify background colors of functions and segments
  • valid addresses on the stack are displayed in a different color
  • debugger: display a warning the first time the user starts the debugger
  • debugger: 'EIP inside previously defined instruction or data' messages can be disabled on a per database basis
  • 'Reset hidden messages...' command added to Windows menu
  • Kernel Improvements

  • IDA recognizes and uses register names in the IDC expressions MS _fastcall decorated function names are properly demangled
  • demangler: new encoding of virtual tables for GNU ARM is supported
  • do not append a dummy name as a comment when creating entry points
  • ida creates 2..32 byte alignment directives automatically
  • HTML supports background colors and conforms to 4.01 standard
  • Debugger

  • new commands: switch/select debugger
  • debugger: added a tracing option to specify a trace stop condition
  • debugger: modules window added
  • IDC & SDK

  • IDC: GetDisasm() function returns the disassembly line of the specified address
  • IDC: GuessType() function tries to guess the function/variable type.
  • IDC: functions to manipulate colors are added
  • SDK: floating point conversion functions have additional parameter: the output buffer size
  • SDK: generate_disasm_line() has an additional parameter. Currently it can be used to force instruction decoding even if there is no instruction at the specified address
  • SDK: open_url() function is added
  • SDK: qfscanf() is added
  • SDK: debugger: functions to list, attach and detach processes are available for plugins
  • SDK: get_tilpath() accepts the output buffer as a parameter
  • SDK: added various keywords to display more complex message boxes (warning(), info(), askyn(), etc)
  • BUGFIXES

    BUGFIX: 'Change stack pointer' command is always available in context menu if the cursor is in a function and the stack pointer is displayed
    BUGFIX: 'Copy address to command line' command was broken
    BUGFIX: ARM BLX instruction in the thumb mode could not be disassembled
    BUGFIX: IDC command line properly evaluates multi-lines statements (for example from a cut & paste)
    BUGFIX: Palm Pilot loader was not considering the BSS segment while loading
    BUGFIX: TMS320C54 module properly handles some invalid instructions, delayed jumps, and loading of additional binary files
    BUGFIX: VC name ?Query@CCodeKey@@QAEHGPAX0@Z was incorrectly demangled
    BUGFIX: amd64 elf relocation R_X86_64_PC8 wasn't properly processed
    BUGFIX: bitfields with mask -1 could not be used
    BUGFIX: brazilian keyboard was causing an error message: Actions Calculate and WatchList have the same hotkey Ctrl-Alt-W.
    BUGFIX: corrected help on the GetOperandValue() function
    BUGFIX: debugger: if an IDA breakpoint was created over an INT3 instruction, it was not possible to continue the execution
    BUGFIX: debugger: when debugging a DLL (using a host application), host application segments were not properly named
    BUGFIX: floating point data operands for big endian processors were not displayed correctly
    BUGFIX: hint was not properly displayed over enum consts with a 0xFFFFFFFF value
    BUGFIX: ida.cfg sections for the processor module names with more than 4 letters would be skipped
    BUGFIX: ida64 could hang loading some OMF files
    BUGFIX: if the user double-clicked in a struct/enum/hex view while the cursor was on a valid address in the last active disassembly view, IDA jumped to this valid address in this
    disassembly view
    BUGFIX: in graphs, the color used for functions defined in an external segment wasn't good
    BUGFIX: in some cases, settings of closed windows saved in desktops were not properly restored
    BUGFIX: in some particular cases, IDA was crashing when trying to display the hint window
    BUGFIX: in some particular cases, a hint window to an invalid address appeared when the mouse was over instructions or operands
    BUGFIX: in user-defined graphs, functions defined in an external segment were drawn even if 'Ignore Externals' was selected
    BUGFIX: it was impossible to rename local vars, struct members or enum members from disassembly view once the name contains a char from the IDA.CFG MangleChars list
    BUGFIX: it was not possible to search for a substring appearing on the last line of a structure definition
    BUGFIX: it was not possible to specify the alignment directive in some object files
    BUGFIX: marked positions were not rebased with the program
    BUGFIX: pressing 'Y' in the imports table at an address without a name would cause an access violation
    BUGFIX: rebasing the program would not modify addresses in the problems list; deleting a segment would not delete addresses from
    the problems list
    BUGFIX: resizing the disassembly view could lead to a crash is some curcumstances (repetitively resize the window vertically +
    page down, around 100 times)
    BUGFIX: setting the start address of a function with an auto-generated name to a lower address could display a strange warning message
    BUGFIX: the 'Create HTML file' command reflects exactly what is visible on the screen
    BUGFIX: the calculator was not properly evaluating the current name in a struct or enum window
    BUGFIX: tracing: in some cases, the last instruction or call before the process termination was not properly traced
    BUGFIX: fixed a typo in the autocomments for C166
    BUGFIX: it was not possible to load enum definitions from a 32-bit database to a 64-bit database
    BUGFIX: in the dialog boxes the segment register values were displayed in the target processor format while the entered values were expected to be in the hexadecimal notation
    BUGFIX: 'Enter comment' and 'Enter repeatable commant' commands were sometimes wrongly enabled or disabled in structure/enumeration views
    BUGFIX: 'Field type' command in stack frame popup menu was disabled
    BUGFIX: AVR module would use zero page for RAM even if RAM has not been defined in the disassembly
    BUGFIX: MC6816 module properly displays virtual addresses and operands defined as user defined offset
    BUGFIX: the second operand of movntdq instruction was mm# register instead of xmm# register; movq2dq, movq, movdq2q instructions were not disassembled
    BUGFIX: some segment list columns were too narrow
    BUGFIX: ELF32 files without section header were not loaded correctly
    BUGFIX: xrefs.idc was out of date
    BUGFIX: ST9 bset and other bit manipulation instructions were not disassembled correctly
    BUGFIX: some cross references were not created correctly (16-bit values were sign extended to 32-bit while they should not be)
    BUGFIX: "delete xref manually " command was proposing wrong target address by default
    BUGFIX: long string constants were silently truncated in IDC
    BUGFIX: if a breakpoint was edited during debugging it would be displayed in orange (should be in red)
    BUGFIX: lines of the messages window are not draggable anymore
    BUGFIX: the debugger would leak DLL handles if the process has been forcibly terminated
    BUGFIX: some function prologues were not parsed completely (mov ax, #imm at the beginning)
    BUGFIX: dsp56k return instruction codes were incorrect
    BUGFIX: MC6816 module properly handles memory-mapped registers (defined in 6816.cfg)
    BUGFIX: VC6 RTTI-related names were incorrectly demangled
    BUGFIX: C166 SBN loader was accepting zero filled files
    BUGFIX: "unload database to idc" was using IBM PC segment register names for all processors
    BUGFIX: AVR module would crash if the ROM size was not specified in the configuration file.
    BUGFIX: get_loader_name() was returning the name with "64" suffix for the 64-bit version

    New Features is the IDA Pro v4.6 Disassembler

    Major Features

  • True 64-bit support is added. IDA64 now fully supports 64-bit programs for Windows64, Itanium, Alpha, Sparc64, etc.
  • The debugger can trace the program and produce a trace log. Individual instructions and function calls can be traced.
  • Processor Modules

  • new processor: AMD64 (advanced, automatically handled by the meta PC module)
  • C166: new & better configuration files
  • PIC: better configuration files
  • Hitachi h8/500: addressing scheme is improved
  • MIPS: better handling of macro instructions; two new options are introduced: MIPS_MACRO_RESPECT_XREFS, MIPS_MACRO_HIDDEN_R1
  • MIPS: new macro instructions are added
  • MIPS: use 64-bit definition of "move" for 64-bit segments (daddui)
  • PC: added options to turn off the VxD and FPU emulation interrupts
  • PC: better handling of VC exception blocks
  • SPARC: better work with macros (destroy a macro if a reference to its middle is found)
  • TMS320C54: added support for delayed instructions
  • TMS320C54: separate code and data spaces are supported
  • INTEL 80916: register names as the location names are allowed
  • Alpha: 64-bit version stores the GP register values simply as a segment register (32-bit stores a delta between .got and current GP which is more difficult to understand)
  • File Formats

  • COFF: full support of Alpha 64-bit files
  • COFF: file type check is stricter to avoid false positives with amiga files
  • ELF: added support for elf-x64 (for amd64). not all relocations are supported yet.
  • ELF: PowerPC R_PPC_REL14 relocation type is supported
  • EPOC: SIS files for EPOC 6 are now supported.
  • PDB plugin: create functions only in the code and normal segments
  • PE: auxiliary names are not included in the name list
  • PE: delayed import tables are nicely parsed and commented
  • PE: files with corrupted export table can be loaded
  • PE: illegal relocation table size could lead to a crash
  • PE: small files with the hidden entry point and imports table in the header could not be loaded
  • PE: the header section is collapsed if it is used only for delayed imports
  • PE: the presence of the delayed import table loads the header section to make the disassembly nicer
  • Kernel

  • new FLIRT signatures for Visual Studio.Net 7.1
  • MFC v7.1 ids files are added
  • better management of user defined xrefs: the user can specify any existing xref type, not only one "user" xref type as before
  • flair: improved help about signature files; updated dumpsig to support more processor codes
  • ida uses the type information of the struct function members for the "struct offset" operands
  • if a structure definition from til contains a register name, ida will prepend the field name with an underscore rather than failng to add the whole structure
  • idau: universal ida which works under ms dos and under ms windows
  • SDK & IDC (please look at the history file in the SDK for the details)

  • IDC: type manipulation functions GetType/SetType are added

  • SDK: MD5 functions are available
  • SDK: added a 'distclean' target to clean & remove compilation directory in plugin makefiles + LIBS can specify external libraries to link to
  • SDK: calcexpr_long() accepts a pointer to uval_t as well to sval_t
  • SDK: can compile plugins with Visual C++ command line compiler (available either in Visual C++ 6.0/7.0 or as free with .NET framework SDK + Plateform SDK)
  • SDK: construct_macro() function is added
  • SDK: do_name_anyway() does not complain to the user about bad names anymore
  • SDK: fixed a bug in swap64() and swap128()
  • SDK: foreach_strmem() and get_struct_member() function prototypes are changed to handle the member field names
  • SDK: gcc can be used to compile IDA plugins, loaders, and modules
  • SDK: graphing functions are available in IDA API
  • SDK: import_node is available in IDA API
  • SDK: int128 type is added
  • SDK: is_call_insn() function and callback is introduced. The callback should be implemented by the processor modules with unusual call instructions (like PowerPC)
  • SDK: more floating point functions are exported
  • SDK: new function: reftype_t get_default_reftype(ea_t ea);
  • SDK: all out.../Out... functions check the output buffer boundaries
  • SDK: prototypes of some processor module functions are changed: outop, is_sp_based, create_func_frame, gen_specseg. The returns values are bool, not int as before
  • SDK: tag_skipcodes() function is added
  • SDK: use GNU make to compile plugins with GCC (Borland make was previously required)
  • SDK: zip compression handling functions are added to the API
  • User Interface

  • the debugger is available in the text version of ida (less fancy but faster and takes less room on the screen)
  • added some new extensions to the open dialog box
  • can change the address of an existing breakpoint - insert new breakpoints from the breakpoints window
  • can jump to operands (from the popup menu) while debugging
  • debugger: added the "Run until return" command
  • debugger: can use 'Run to cursor' command to start the debugging
  • debugger: detect and renames thread related segments: TIB (Thread Information Block), thread stack & thread stack PAGE_GUARD segment
  • exit dialog does not display "don't save" option if the database was not packed
  • in arrows panel: can toggle breakpoint (double-click on a dot) and run to cursor (CTRL + double click on a dot)
  • threads window added
  • many minor modifications and improvements
  • Bugfixes

    BUGFIX: "load ids" command might add comments instead of renaming imported functions if the database was closed and opened at least once
    BUGFIX: "make alignment" command would fail for some addresses
    BUGFIX: ELF: dynamic relocations to the whole program were not applied
    BUGFIX: ESP register view arrows panel width wasn't saved properly in desktops
    BUGFIX: FR module incorrectly disassembled some instructions
    BUGFIX: IA64: the opcode bytes were not displayed for predicated instructions
    BUGFIX: IBM PC: movq instruction was disassembled incorrectly (F3 0F 7E); some data types for SSE2 instructions were wrong
    BUGFIX: IDA could crash if a list with a reverse sorting on a column was refreshed
    BUGFIX: IDA could crash if trying to debug a program spawning subprocesses
    BUGFIX: IDA could crash on corrupted databases with the hidden area descriptions missing
    BUGFIX: IDA could crash when loading a desktop with open disassembly views
    BUGFIX: IDA could die with some national keyboard layouts
    BUGFIX: IDA does not destroy code even if there is a data reference to it from the type system
    BUGFIX: IDA doesn't freeze anymore when drawing the hint for stack variables in huge stack frames
    BUGFIX: IDA was erroneously reporting 'the input file has been changed' after the reloading of a new input file into the database
    BUGFIX: IDA would abort trying to execute some buggy idc scripts
    BUGFIX: IDA would complain about bad TMS id for some PE files which look like COFF files
    BUGFIX: MIPS module was using 32-bit definition of the "move" instruction for all processors
    BUGFIX: PC: 4k segment alignment should be represented as "mempage"
    BUGFIX: PowerPC function flow charts are displayed correctly
    BUGFIX: TMS320C54 module properly handles absolute addressing and doesn't use anymore I/O definitions for immediates
    BUGFIX: TMS320C54 module properly prints variable names and creates xrefs for absolute "indirect" adressing
    BUGFIX: calling qexit() from a plugin was not terminating plugins, closing windows, etc in the gui version
    BUGFIX: disassembly views weren't properly refreshed when creating a string
    BUGFIX: dr_I was not defined in idc.idc
    BUGFIX: dumping a database with references to unexisting structures or enums could crash IDA
    BUGFIX: ida could add numerous type comments on the register arguments
    BUGFIX: ida could leave some imported functions without types at the loading time
    BUGFIX: ida would complain about incorrect numbers in the "rom size" dialog box during editing them
    BUGFIX: idag in the batch mode quits if there were errors in the command line. before it was silently hanging.
    BUGFIX: if the number of the functions was greater than 65535, then some commands would fail (like "find next byte not belonging to a function")
    BUGFIX: it was impossible to jump to a name with colons (:) using Ctrl-G
    BUGFIX: it was not possible to select the little endian MIPS & RSP processor from the initial dialog box
    BUGFIX: manually suspending a multithreaded process and steping over function calls could lead to erroneously suspend some threads
    BUGFIX: mc6808 module could not disassemble inc oprx8, sp
    BUGFIX: opening a modal window during debugging then stopping the debugged application could freeze IDA
    BUGFIX: operator new would be demangled incorrectly (truncated as "operator ne")
    BUGFIX: register views weren't properly refreshed at the start of the debugging
    BUGFIX: resetting the debugger desktop wouldn't properly reset the height of the main window in some particular cases
    BUGFIX: some mach-o files could not be loaded
    BUGFIX: the analysis could loop endlessly in some functions due to the stack pointer tracing
    BUGFIX: the description of Word(), Dword() IDC functions is corrected
    BUGFIX: the first imported function would not have a type if it were at the beginning of the program
    BUGFIX: trying to pause an application with many sleeping threads could lead to subsequent application crash when the sleeping threads wake up
    BUGFIX: vc6rtf.sig: strcpy/strcat functions were not recognized

    New Features is the IDA Pro v4.51 Disassembler

    (8/06/2003)

    Processors

    Files Formats

    User Interface

    Kernerl Improvements

    BugFixes

    BUGFIX: "Rebase program" command was not correcting the image base correctly
    BUGFIX: 'F' key was not working in the name, function, etc non-modal windows
    BUGFIX: AIX COFF executables with the stripped symbol table were not loaded properly
    BUGFIX: C166: bfldl instruction had 2 last operands swapped
    BUGFIX: C166: rets instruction would have loc_xxx label instead of locret_xxx
    BUGFIX: EPOC: ROM images were loaded incorrectly
    BUGFIX: EPOC: some SIS files were not recognized
    BUGFIX: Esc key closes the enumerations and structures windows even if they are on the desktop
    BUGFIX: FR module had several disassembly problems (byte order, ascii string display, special register handling, indirect calls)
    BUGFIX: FR: delayed instructions were not taken into account when following the execution flow
    BUGFIX: HEX loader creates the correct segments even if the input file contains the data records in the wrong order
    BUGFIX: IBM PC: all o_phrase operands were marked as having an immediate number
    BUGFIX: IBM PC: the size of the second operand of "lea" instruction was always dt_byte
    BUGFIX: IDA could crash if the user double clicked in the messages window and no database was open
    BUGFIX: IDA could crash trying to close some windows
    BUGFIX: IDA could crash trying to move a function in a corrupted database
    BUGFIX: IDA could hang trying to delete a function from a corrupted database
    BUGFIX: IDA could not open an old database after opening a new file from a ZIP or any other container file
    BUGFIX: IDA would crash if a processor with word grouping of the instruction opcodes was used and the display of the instruction opcodes was turned on
    BUGFIX: If Shift,Ctrl, or Alt keys are down, don't display help for F1
    BUGFIX: If ida.cfg was missing, IDA would complain about IDC errors
    BUGFIX: JAVA: fixed an access violation in the gui version of ida if the hints were turned on and the cursor was at the beginning of a line starting with a dot.
    BUGFIX: M740 #imm values were represented as "port_name" without the '#' is am i/o port was corresponding to the immediate value. improved handling of the configuration file.
    BUGFIX: MSDOS: some external pascal overlays were not detected and not loaded
    BUGFIX: PIC: IDA was using only 1 bit of the STATUS register to calculate the target addresses (page addressing)
    BUGFIX: PPC dcr field was decoded incorrectly
    BUGFIX: TXT: if ida had been launched with "idaw not-existing-file", then switching to the silent mode immediately after the error message would crash ida
    BUGFIX: VC mangled names like ?GetRowInfo@ui_textmatrix@@QAEXHPAH0@Z were demangled incorrectly
    BUGFIX: XlatAsciiOutput for IBM PC was not working for the new bases and required the reloading an existing database
    BUGFIX: XlatAsciiOutput was ignored in the strings window
    BUGFIX: a memory leak is fixed. If a list is sorted by a column, stable_sort() would leak memory. Now we use sort() instead of stable_sort().
    BUGFIX: access violation if a corrupted database had a bad function without a name
    BUGFIX: annoying access violation in the gui when the user tries to rename a stack variable. the access violation would not hinder the normal execution.
    BUGFIX: bin_search() could endlessly loop
    BUGFIX: breakpoints window state is now saved
    BUGFIX: changing the alignment type in an alignment directive could undefine everything in the database
    BUGFIX: creating a user-defined offset for an indirect call using a vtable would consistently fail the first time
    BUGFIX: debugger: 'Step over' command now works over LOOP/LOOPE/LOOPNE instructions
    BUGFIX: debugger: if the path to the executable or the executable name contains spaces, everything after the first space gets split and passed as arguments to the process
    BUGFIX: debugger: segments creation doesn't stop anymore if a breakpoint can't be restored.
    BUGFIX: debugger: target arrow wasn't properly updated for LOOP/LOOPE/LOOPNE instructions
    BUGFIX: deleting a segment could hang ida if trivial segment translations were used
    BUGFIX: double clicking on IDA window system menus now properly close the window
    BUGFIX: fixed the entry point problem of DJGPP COFF executables
    BUGFIX: hex loader would not load the following line: S319FFC00000000000000000000000000000000000000000000027
    BUGFIX: IA64 module had some disassembly problems
    BUGFIX: idaw in the batch mode would loop forever trying to ask the user if a dependent dll was not found
    BUGFIX: if a function stack variables window was open, IDA would crash when the function was deleted
    BUGFIX: if a hidden area, function, or segment start at the same address, hidden functions would have priority over areas; the correct logic should take the longest hidden element rather than making one thing be more prioritary that another.
    BUGFIX: if no selection is active, text search brings up the old search string by default
    BUGFIX: in the case of a program/DLL rebase, some breakpoints were improperly restored/moved
    BUGFIX: information in the debug segments could stay in the database even after the debugging session has been closed. the current fix fixes it somewhat but not completely
    BUGFIX: input files from ZIP archives and other containers do not appear in the most recently used file list anymore
    BUGFIX: instruction operands 4..6 were displayed in red
    BUGFIX: it was not possible to declare variables of a structure type if this structure type had a union member in the past
    BUGFIX: it was not possible to delete a dummy name without references in a function (normally these names doesn't appear unless the user creates them)
    BUGFIX: it wasn't possible to create structure variables if an area was selected and there were defined bytes
    BUGFIX: local labels and stack change point information might be lost during the program rebase
    BUGFIX: long symbol names from COFF DBG information were not loaded
    BUGFIX: properly refresh strings window when segments are moved
    BUGFIX: properly update actions as soon as the debugged process is suspended
    BUGFIX: rebase_program() would leave the xrefs unmoved if called when the debugger was active
    BUGFIX: rebasing a corrupted database could lead to a crash (area_t::move)
    BUGFIX: removed erroneous "rebasing program" message from the debugger
    BUGFIX: removed misleading & from the Debugger menu name (Alt-D is used to setup the data types)
    BUGFIX: scr2idb() would not do anything is !is_gui
    BUGFIX: "search for immediate" would not find negated values
    BUGFIX: the debugger would sometimes miss the dll relocations on XP (for some reason the system does not provide the dll name at the loading time)
    BUGFIX: the main menu would stay in the incorrect state when switching between a desktop window and an MDI window
    BUGFIX: the process parameters in the debugger could not be cleared once set