IDA: 5.3 Comparison Page

Welcome to the IDA v5.3 comparison page! Below you will find side-by-side comparisons of IDA v5.2 and v5.3 disassemblies. Please maximize the window too see both columns simultaneously.

The following original exhibits are displayed on this page:

New PDB plugin - disassembly
New PDB plugin - type information
PIC code - MAC binary
PIC code - Linux binary
Better function recognition
Better jump table recognition
ARM (iPhone, Symbian) - PIC code
ARM (iPhone) - Type information

NOTE: these are just some selected examples, there are many other improvements not mentioned on this page.

New PDB plugin - disassembly

mov edx, [ebp+arg_8]

push edx

mov eax, [ebp+arg_4]

push eax

mov ecx, [ebp+arg_0]

call linput_t__read_cache

jmp short loc_428122

; ---------------------------------------------------------------------------

loc_428107: ; CODE XREF: qlread+24j qlread+33j

or eax, 0FFFFFFFFh

jmp short loc_428122

; ---------------------------------------------------------------------------

jmp short loc_428122

; ---------------------------------------------------------------------------

loc_42810E: ; CODE XREF: qlread+1Bj

mov ecx, [ebp+arg_8]

push ecx

mov edx, [ebp+arg_4]

push edx

mov eax, [ebp+arg_0]

mov ecx, [eax+4]

push ecx

call qfread

loc_428122: ; CODE XREF: qlread+Cj qlread+45j ...

pop ebp

retn 0Ch

qlread endp

mov edx, [ebp+arg_8]

push edx ; size_t

mov eax, [ebp+arg_4]

push eax ; void *

mov ecx, [ebp+arg_0]

call ?read_cache@linput_t@@QAEHPAXI@Z ; linput_t::read_cache(void *,uint)

jmp short loc_428122

; ---------------------------------------------------------------------------

loc_428107: ; CODE XREF: qlread(x,x,x)+24j

; qlread(x,x,x)+33j

or eax, 0FFFFFFFFh

jmp short loc_428122

; ---------------------------------------------------------------------------

jmp short loc_428122

; ---------------------------------------------------------------------------

loc_42810E: ; CODE XREF: qlread(x,x,x)+1Bj

mov ecx, [ebp+arg_8]

push ecx ; size_t

mov edx, [ebp+arg_4]

push edx ; void *

mov eax, [ebp+arg_0]

mov ecx, [eax+4]

push ecx ; FILE *

call _qfread@12 ; qfread(x,x,x)

loc_428122: ; CODE XREF: qlread(x,x,x)+Cj

; qlread(x,x,x)+45j ...

pop ebp

retn 0Ch

_qlread@12 endp

Please note that the function names are better, they have the argument count suffixes. The function arguments have been found and correctly labeled.

New PDB plugin - type information

IDA v5.2 could not extract any type information from PDB files. The new version populates the local types window with all types, all of them ready to use. The only shortcoming we are aware of is that we can not handle nested anonymous structs and unions. We will fix this in the future.

PIC code - MAC binary

dyld_stub_binding_helper proc near

call $+5

pop eax

push dword ptr [eax+34D6Fh]

mov eax, [eax+34E53h]

jmp eax

dyld_stub_binding_helper endp

; =============== S U B R O U T I N E =======================================

; int _dyld_func_lookup(const char *dyld_func_name, void **address)

__dyld_func_lookup proc near

call $+5

pop eax

mov eax, [eax+34E43h]

jmp eax

__dyld_func_lookup endp

dyld_stub_binding_helper proc near

call $+5

pop eax

push ds:(dyld__mh_dylib_header - 1291h)[eax]

mov eax, ds:(dyld_lazy_symbol_binding_entry_point - 1291h)[eax]

jmp eax

dyld_stub_binding_helper endp

; =============== S U B R O U T I N E =======================================

; int _dyld_func_lookup(const char *dyld_func_name, void **address)

__dyld_func_lookup proc near

call $+5

pop eax

mov eax, ds:(dyld_func_lookup_pointer - 12A5h)[eax]

jmp eax

__dyld_func_lookup endp

Please note meaningful names in v5.3 and unhelpful hexadecimal offsets in v5.2. Needless to say that proper naming leads to plenty of other niceties: you will have correct cross reference information, better annotates listing, better data segment, etc.

PIC code - Linux binary

; ---------------------------------------------------------------------------

loc_4DF89BFB: ; CODE XREF: _init+90j

mov [ebx+2Ch], eax

test eax, eax

jnz short loc_4DF89C25

mov eax, [ebx-108h]

movzx edx, word ptr [eax]

mov eax, [ebx-120h]

cmp [eax+34h], dx

jz short loc_4DF89C25

movzx eax, dx

mov [esp+18h+var_18], eax

call __setfpucw

loc_4DF89C25: ; CODE XREF: _init+2Ej _init+43j

mov eax, [ebp+arg_0]

mov [ebx+37F4h], eax

mov [ebx+37F8h], edi

mov eax, [ebx-140h]

mov [eax], esi

; ---------------------------------------------------------------------------

loc_4DF89BFB: ; CODE XREF: _init+90j

mov (__libc_multiple_libcs - 4E09AFF4h)[ebx], eax

test eax, eax

jnz short loc_4DF89C25

mov eax, ds:(__fpu_control_ptr - 4E09AFF4h)[ebx]

movzx edx, word ptr [eax]

mov eax, ds:(_rtld_global_ro_ptr - 4E09AFF4h)[ebx]

cmp [eax+34h], dx

jz short loc_4DF89C25

movzx eax, dx

mov [esp+18h+var_18], eax

call __setfpucw

loc_4DF89C25: ; CODE XREF: _init+2Ej _init+43j

mov eax, [ebp+arg_0]

mov ds:(__libc_argc - 4E09AFF4h)[ebx], eax

mov ds:(__libc_argv - 4E09AFF4h)[ebx], edi

mov eax, ds:(environ_ptr_0 - 4E09AFF4h)[ebx]

mov [eax], esi

The listing on the left is not readable but the one on the right poses no problems. This is a big time saver.

Better function recognition

byte_60ACCB87 db 8Bh ; DATA XREF: .text:stru_60B0A53Co

dd 452BE445h, 75FF50E0h, 0F1C1E8E0h, 6AFFFFh, 0CDE8006Ah

dd 0CC000396h, 0CCCCCCCCh

db 0CCh

; =============== S U B R O U T I N E =======================================

; Attributes: noreturn

sub_60ACCB87 proc near ; DATA XREF: .text:stru_60B0A53Co

mov eax, [ebp-1Ch]

sub eax, [ebp-20h]

push eax ; unsigned int

push dword ptr [ebp-20h] ; void *

call ?ScrubBuffer@@YGXPAXI@Z ; ScrubBuffer(void *,uint)

push 0

call __CxxThrowException@8 ; _CxxThrowException(x,x)

sub_60ACCB87 endp

We made numerous tiny improvements to the analysis engine. The above example illustrates just one particular case. While there are lots of similar examples, we will limit ourselves to this single snippet. Anyway, you get the idea...

Better jump table recognition

cmp [ebp+var_54], 4

ja loc_1312EB

mov edx, [ebp+var_54]

shl edx, 2

lea eax, (dword_130FD8 - 130FACh)[ebx]

mov eax, [edx+eax]

add eax, ebx

jmp eax

; ---------------------------------------------------------------------------

dword_130FD8 dd 40h ; DATA XREF: sub_130F9E+2Dr

dd 0BBh, 167h, 58h, 28Eh, 0C708458Bh, 0C40h, 458B0000h

dd 2C408B08h, 850FC085h, 1EAh, 0B455B60Fh, 8D084D8Bh, 28ED4083h

dd 89008B00h, 89182444h, 0C7142454h, 102444h, 8B000000h

dd 44891045h, 458B0C24h, 2444890Ch, 2444C708h, 304h, 240C8900h

dd 23A8BE8h, 0FC08500h, 0C084C095h, 1AF840Fh, 0B6E90000h

dd 8B000001h, 508B0845h, 8458B30h, 392C408Bh, 0AC850FC2h

dd 0F000000h, 8BB475B6h, 0C0830845h, 24048914h, 290480E8h

dd 8BC78900h, 0C0830845h, 24048914h, 29070EE8h, 8BC28900h

dd 838D084Dh, 28ED40h, 4489008Bh, 74891824h, 44C71424h

dd 1024h, 7C890000h, 54890C24h, 44C70824h, 10424h, 0C890000h

dd 3A0EE824h, 0C0850002h, 84C0950Fh, 8B4274C0h, 0C0830845h

dd 24048914h, 290424E8h, 8BC28900h, 408B0845h, 29D1890Ch

dd 89C889C1h, 45C7BC45h, 1C0h, 0BC458D00h, 4244489h, 89C0458Dh

dd 43E82404h, 8B002906h, 0B0458900h, 20CE9h, 8458B00h

cmp [ebp+var_54], 4 ; switch 5 cases

ja loc_1312EB ; default

mov edx, [ebp+var_54]

shl edx, 2

lea eax, (off_130FD8 - 130FACh)[ebx]

mov eax, [edx+eax]

add eax, ebx

jmp eax ; switch jump

; ---------------------------------------------------------------------------

off_130FD8 dd offset loc_130FEC - offset loc_130FAC ; DATA XREF: sub_130F9E+2Do

dd offset loc_131067 - offset loc_130FAC ; jump table for switch statement

dd offset loc_131113 - offset loc_130FAC

dd offset loc_131004 - offset loc_130FAC

dd offset loc_13123A - offset loc_130FAC

; ---------------------------------------------------------------------------

loc_130FEC: ; CODE XREF: sub_130F9E+38j

; DATA XREF: sub_130F9E:off_130FD8o

mov eax, [ebp+arg_0] ; jumptable 00130FD6 case 0

Another spectacular example.
We added many new jump table patterns in v5.3, for both PC and ARM.

ARM (iPhone, Symbian) - PIC code

LDR R3, =loc_145CC

ADD R3, PC, R3

MOV R0, R3 ; path

MOV R1, #0x10 ; mode

BL _dlopen

; ---------------------------------------------------------------------------

off_2720 DCD loc_145CC ; DATA XREF: sub_2550+84r

off_2724 DCD loc_145BC ; DATA XREF: sub_2550+B0r

off_2728 DCD loc_145A8 ; DATA XREF: sub_2550+D4r

off_272C DCD loc_14528 ; DATA XREF: sub_2550+164r

LDR R3, =(aUsrLibLibsyste - 0x25E0)

ADD R3, PC, R3 ; "/usr/lib/libSystem.B.dylib"

MOV R0, R3 ; path

MOV R1, #0x10 ; mode

BL _dlopen

; ---------------------------------------------------------------------------

off_2720 DCD aUsrLibLibsyste - 0x25E0 ; DATA XREF: sub_2550+84r

; "/usr/lib/libSystem.B.dylib"

off_2724 DCD a__cxa_atexit - 0x260C ; DATA XREF: sub_2550+B0r

; "__cxa_atexit"

off_2728 DCD a__cxa_finalize - 0x2630 ; DATA XREF: sub_2550+D4r

; "__cxa_finalize"

off_272C DCD aAtexit - 0x26C0 ; DATA XREF: sub_2550+164r

; "atexit"

The listing on the left is plainly wrong because IDA v5.2 did not know to handle PIC code. The new version analyzes it without any problems and without any user intervention.

ARM (iPhone) - Type information

; ---------------------------------------------------------------------------

MOV R1, R11

ADDS R0, R4, #0

ADDS R2, R5, #0

BL _strlcpy

MOVS R2, #0

ADDS R0, R4, R0

ADDS R4, R0, #1

STRB R2, [R0]

MOV R0, R11

BLX _strlen

LDR R1, =aOctet

SUBS R2, R5, R0

ADDS R0, R4, #0

BL _strlcpy

; ---------------------------------------------------------------------------

MOV R1, R11 ; char *

ADDS R0, R4, #0 ; char *

ADDS R2, R5, #0 ; size_t

BL _strlcpy

MOVS R2, #0

ADDS R0, R4, R0

ADDS R4, R0, #1

STRB R2, [R0]

MOV R0, R11 ; char *

BLX _strlen

LDR R1, =aOctet ; char *

SUBS R2, R5, R0 ; size_t

ADDS R0, R4, #0 ; char *

BL _strlcpy

IDA v5.3 uses type information for iPhone executables. Please note that function arguments have automatically been labeled. The user may specify function prototypes and use all predefined types from the macosx type library.