IDA: What's new in 5.5

Highlights

Finally! Finally we drop the MDI user interface and switch to dockable windows. They are simpler to use, more flexible, waste less screen space. Well, you know it yourself. The new interface also includes the improved hex viewer and stack view. The new hex view is much easier to use, can display the data in various formats, allows editing in-place. There is a lot to discover, some screenshots can be checked in the gallery.

Probably the fastest thing to do is to visit the comparison page for more detail about processor modules. In the endless pursuit to improve the disassembly output, we continue to add new methods, tricks, and heuristic rules to IDA. This time the biggest changes are in the ARM and PC modules. The ARM module handles the stack frame, type information, call/jump instructions better than before. The PC module knows about more code patterns, like switch and position-independent code idioms, detects more exception handlers, etc.

Naturally, after adding Windbg support in v5.4, we had to add support for crash dumps. Just specify a crash dump file as the input file and IDA will create a database from it. The debugger can be 'launched' to enter the familiar debugger environment with module, thread, and stack windows, where information can be retrieved the usual way. The only thing you can not do is to resume the execution, that would be an overkill ;)

The previous addition required a big, hopefully invisible, change in the kernel, because the existing storage method could not handle huge gigabyte segments. Previous versions of IDA had a hard limit on the addressing space of the program: max 256MBytes in the default configuration. Modern programs routinely allocate much bigger memories, so we had to find a solution. Now, if a crash dump segment is bigger than a certain size, IDA automatically chooses the sparse storage method. Instead of storing information about every single byte of the program, IDA remebers only useful information. Thus, a 25MB uninitialized array requires just a few bytes of storage to describe it, not 100MB as before.

We would also explicitly mention and say 'thank you' to the users who contributed to this release of IDA. Bernhard Mueller from SEC Consult GmbH was very kind to investigate why the Symbian debugger was failing on new devices and contributed an improvement. Robert Krkic generously shared his IDS files for Symbian systems with all IDA users. Thank you guys, your contributions make IDA better and easier to use!

Do you remember that you can add emulated API functions to the Bochs debugger? Just provide an implementation in IDC/Python/C++ and your function is called. For example, you could provide an implementation of the socket() function that would open a socket on the host system or do something else. While this possibility is very useful and remains in place, we added more predefined functions. Now the Visual Studio and Borland C/C++ startup code can be executed without generating exceptions and you can focus on the 'real' code.

In addition, we also added the 'Bochs rc file loader'. It really helps if you already have a bochsrc file and want to debug it with IDA. Just specify it as the input file and IDA will create a nice database for you. No need to create a dummy database, populate it with the code from the boot sector, etc.

Other, probably less visible, improvements include the PDB plugin, the type system, more SDK functions (check out the exec_request_t if you develop multithreaded plugins), etc. The full list is below:

Changelist

Processor Modules
File Formats
Kernel
Scripts & SDK
User Interface
Debugger
Bugfixes