Highlights

Support for long names. In previous versions of IDA names were limited to 511 bytes. This was causing problems, especially with long mangled C++ names (e.g. boost names). We removed this limitation in many places of IDA. The work is not complete, there are still some areas where the limitation exists but overall the listings are more readable now.

Dalvik: added support for OAT files

PPC: support for Power ISA 2.07

Better analysis of prolog code; better register tracking, especially for ARM

Lots of vulnerabilities fixed thanks to the submissions to our bug bounty program

Complete changelist

Processor Modules ARM: Better tracking of registers, improved analysis ARM: added support for scattered arguments (that are partially passed on the stack and partially in registers) PC: improved prolog analysis PPC: added support for a switch variation produced by the Green Hills compiler PPC: support for Power ISA 2.07

File Formats COFF: added support for irix mips files (no support for relocations yet) Dalvik: added support for OAT files DWARF: basic support for clang-generated DWARF variable location DWARF: very basic support for ‘rustc’-produced DWARF information

Debugger PIN: add support for reading of FPU/XMM registers from internal exception tracing: can display addresses as raw, instead of using seg/func/offset representation

Kernel/Misc kernel: introduced the notion of ASM and C level types; IDA tries to preserve member offsets only for ASM types; C types may change their sizes because of the changes to other types they depend on kernel: added support for long names: type, function, label, etc names can be up to 32767 bytes long demangler: improved to recognize new mangled names til: added type library for Windows 8.1 (user mode) til: updated windows til files improved automatic recognition of ascii string by the autoanalyzer

User Interface UI: idaq dock menu on mac now features a list of recent files UI/qt: It is now possible to navigate back & forward in location history with the mouse side navigation buttons (for mice that feature those) in graph & proximity view as well (it was already possible in listing view) UI: display a warning if the user rebases program around 0xFF000000 (it may cause problems because these addresses are used for internal housekeeping) UI: graph: Ctrl-Keypad-+ and Ctrl-Keypad– can now be used to quickly collapse/reveal a node’s contents UI: GraphOverview: can optionally use a blank background (just like before 6.7) UI: Proximity: added ability to have multiple paths, set their color, turn them on/off and delete them

Scripts & SDK IDC: added ExpandStruc() IDC: improved SetLocalType: it accepts typeinfo object as the second argument in addition to declaration strings; added PT_REPLACE so that local types can be replaced IDAPython: allow accessing a til_t’s “base” til_t objects IDAPython: in addition to AskUsingForm (that opens a dialog), it is now possible to call OpenForm (e.g., to open a form as a tab.) IDAPython: added ExpandStruc() IDAPython: USE_LOCAL_PYTHON config parameter is deprecated, IDA autodetects local Python installation now SDK: added “segm_attrs_changed” event so that plugins can take appropriate actions if necessary SDK: added print_decls(), allowing to print types from a type library (possibly including dependencies) in a format suitable for C(++) compilation SDK: added support for default register bits of 64-bit debugger registers SDK: added tinfo_t::clr_const,clr_volatile,clr_const_volatile functions SDK: made the return codes of ph.notify() callbacks more plugin-friendly SDK: netnode names can be of arbitrary length. for practical reason we limit them by 32KB SDK: qstrncpy and similar functions will raise interr if the size argument is 0 or negative SDK: replaced get_true_name() and similar functions by get_ea_name(), which accepts qstring as the output buffer; this allows for names of unlimited length, if necessary SDK: segment names and classes use a separate namespace now and do not hinder functions or data labels with the same name SDK: tinfo_t::get_unpadded_size() now works not only for c++ objects but for all structs SDK: ui: forms: Added askqstr() – the kind of askstr() but with qstring argument SDK: ui: new chooser_item_attrs_t::flags flag CHITEM_GRAY is added to show chooser item grayed out (like disabled). It is now used for the Local types choser to distinct guest types (syncronized from structure/enum views)

BUGFIXES BUGFIX: ‘-‘ was forbidden in type names but it can be encountered in template arguments BUGFIX: ARM: A reference to SP (R13) in the register list of the LDMDB instruction (and similar ones) was not allowed by IDA, while some ARM devices can apparently execute it BUGFIX: COFF: specially crafted COFF files could trigger invalid memory writes on OS X BUGFIX: Calling refresh_chooser() on a chooser that’s embedded in an AskUsingForm might fail calling the possible form callback with a possibly-updated rows selection BUGFIX: Cmd+C was broken on OSX, and copying was only possible through Ctrl+C BUGFIX: Creating 2 GraphRenderer with the same title could crash IDA BUGFIX: Deprecated function add_menu_item() would place the item at the end of the menu if the path was of the form “Edit/Other/” (i.e., ending with an empty string), while it used to place the action on top before BUGFIX: Deprecated function add_menu_item() wouldn’t accept ‘-‘ as a separator anymore; only expecting ” (i.e., empty string) was allowed for separators BUGFIX: Double-clicking on a thread in the list would jump to the wrong thread, if the list was sorted by a column BUGFIX: During debugging, clicking on some strings containing format specifiers could cause IDA to display the wrong data BUGFIX: Exporting structures to IDC could lose type information for their members BUGFIX: File save dialog could have an empty/undefined file name on OSX (Issue 1232) BUGFIX: Force switching to graph view on functions with huge number of nodes, might cause IDA to crash BUGFIX: Global variable database_idb was not reset to the empty string after a database was closed BUGFIX: Hex-View widgets had lost the ability to allow direct editing of the text in their rightmost area (since IDA 6.4) BUGFIX: IDA could hang after not adequately handling a segment register change BUGFIX: IDA could hang trying to coagulate unknown bytes within a code segment BUGFIX: IDA could sometimes print garbage after cross references between structs BUGFIX: IDA had no way to reset the background color of proximity view nodes that were highlighted by the ‘Find path’ action BUGFIX: IDA was displaying split Unicode strings for big-endian processors incorrectly BUGFIX: IDA would incorrectly report a circular dependency when trying to export a type containing a deleted type BUGFIX: IDA would try to generate disassembly text for nodes that are unreasonably large BUGFIX: IDAPython Hex-Rays bindings: could crash IDA because access to members of unions, while they didn’t make sense, were allowed (and thus SWiG created buggy proxies around invalid pointers.) BUGFIX: IDAPython was not exposing tinfo_t::get_named_type(), because SWiG rules in typeinf.i were too broad BUGFIX: IDAPython’s IDC-style ApplyType() wasn’t working for structure members BUGFIX: IDAPython: GetSegmentAttr/SetSegmentAttr would fail with segment registers BUGFIX: IDAPython: Only the first ‘long name’ of python-based processor modules was considered BUGFIX: IDAPython: build.py didn’t trigger the patching of some directors methods calling convention, resulting in compilation failure with flag “–with-hexrays” BUGFIX: IDAPython: expose ::get_named_type() BUGFIX: IDAPython: idautils.DecodePreviousInstruction() was not checking for the right value returned from idaapi.decode_prev_insn() BUGFIX: In IDAPython, re-using the same action description twice when registering dynamic context menu items could lead to a crash BUGFIX: In some rare cases, IDA could crash when closing down & force-exiting a debugging session BUGFIX: Installers couldn’t be run in unattended mode, because the ‘setEncryptionPassword’ directive was specified in a ‘<validationActionList>’, which is not executed in unattended mode BUGFIX: It was impossible to comment function stack variables in “Stack of <function name>” windows BUGFIX: It was impossible to rename structure fields from IDA View-A anymore BUGFIX: It was possible, through process_ui_action(), to invoke the code for an action that was disabled BUGFIX: Mach-O DWARF source-level debugging could fail to find the source file BUGFIX: Mach-O source-level debugging DWARF could fail finding shared libraries source files because it would miss some items (it wasn’t taking ASLR into account) BUGFIX: Manually loading a PE overlay could cause previous segments to be stretched, which would then conflict with later segments being loaded BUGFIX: Not Free()ing a Compile()d idaapi.Form could cause IDA to crash at exit-time BUGFIX: On OSX, opening the “About” dialog, then the “Addons” dialog, then closing the “Addons” and performing Ctrl+C could crash IDA BUGFIX: PDB could fail on meaningless array descriptions, when those are packed into structures BUGFIX: PDB was not properly parsing unnamed types of the form “SOME_NAMED_THING::__unnamed” BUGFIX: PDB: improved responsivity of IDA while it’s loading PDB information BUGFIX: PIN: IDA could report incorrect address in an exception description BUGFIX: PIN: pintool could crash when running with disabled ST_OVER… trace options BUGFIX: PIN: pintool could report incorrect register values in case of internal exception BUGFIX: Program rebasing could produce incorrect name records in the database BUGFIX: Rebasing the program would lead to erroneous addresses in the “Imports” window, until that window is closed & re-opened BUGFIX: Reloading some PE files could lead to an internal error BUGFIX: Retina: When zooming in/out of the graph view, nodes contents could appear smaller BUGFIX: Right-clicking on an identifier in a node wouldn’t set the cursor position to that identifier before opening the context menu, resulting on context menu items irrelevant for the wanted identifier BUGFIX: Saving the IDB would cause the history to be modified BUGFIX: Selecting a node that is overlapping another node, and Ctrl+dragging (for selecting) from another node was sometimes producing an interr BUGFIX: Selecting by rectangle in graph view was displaying the rectangle at its position * 2 on OSX retina displays BUGFIX: Setting a widget’s icon wouldn’t be reflected in the UI BUGFIX: Setting function prototypes to similar-looking prototypes, but whose arguments come from other type info libraries, could cause IDA to interr 1064 BUGFIX: Specifying an erroneous binary path mapping & then correcting it, could cause IDA to keep requesting for mappings BUGFIX: When calling ‘attach_action_to_menu’ with a menu path starting with “Edit” from the “Recent scripts” window, the action could end up in the ‘Recent scripts’s own Edit menu, instead of in the global one BUGFIX: When changing a variable/argument type in a function frame, ‘Structures’ xrefs might not be updated BUGFIX: When debugging with WinDbg, stepping over some instructions that cause debugging events (e.g., a “call CreateProcess”, causing library load events) might fail & let the program run freely BUGFIX: When debugging, performing unaligned read_dbg_memory() on linux targets could return wrong data (and so could DbgRead() and idaapi.dbg_read_memory()) BUGFIX: When debugging, synchronizing a Hex View with a register, then later syncing with another register would lead the view to be synced with both registers BUGFIX: When importing structures from an IDC strict, some dependencies were missing (if those dependencies were defined later in the file.) BUGFIX: When in graph view, IDA had lost the ability to create groups with only one node (as some users sometimes desire.) BUGFIX: When in graph view, pressing <Enter> to follow an identifier that will cause the view to switch to listing view, then opening a dialog (e.g., renaming that identifier), and finally going back to graph view, could cause some actions to be unavailable (e.g., ‘Hide group’.) BUGFIX: When the DWARF information for “well-known types” (e.g., __m128d) was erroneous, the DWARF plugin was creating erroneously-sized structures, causing the decompiler to fail BUGFIX: When the graph layout is locked, clicking within nodes of user-provided graphs wouldn’t change the cursor & update the highlight BUGFIX: add_menu_item() backward compatibility was broken when the path didn’t contain any slash. E.g., “Options” BUGFIX: an expression like sizeof(struct) was creating an xref to the first struct member; changed it to create an xref to the entire structure BUGFIX: autoanalysis could hang on some wrong code sequences or corrupted files BUGFIX: better distinction between the code/data conversions done automatically by ida and by the user BUGFIX: btree: IDA could abort in rare cases when removing a subtree from a database BUGFIX: cli: IDA could crash trying to print strings coming from very corrupted (i.e., fuzzed) input files with corrupted signatures BUGFIX: compacting a type library in the presence of aliased types could lead to interr BUGFIX: corrupted codeview info could crash ida BUGFIX: corrupted epoc files could crash ida BUGFIX: corrupted xcoff files could crash ida BUGFIX: corrupted database (idb/i64) could lead to memory corruption BUGFIX: dalvik: added “green arrow”, which points to the next executed instruction in the debugger BUGFIX: dbg: dalvik: slot coinciding with “retval” was erroneously ignored when the locals are collected BUGFIX: dbg: gdbserver: reinitialize the registers information when the target architecture is detected BUGFIX: dbg: linux_server: signals from the different threads may arise simultaneously without special order, so in the interr 30057 we must weaken the condition BUGFIX: dbg_read_memory()/DbgRead() could return garbage data for unmapped regions BUGFIX: debugger: request_step_into() could cause interr 40396 BUGFIX: debugging with gdbserver was impossible for mips executables starting at 0x80000000 BUGFIX: defining the same standard structure twice could lead to a crash BUGFIX: deleting structures could break navigation in the structures window BUGFIX: dump typeinfo to idc: in some cases EndTypeUpdating(UTP_ENUM) was missing in the generated file BUGFIX: dumy typeinfo to idc: structures alignments were missing BUGFIX: editing a enum type from the local types view to a wrong definition (for example, reusing a symbol that was used elsewhere) would lead to desynchronization with the enum view; fixed other similar problems BUGFIX: editing a local type would desynchronize it from idb types BUGFIX: export types: anoonymous nested struct/union types were referred by a generated name; this was leading to an incorrect c declaration BUGFIX: fixed internal error in the instruction decoder for mips (opcode 78787878 was causing it) BUGFIX: fixed interr 40208 that could occur when terminating the debugger BUGFIX: fixed interr 518 BUGFIX: fixed interr 599 (the value of a 6-byte pointer could not be printed as a c declaration) BUGFIX: fixed interr 608 BUGFIX: fixed multiple vulnerabilities in the rpc protocol between ida and debuggser servers BUGFIX: fixed some idc nuisances reported on the forum BUGFIX: gdbserver: disabling single-step support could render the debugger module unusable, ida would complain about wrong RESMOD bits BUGFIX: ida could crash after calling StartProcess(“”,””,””) from the python command line while using a remote GDB debugger BUGFIX: ida could crash during analysis BUGFIX: ida could crash or hang on corrupted cli files BUGFIX: ida could crash when stopping the debugger BUGFIX: ida could crash while analyzing a file (if a function tail was deleted during enumerating function tails) BUGFIX: ida could crash with stack overflow while analyzing borland template data BUGFIX: ida could hang trying to load a corrupted pe file BUGFIX: ida could hang trying to load corrupted aout file BUGFIX: ida could hang when analyzing some files BUGFIX: ida could interr when compacting a type library BUGFIX: ida would hang trying to display huge (>2GB) arrays BUGFIX: ida64 would interr trying to calculate arglocs for some functions BUGFIX: idapython: fixed idx.savefile. Previous implementation has failed to open new file BUGFIX: idaw would not accept non-ascii file names from the command line BUGFIX: if an address was marked as ‘notcode’, it would lead to odd situation when the user would define an instruction but ida would immediately delete it BUGFIX: if idb was saved before any planned signatures had been applied, autoIsOk would never return true BUGFIX: if sending a bug report failed, ida would simply tell the user about it; now we show the dialog box once more so that the user can copy the bug report out of ida BUGFIX: if the last thing we do before saving the idb to the disk is to define a big item that uses both STT_VA and STT_MM storage methods, the sparse flags would not be saved correctly to the disk (they would not be marked as dirty) BUGFIX: if the struct indexes got corrupted, some of struct types were permanently missing from the list BUGFIX: importing a struct type from the local types window to the struct view could crash ida BUGFIX: instant debugging: gdb module was not configuring its registers correctly if the target processor was changed at the last moment BUGFIX: mac_server would make one processor core 100% busy after debugging an application BUGFIX: mc16c: ida could crash trying to display an bad instruction BUGFIX: parsing of argument locations in a register with an offset was broken (e.g. rdx^4.2) BUGFIX: pe: ida could complain about truncated input file in some rare cases BUGFIX: pe: ida could hang trying to load a corrupted file BUGFIX: pe: replaced interr 20064 with a silent failure because it may occur on corrupted input files BUGFIX: pe: validation of the number of exported addresses was wrong BUGFIX: ppc: dquai and dquaiq instructions could not be decoded BUGFIX: read-access hardware breakpoints on win64 were broken BUGFIX: setting a new target compiler must lead to recalculation of argument locations (especially for x64 where gcc and ms behave differently) BUGFIX: some type names were displayed as #N (where N is the type number) BUGFIX: symbol addresses in 32-bit map files were relative to the segment start, not to the segment base (pe files were not affected by this bug) BUGFIX: the struct/enum views were not automatically refreshed after idc/python scripts that modify them BUGFIX: tilib was not accepting enum redefinitions if a constant with the high bit set was present (for example, 0x80000000) BUGFIX: tinfo validation could erroneously fail for aliased types BUGFIX: tls callbacks in pe+ files were handled incorrectly BUGFIX: tms320c6: some insns were disassembled incorrectly or not at all BUGFIX: type validation was too strict: an internal type alias may differ from its target in the type modifiers (const/volatile). they are one of the reasons why we have internal aliases after all BUGFIX: types entered by the user were not lowered; it is safer to try to lower them in order to get rid of arrays as function arguments, for example BUGFIX: ui: docks: Prevented creation of empty areas BUGFIX: ui: qt: Fixed disappearing of persistent dock if “Float” button in the dock header is clicked BUGFIX: when debugging, double-clicking on an address in the stack view wouldn’t jump anymore BUGFIX: when exporting types, ida could fail to define a structure that was previously used in a typedef BUGFIX: xrefs to the structure members would disappear after renaming a structure/enum or other manipulations with it BUGFIX: IDA would fail to delete the last history item from the QuickStart dialog. BUGFIX: IDAPython Choose2 instances that were self.Close()ing as a part of an OnCommand() callback could crash IDA. BUGFIX: IDAPython Choose2-based choosers could not be notified of selection changes (through their ‘OnSelectionChange’ callback.) BUGFIX: IDAPython calling ‘term_database’ could leave some windows opened that still need a database, leading to a crash. BUGFIX: Painting widgets from PySide in IDAPython could cause IDA to crash. BUGFIX: When toggling (with <Tab>) between Hex-Rays & IDA View-A, hex-rays could cause IDA View-A to move the cursor. BUGFIX: clicking on opcode bytes AF, CF and DF would result in no highlighting whatsoever. BUGFIX: fixed interr 40208 which could occur if the network connection to the remote debugger was broken BUGFIX: interr 820 could occur when loading dwarf debug info BUGFIX: pc: register tracking was leading to wrong results in omf files BUGFIX: pc: some instructions were erroneously marked as belonging to the function epilog; this would lead to wrong decompilation BUGFIX: read-only page breakpoints would be missed if added into an executable page



This is mainly a maintenance release, so our focus was on fixing bugs. However, there are some improvements too: