Welcome to IDA 9.0

• With IDAlib, both the C++ and Python APIs can be used from outside IDA to form standalone applications. The resulting program or script doesn't have to be loaded inside IDA, but rather IDA engine is invoked from inside your application.

• This makes developing against the IDA API much easier - if configured correctly, you get auto-completion and debugging in your favorite C++/Python IDE

• NO RCP or IPC to an external IDA process means you get native speed of execution

• With many apps shifting to client-side browser applications we saw the need of a new disassembler for Web Assembly (WASM).

• WASM code is embedded into its own binary file format. Hence we also ship a file loader that decodes the WASM file format

• Both the MIPS disassembler and decompiler got added support for nanoMIPS instructions. The nanoMIPS support is included in the classic MIPS (HEXMIPS) decompiler, so there is no need to purchase an extra license.

• Firmware compiled for nanoMIPS often ships in md1rom format, which is why we added an md1rom file loader to IDA (which includes parsing and applying of debug symbols, if available)

• New decompilers targeting 32- and 64-bit RISC-V code (HEXRV and HEXRV64) are now available.

• We extended the RISC-V processor module to support T-Head extension instructions (used in Xuantie and Allwinner processors)

• The decompiler can now emit try / catch blocks. As the first step, we implemented support for the C++ exception scheme in binaries compiled for x64 using Microsoft VC++

• Most IDAPython APIs now have type annotations, making the API less obstructive to use.

• Python virtual environments are now supported - simply point $PATH to the directory containing the interpreter inside the virtual environment (done automatically by the activation script).

• Objects returned in the Python API are properly zero-initialized.

• Auto-completion in IDA's CLI now disregards __magic_methods__ and auto-generated SWIG methods, which reduces noise and helps finding a particular function easier.

• We massively updated, modernized and extended the number of FLIRT signatures available for use with IDA. As of this release, we provide (and plan to maintain) signatures for the following operating systems, languages, architectures, and software packages:

• Golang:

  • Versions: stable versions from 1.10.0 to 1.22.5 and unstable version 1.23.0-rc1/1.23.0-rc2

  • Windows: x86, x64, arm, arm64

  • Linux: i386, amd64, arm, arm64

  • Darwin: amd64, arm64

• C/C++

  • Windows (MSVC):

    • Architectures: arm, arm64, i386, amd64

    • Packages: ATL, CTL, MFC, Windows SDK 10, Windows SDK 11

  • Linux:

    • Distribution: Ubuntu & Debian

    • Architectures: i386, amd64, arm64, armhf, armel, arm, s390x, mips64el, mipsel, mips, ppc64el

    • Packages: libc6, libselinux1, libpcre2, libidn2, libssl, zlib1g, lib32z1, libunistring, libcurl4-gnutls, libcurl4-nss, libcurl4-openssl, libnghttp2, libidn2, librtmp, libssh, libssh-gcrypt, libpsl, libldap, libzstd, libbrotli, libgnutls28, nettle, libgmp, comerr, libsasl2, libbrotli, libtasn1-6, libkeyutils, libffi, uuid, libprotobuf, heimdal-multidev, musl, libplib, libsdl1.2-bundle (libsdl-console, libsdl-sge, libsdl1.2, libsdl-ocaml, libsdl-image1.2, libsdl-kitchensink, libsdl-mixer1.2, libsdl-net1.2, libsdl-sound1.2, libsdl-ttf2.0, libsdl1.2-compat, libsdl-gfx1.2, libsdl-pango), libsdl2-bundle (libsdl2, libsdl2-gfx, libsdl2-image, libsdl2-mixer, libsdl2-net, libsdl2-ttf)

• The extra signatures are initially available as separate download

• ida-plugin.json now offers a standardized entrypoint for plugins. This enables plugin authors to follow their own plugin directory structure, all they need to do is point IDA to the main plugin entry point. To maintain backward compatibility, IDA will keep loading plugins in the pre-9.0 way for a couple of releases.

With the following directory structure:

plugins
└── ida_greeter
    ├── ida-plugin.json
    └── main.py

A possible ida-plugin.json could look as follows:

{
  "plugin" :
  {
    "name" : "greeter",
    "entryPoint" : "main.py"
  }
}

• We deprecated IDA32 a few versions ago. With IDA 9.0, we’re unifying the IDA binaries targeting 32 or 64 bit code into just one IDA64 binary. This means:

• Number of installed files is cut in half

• Easier life for native plugin maintainers since only one version (__EA64__) needs to be maintained.

• Conversion of IDB files to I64 file format is transparently and automatically performed by IDA64.

• The legacy Enums and Structures views are removed entirely and replaced by Local Types. This also means that struct.hpp and enum.hpp and their counterparts ida_struct and ida_enum disappear from the API. Replacement functionality for both headers/modules is now located (mostly) in typeinf.hpp / ida_typeinf. A porting guide will be available for the release.

• The function prototype editor (aka y shortcut on a function name) now can toggle between the classic free-text one-line editor and a new multi-line editor featuring the usual shortcuts and controls. By the same time, we added basic support for UI-based editing of argument locations, to make prototype syntax less of a hassle to remember.

• It is now possible to specify fixed size for structures and to enable field packing easily

• A refreshed set of shortcuts which better matches the modern OS conventions can now be selected instead of the traditional shortcuts