首页
社区
课程
招聘
[分享]IDA v5.4 release is not that far away
发表于: 2009-2-3 11:53 7440

[分享]IDA v5.4 release is not that far away

2009-2-3 11:53
7440
From hex blog

I'm happy to inform you that we are entering the beta stage of IDA v5.4!

In addition to numerous small and not that small improvements, the new version will have three debugger modules: bochs, gdb, and windbg, selectable on the fly (the active debugger session will be closed, though ;))

With the bochs debugger, we offer three different worlds: run-any-code-snippet facility, windows-like-environment for PE files, and any-bochs-image bare-bone machine emulation mode. You can read more about this module in our blog: http://hexblog.com/2008/11/bochs_plugin_goes_alpha.html

With gdb, x86 and arm targets are supported. Among other things, it is possible to connect IDA to QEMU or debug a virtual machine inside VMWare. We tried it iPhone as well. However, while it works in some curcimstances, there were some problems on the gdbserver side.

With windbg, user and kernel mode debugging is available. The debugger engine from Microsoft, which is currently the only choice for driver and kernel mode debugging, can be used from IDA. It can automatically load required PDB files and populate the listing with meaningful names, types, etc. Speaking of PDB files, IDA imports more information from them: local function variables and types are retrieved too, c++ base classes are handled, etc.

The gdb and windbg debugger modules support local and remote debugging. We tried to make the debugger modules as open as possible: target-specific commands can be sent to all backend engines in a very easy and user-friendly way.

As usual, better analysis and many minor changes have been made. If you spend plenty of time analyzing gcc generated binaries, you'll certainly appreciate that IDA handles its weird way of preparing outgoing function arguments. Now it can trace and find arguments copies to the stack with mov statements.

The new IDA will support Python out of box, thanks to Gergely Erdelyi, who kindly agreed the Python plugin to be included in the official distribution. In fact, the main IDA window will have a command line to enter any python (or other language) expressions and immediately get a result in the message window.

We will prepare the detailed list of improvements later this week.

[课程]Android-CTF解题方法汇总!

收藏
免费 0
支持
分享
最新回复 (15)
雪    币: 331
活跃值: (56)
能力值: ( LV13,RANK:410 )
在线值:
发帖
回帖
粉丝
2
太强大了。等着膜拜。

windbg太难看了。
2009-2-3 13:06
0
雪    币: 247
活跃值: (10)
能力值: ( LV7,RANK:100 )
在线值:
发帖
回帖
粉丝
3
期待中~~~
2009-2-3 13:45
0
雪    币: 247
活跃值: (10)
能力值: ( LV7,RANK:100 )
在线值:
发帖
回帖
粉丝
4
https://www.hex-rays.com/updida.shtml

什么时候能够搞到最新的啊???
2009-2-3 13:47
0
雪    币: 1844
活跃值: (35)
能力值: ( LV3,RANK:30 )
在线值:
发帖
回帖
粉丝
5
估计明年今日还没有到我们的手里,所以就不用期待了
2009-2-3 17:06
0
雪    币: 200
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
6
路过而已
2009-2-3 17:21
0
雪    币: 200
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
7
路过,学习ing...
2009-2-3 20:21
0
雪    币: 2134
活跃值: (14)
能力值: (RANK:170 )
在线值:
发帖
回帖
粉丝
8
非常期待,bochs, gdb, 和windbg模块哈,还有命令行支持和python支持,口水ing ...
2009-2-3 22:26
0
雪    币: 205
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
9
the new version of Interactive Disassembler Pro got released a few days ago (2009/01/29).

here are some highlights of new version:

Three new debuggers
We continue to add more debugger modules to IDA and improve the existing ones. This version introduces three new debuggers: bochs, gdb, and windbg.

Each of these debuggers deserve a separate article, so only the most interesting highlights here:

Bochs: can run any 32bit code, from a few instructions to whole operating systems. Just click F9 and immediately switch to running state. In fact, any code snippet can be executed
in a safe and user friendly way. With the bochs debugger, we offer three different worlds: run-any-code-snippet facility, windows-like-environment for PE files, and any-bochs-image
bare-bon machine emulation mode. Please read more about Bochs plugin here: http://hexblog.com/2008/11/bochs_plugin_goes_alpha.html

GDBServer: x86 and arm targets are supported. Among other things, it is possible to connect IDA to QEMU or debug a virtual machine using VMWare.

Windbg: both user and kernel mode debugging are available. IDA can automatically load required PDB files and populate the listing with meaningful names, types, etc. Speaking
of PDB files, IDA imports more information from them: local function variables and types are retrieved too, c++ base classes are handled, etc.

The GDBServer and Windbg debugger modules support local and remote debugging. We tried to make the debugger modules as open as possible: target-specific commands can be
sent to all backend engines very easily.

Better analysis
IDA understands GNU-style function arguments (when they are moved onto the stack instead of being pushed). Analysis is more efficient in general and does does fall into the
instruction creation/deletion loop. Many FLAIR signatures have been updated and new ones added.

Command line
The command line was present in IDA since very long time but it was not turned on by default. This version activates it and empowers it with the following interpreters:

IDC: native IDA language (we added support for global variables)
Bochs: to send arbitrary commands to the Bochs debugger
GDBServer:to control GDBServer targets
Windbg: to access Windbg extensions and kernel information
Python : to program IDA in the popular language

The new IDA supports Python out of box, thanks to Gergely Erdelyi, who kindly agreed the Python plugin to be included in the official distribution.


for a list of complete changes see IDA Pro 5.4 feature list
2009-2-5 01:01
0
雪    币: 205
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
10
also new version of Hex-Rays Decompiler got out the same date with these changes:


+ added block comments
+ added support for function comments
+ added command to hide cast operators from the output (hotkey is \)
+ added warnings. they can be suppressed by WARNS1 parameter in hexrays.cfg
+ derived types are saved into the database: now decompilation results should not differ between sessions
+ improved the speed of batch decompilation: better handling of decompilation queue
+ references to " r" and " s" special stack frame members are renamed to "retaddr" and "savedregs"
+ mach-o: __cls_refs and __message_refs sections are handled in a special way
+ added special handling for elf .got sections
+ added special handling for mach-o __pointers section
+ reserved words can not be used as local variable names. the function name is rejected too
+ if the user requested a bitfield for a constant, use it even if some bits have no corresponding symbolic names; these bits are printed in hex
+ added rule: *(x+y) => x[y]
+ sdk: added get_line_item() to facilitate mapping of line items
+ sdk: added hxe_text_ready and hxe_print_func events
bugfix: expressions with pointers to arrays were suboptimal; if such types were used for function arguments, the output would be wrong
bugfix: small (4 byte) arrays could be used as scalars in the output, which was wrong
bugfix: if instruction bytes were patched without reanalyzing them, the decompiler could interr
bugfix: error message for 16bit applications was wrong
bugfix: decompiler could create fastcall functions with __int64 register arguments
bugfix: tail call to unknown function could lead to interr
bugfix: the decompiler could crash in some exceptional circumstances
bugfix: fixed a typo that could lead to a crash
bugfix: if a funcarg was also represeting the return value, the function prototype could be modified during analysis
bugfix: could interr on a linux syscall if it was the last instruction of the function
bugfix: if the user modified a structure field type, it would be detected by the decompiler
bugfix: mul64 recognizer could create an interr


see here for more info!
2009-2-5 01:07
0
雪    币: 233
活跃值: (392)
能力值: ( LV3,RANK:20 )
在线值:
发帖
回帖
粉丝
11
不要贴了,只是一块可望而不可及的一块肥肉。
2009-2-5 09:36
0
雪    币: 247
活跃值: (18)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
12
等YAG
2009-2-5 11:05
0
雪    币: 23
活跃值: (30)
能力值: ( LV4,RANK:50 )
在线值:
发帖
回帖
粉丝
13
没有地方能得到正式版,遗憾啊
2009-2-5 17:41
0
雪    币: 184
活跃值: (1298)
能力值: ( LV6,RANK:90 )
在线值:
发帖
回帖
粉丝
14
经济危机了,很难等到
大家一起团购吧

http://bbs.unpack.cn/viewthread.php?tid=32504&extra=page%3D1
2009-2-6 19:47
0
雪    币: 202
活跃值: (16)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
15
什么时候能够搞到最新的啊???
2009-2-7 22:05
0
雪    币: 93908
活跃值: (200199)
能力值: (RANK:10 )
在线值:
发帖
回帖
粉丝
16
CLOSE.
2009-2-8 00:00
0
游客
登录 | 注册 方可回帖
返回
//