IDA Pro 5.5 goes alpha

After many months of work, IDA Pro 5.5 is now in alpha stage and this week the beta will be out for testing.

In this version many small and big improvements took place, here is a partial change list:

  • PC module improvements
  • PE loader improvements
  • ARM processor module improvements
  • Improved Hex-View:
    • Edit support
    • Data display format: words, dwords, doubles, …
    • Unicode or custom codepages
  • Bochsrc file loader: load a bochsrc file and start debugging the disk image
  • Windows Crash dump support: IDA now accepts MS Windows Crash dump files. Load the crash dump file and IDA Pro will create a database with the memory contents of the crash (if they were included). You can also run the Windbg debugger module and issue commands to the debugger engine to investigate more about the crash
  • Docking interface: all windows are now dockable, allowing you to make optimal use of the desktop space.

This is for example how a desktop configuration could look like:

main interface example

And this is another desktop configuration for the debugger:

debugger interface example

This entry was posted in IDA Pro. Bookmark the permalink.

11 Responses to IDA Pro 5.5 goes alpha

  1. Andrew says:

    What about sourse files support? It will be really useful for my job as I am developing security and very often need to see how it looks in disassembler, and also browsing what hackers managed to change there.

  2. Rolf Rolles says:

    Wow, that was quick! 5.4 just came out a few months ago…

  3. Hello Andrew,
    Sorry not in this version, but we are planning to add support for source code debugging in the future.

  4. Anonymous says:

    Hi Ilfak,
    Did you ported the Bochs module to Linux? And, can you patch a process in memory when you’re debugging it?

  5. Jerry says:

    Thanks for the great work. I’m definitely excited about the improved HEX view & ARM updates.

  6. Jonathan Stuart says:

    How about allowing editing of actual instructions and then rebuilding the executable? I see that hex-editing will be there, but something where you could change an instruction (even if it decreases or increases the size of the executable) and have IDA recalculate all address references in other instructions — and in the executable header, such as the entry point address — then allowing you to rebuild whatever executable or binary you loaded would be very cool.
    Is such a thing feasible? I haven’t used IDA in a while, so maybe I’m a bit behind and some work has been done.
    Though, I did love how it had support for multiple archs and could tell what compiler / libc was used (call printf is so much more helpful than call 0x7ffbc114).

  7. The new UI looks absolutely fantastic, much less dispersive than the current one – expecially the debugger configuration.
    Anyway, can you comment a bit more about PC module improvements and PE loader improvements?
    Great job!

  8. @Rolf: Not that quick, we are June already ;)
    @Anon: Sorry Bochs debugger module is not ported to linux. Yes you can edit the process memory while debugging it.
    You could do that right now with the “Patch” menu, scripting and SDK.
    @Jon: Sorry IDA Pro does not allow you to edit and then rebuild the executable. In a sense, you can do that by taking a listing, re-assembling it and inserting it back to an appropriate place in the executable.
    @Paolo: A full change list will be released soon.

  9. JC says:

    Docking interface – awesome!. my suggestion: remove File->Create Exe file option it’s confusing and mostly useless

  10. Nico says:

    Hi Ilfak,
    “ARM module improvement” -> are we gonna be able to single-step ARM thumb code?
    Thank you,

  11. Igor Skochinsky says:

    @Nico: we do support single stepping Thumb code (for platforms where debugging is available). If you have any issues, please contact support!