http://www.hex-rays.com/idapro/55/index.htm

Hex-Rays 1.1

The decompiler uses debug information if it is available: in this case, even local variable names and types will be restored. If there is no debug information, the decompiler will still generate correct and precise output. In fact, it is designed to work without debug information, which means that virtually any compiler-generated executable can be analyzed and turned into C output.

New pricing and support plans

If you upgraded your IDA/Hex-Rays copy the last month with older prices, do not worry. For you, we will add a month of support for the IDA license, and three months of support for Hex-Rays Decompiler.

We will continue to accept old-style upgrade orders until 12 October 2009.

How to request the new versions

https://www.hex-rays.com/updida.shtml

and expect a message from us within 5-10 minutes. Sometimes we do not have your email in the database, so please specify it (otherwise we will have no means of communicating with you).

To request the new version of the decompiler, please use Edit, Plugins, Hex-Rays, Check for updates in IDA.

Is your key too old?

http://www.hex-rays.com/idapro/idaorder.htm

We will arrange an electronic delivery to existing customers.

That's all folks! Enjoy the release. ]]> http://hexblog.com/2009/06/ida_pro_55_and_hexrays_11_have.html http://hexblog.com/2009/06/ida_pro_55_and_hexrays_11_have.html Mon, 15 Jun 2009 17:30:59 +0100 After many months of work, IDA Pro 5.5 is now in alpha stage and this week the beta will be out for testing. http://hexblog.com/2009/06/ida_pro_55_goes_alpha.html http://hexblog.com/2009/06/ida_pro_55_goes_alpha.html IDA Pro Tue, 02 Jun 2009 15:12:44 +0100 ]]> http://hexblog.com/2009/05/decompiling_floating_point.html http://hexblog.com/2009/05/decompiling_floating_point.html Decompilation Tue, 05 May 2009 13:13:32 +0100 Just a quick note for interested parties: we prepared the new demo version of IDA Pro. The new demo includes the bochs debugger. The debugger is fully functional with just one limitation: it will become inactive after a number of commands. I prefer to tell you this in advance rather than this limitation to be discovered in the middle of a heavy debugging session ;)

Here's the download link:

http://www.hex-rays.com/idapro/idadowndemo.htm

Enjoy!

VMWare's GDB stub is very basic, it doesn't know anything about processes or threads (for Windows guests), so for anything high-level we'll need to do some extra work. We will show how to get the loaded module list and load symbols for all them using IDAPython.

http://www.hex-rays.com/idapro/debugger/index.htm

Direct links to tutorials are available here:

http://www.hex-rays.com/idapro/idasupport.htm

I know, I know - we need to add 64-bit support for all platforms, port the Bochs debugger module to Linux, and... any other suggestions? I personally would love to have source level debugging, yet it requires some substantial changes to the kernel. We probably will move in this direction, sooner or later...

In addition to numerous small and not that small improvements, the new version will have three debugger modules: bochs, gdb, and windbg, selectable on the fly (the active debugger session will be closed, though ;))

• With the bochs debugger, we offer three different worlds: run-any-code-snippet facility, windows-like-environment for PE files, and any-bochs-image bare-bone machine emulation mode. You can read more about this module in our blog: http://hexblog.com/2008/11/bochs_plugin_goes_alpha.html
  
• With gdb, x86 and arm targets are supported. Among other things, it is possible to connect IDA to QEMU or debug a virtual machine inside VMWare. We tried it iPhone as well. However, while it works in some curcimstances, there were some problems on the gdbserver side.
  
• With windbg, user and kernel mode debugging is available. The debugger engine from Microsoft, which is currently the only choice for driver and kernel mode debugging, can be used from IDA. It can automatically load required PDB files and populate the listing with meaningful names, types, etc. Speaking of PDB files, IDA imports more information from them: local function variables and types are retrieved too, c++ base classes are handled, etc.
  

The gdb and windbg debugger modules support local and remote debugging. We tried to make the debugger modules as open as possible: target-specific commands can be sent to all backend engines in a very easy and user-friendly way.

As usual, better analysis and many minor changes have been made. If you spend plenty of time analyzing gcc generated binaries, you'll certainly appreciate that IDA handles its weird way of preparing outgoing function arguments. Now it can trace and find arguments copies to the stack with mov statements.

The new IDA will support Python out of box, thanks to Gergely Erdelyi, who kindly agreed the Python plugin to be included in the official distribution. In fact, the main IDA window will have a command line to enter any python (or other language) expressions and immediately get a result in the message window.

We will prepare the detailed list of improvements later this week.

http://www.binary-art.net/?p=1002

This is MIPS emulator for Linux. It can generate an IDC script after emulation, which then can be applied to the database and make it more readable.

Background Intelligent Transfer Service (BITS) is a component of modern Microsoft Windows operating systems that facilitates prioritized, throttled, and asynchronous transfer of files between machines using idle network bandwidth.

The web page ends with a list of third-party applications that use BITS. However, as any technical method, it can be used for evil purposes as well. Eric Landuyt analyzed a malware that exploits it for bad:

http://www.datarescue.com/laboratory/trojan2008/index.html

I liked the "proof of concept" WinDbg script that runs the malware in a controlled manner. Breakpoints with actions are very powerful, indeed.

Nice work, Eric!

This is not the first book about IDA Pro. However, this is the first book I recommend to anyone using IDA Pro because of the following points:

• Comprehensive: it describes all major IDA features by starting at the beginning and going all the way to the end. Experienced users may be tempted to skip the first few chapters; resist this temptation and you will discover something new (I did :)
• Accurate: it is very difficult to be detailed and precise when describing such a complex product. Chris does it excellently well.
• Real: handles real world malware, packers, and obfuscated code
• No fillers: it is direct and concise
• Profound: this is not just a collection of recipes or tricks, but will give you a better understanding of the IDA architecture, thus saving you from unnecessary frustration. Knowing the limitations of your tool is just as important as knowing its capabilities.

If you want to use IDA efficiently, get your copy from No Starch Press!

UPD for numerologists: the book has exactly 640 pages, no less, no more! ]]> http://hexblog.com/2008/08/the_ida_pro_book_1.html http://hexblog.com/2008/08/the_ida_pro_book_1.html IDA Pro Tue, 26 Aug 2008 18:53:07 +0100