Adds new Clang-based C++ parser and Golang improvements, plus support for iOS 15 and macOS 12.
Features
- iOS 15 and macOS 12 Support
- Apple has made major changes to the internal format of core OS files. In particular, the DYLD Shared Cache (DSC) has been split into multiple parts. Hex-Rays' Mach-O loader and the helper DSCU plugin have been updated to handle this seamlessly. Hex-Rays have also updated the iOS and Mac debuggers to handle peculiarities of debugging in the new OS versions.
- Clang-based C++ Parser
- In addition to the built-in C parser, IDA now supports an additional parser based on libclang. It allows IDA to handle complex, real-life C, C++, and Objective-C syntax found in STL, MFC, Apple’s XNU and iOS SDK, and Linux kernel headers. We will also soon provide a command-line version to build your own type libraries.
- Golang Improvements
- Hex-Rays took their golang analysis to another level. Detection of golang binaries is more robust thanks to the standard startup code detection, and standard library signatures allow you to ignore unimportant functions. They also use more of the rich metadata present in Go binaries. Functions are automatically grouped into folders by modules and once you enable folders, these groups will be visible. Reflection metadata is parsed to recover types used by the program.
- UI Candy
- The Lock Highlight button now allows you to have multiple permanent highlights in the database, so you can see the important things at a glance.
- New icons to easily hide or unhide the listing elements, like functions, segments, etc.
- Output window gained an option to enable timestamps making it easier to keep track of the various messages printed there.
- Qt libraries have been upgraded to version 5.15.2, offering improved support for HiDPI (4K+) screens, as well as native support for macOS’s “dark mode”.
- Switching between IDA’s windows using a keyboard just got easier: hold down Alt to reveal the corresponding digit you need to press to switch to that window.
- Breakpoints list now uses the standard folder view for grouping. You can enable or disable all breakpoints in a folder with one click.
- New Processors
- Two new processor modules were added in this release: Cadence Tensilica Xtensa and the Renesas RX series.
- Type System
- Basic type system support has been enabled for all processors. This means that you can now use C syntax declarations for structures and enums via the Local Types editor or by parsing C headers. DWARF types are also imported, when available. FYI, DWARF5, the new version of the debug format, which is the default since GCC 11, is now supported.
- Decompilers
- Hex-Rays have ported their decompiler to MIPS64. They have also added support for some of the custom instructions of Cavium OCTEON MIPS processors used in advanced network equipment. Currently only n64 ABI is supported for MIPS64. The existing decompilers also received numerous improvements and fixes; for example, the new extended flow guard (XFG) calls are handled in x64 and ARM64 Microsoft Windows binaries.