The release of IDA Pro 9.0.240925 (September 2024) marks a fundamental shift in the architecture and capabilities of the world’s most renowned reverse engineering tool. This version is not merely an incremental update; it represents a major modernization effort by
, introducing headless processing, expanded architecture support, and a significant overhaul of its underlying core. 1. The Dawn of Headless Analysis: idalib
Perhaps the most transformative feature in IDA 9.0 is the introduction of
. Historically, IDA Pro was designed as an interactive, UI-driven application. While scripting was possible via IDAPython, it still largely relied on the IDA environment.
allows developers to use IDA's powerful C++ and Python APIs to create standalone, headless applications. This allows for the integration of IDA’s analysis engine into automated CI/CD pipelines, bulk malware analysis clusters, and custom security tooling without the overhead of the graphical user interface. 2. Modernizing Architectures: RISC-V and nanoMIPS
As the hardware landscape evolves toward open standards and specialized embedded systems, IDA 9.0 has expanded its reach: RISC-V Decompiler
: Responding to high community demand, IDA 9.0 introduces a dedicated RISC-V decompiler
and enhanced disassembler extensions. This is critical for security audits of modern processors and IoT devices. nanoMIPS Support
: Designed for efficiency in constrained environments, nanoMIPS is now fully supported by both the disassembler and decompiler WASM Support IDA Pro 9.0.240925
: WebAssembly (WASM) has become a mainstay of modern web and edge computing; IDA 9.0 includes a new WASM disassembler and file format loader to tackle these binaries. 3. Advanced Decompilation and FLIRT
Reverse engineering complex C++ binaries has long been a manual, arduous task. IDA 9.0 addresses this with: C++ Exception Handling : The decompiler now explicitly supports C++ exception handling
, allowing analysts to unravel obfuscated control flows that previously appeared as messy code blocks. FLIRT Manager
: The Fast Library Identification and Recognition Technology (FLIRT) received its first major overhaul in years. A new FLIRT Manager
allows users to search, manage, and tentatively apply thousands of new signatures from a centralized interface, significantly speeding up the identification of library code. 4. Deprecation of IDA32 and UI Refinements
The transition to a purely 64-bit future is finalized in this release. IDA32 is no longer included
, as the 64-bit version of IDA now handles both 32-bit and 64-bit binaries seamlessly. Additionally, the UI has undergone refinements to improve readability and workflow, including metadata descriptors for plugins and a more intuitive layout for core windows. Conclusion
IDA Pro 9.0.240925 is a "sharpening of the Swiss Army knife". By decoupling the engine from the UI with idalib and embracing emerging architectures like RISC-V, Hex-Rays ensures that IDA remains the essential backbone for malware analysts, vulnerability researchers, and software engineers worldwide. specific technical guide on using idalib for automated analysis or a into the new RISC-V decompiler? IDA 9.0 | Hex-Rays Docs 30 Sept 2024 — The release of IDA Pro 9
* IDA 9.0 Highlights. * Licensing changes. * Headless processing with idalib. * New RISC-V Decompiler and Disassembler Extensions. Hex-Rays docs Discover IDA 9.0: Exciting New Features and Improvements 1 Oct 2024 —
To add a new feature to IDA Pro 9.0.240925 , you have several options depending on whether you want to automate a task, create a UI extension, or build a standalone tool using IDA's engine. 1. Scripting with IDAPython
This is the fastest way to add functionality. You can write Python scripts to automate analysis, rename functions, or manipulate data. Documentation: Refer to the IDAPython API for comprehensive class and function references. Place your scripts in the folder of your IDA installation or run them directly via
IDA Pro 9.0 (including build 9.0.240925) marks a major architectural shift for the Interactive Disassembler, moving toward a unified 64-bit environment and introducing headless processing capabilities. Core Architectural Changes
Single Unified Executable: The "64" suffix has been dropped from the main executable. A single IDA instance now handles both legacy 32-bit and 64-bit databases, automatically converting them to the new 9.0 format.
Removal of IDA32: The legacy 32-bit version is no longer included.
idalib (Headless IDA): A significant new feature that allows developers to use IDA's core engine programmatically outside of the GUI. This enables hosting IDA in standalone executables or Python interpreters for automated processing. Reverse Engineering Enhancements
WASM & RISC-V Support: Version 9.0 introduces a WebAssembly (WASM) module featuring a disassembler, file loader, and processor. It also adds new RISC-V decompiler and disassembler extensions. Plugins: IDA 9
Rust Analysis: Improvements to FLIRT (Fast Library Identification and Recognition Technology) now include signatures for Rust, enhancing the identification of standard Rust library functions.
Advanced Type System: The old structures and enums windows have been replaced by a single Shift+F1 window for managing types. A free-text C editor is available for defining complex related types more efficiently. User Interface & Scripting
IDAPython Improvements: Python scripting is more integrated, with a setup script that allows the ida_pro module to be used in external IDEs for easier debugging. The CLI now features auto-completion and improved documentation.
Navigation Logic: In graph mode, IDA now automatically navigates to single successors or predecessors without requiring a dialog box.
Collaboration with Teams: Large-scale analysis can now benefit from Teams integration, which was moved directly into the main interface to facilitate collaborative reverse engineering. Summary of Key Features Description Executables Unified 64-bit binary for all file types. Automation idalib for headless, programmatic access to the IDA kernel. Processors Added support for WASM, RISC-V, and nanoMIPS. SDK
Substantial changes; binary plugins must be rebuilt for 9.0 compatibility. IDA 9.0 - Hex-Rays docs
Overview
IDA Pro 9.0 marks the end of the 32-bit ida.exe era on Windows, introducing a fully native 64-bit application architecture. While previous versions ran as 32-bit processes (limiting memory usage for large datasets), IDA 9.0 runs natively as a 64-bit process.
However, the most impactful architectural feature introduced in this version is the decoupling of the user interface from the analysis kernel, enabling Native ARM64 support and the foundation for IDA in the Cloud.
github.com/eset/idanatives for recompiled versions.ida_hexrays for decompiler operations.No major release is without bugs. The community has reported a few issues specific to this build:
Options > Graph > Use software renderer.MAX_FUNC_SIZE in cfg/hexrays.cfg to 0 (no limit) or break the function manually.asyncio may segfault due to GIL conflicts.
idaapi.msgs.Hex-Rays has promised a hotfix (9.0.241010) expected in mid-October 2024 to address the GPU rendering issues.