PDA

View Full Version : IDA Pro 4.9 Freeware Version

Kayaker
November 2nd, 2007, 22:34
Saw this posted elsewhere. Pretty decent gesture all things considered...


http://www.datarescue.com/idabase/idadownfreeware.htm
LLXX
November 3rd, 2007, 18:45
I just upgraded (rather reluctantly) from 3.6 pro to 4.3 free a few weeks ago... anything of extreme usefulness added in 4.9?

FYI here's 4.3 free:

http://www.datarescue.be/idafreeware/freeida43.exe
dELTA
November 4th, 2007, 06:25
Here are the complete change logs for all new and old versions:

http://www.datarescue.com/idabase/idanew48.htm

(yes, the URL is named stupidly, but it is the right one, and the older ones are linked from it too)
naides
November 4th, 2007, 10:03
The incorporated debugger is the most salient feature.
They also promised to have a Windows CE simulator for debugging, but I am not sure if they delivered that device in the 4.9 version either commercial or free.
Polaris
November 4th, 2007, 18:29
I would say that there are at least a couple of things that make it worth upgrading: the btree upgrade and the demangler support. Also, 4.9 is the version that introduced the stable SDK - I have not verified, but that should means you could use precompiled plugins.
Kayaker
November 4th, 2007, 18:58
Quote:
[Originally Posted by Polaris;70019]I have not verified, but that should means you could use precompiled plugins.


Tried that with a precompiled 4.9 plugin I found on the net.. didn't work. I also tried compiling my own with the 4.9 SDK.. didn't work. There just doesn't seem to be support for plugins, other than the few already provided. Some error about the plugin entry point not found.

The old 4.1 freeware version had an SDK provided by Quasar.
http://quasar.bighost.pl/idafw.html

/me wonders if this shortcoming couldn't be 'fixed', especially considering the ida executables aren't packed..
quasar
November 5th, 2007, 12:36
Have you tried to check if IDP_INTERFACE_VERSION is the same in 4.9 commercial and 4.9 free? If we are lucky this will be only difference between them, if not the same work should be done as for 4.1 freeware (haven't tried, today I'm mostly writing Java code ).
xtc
November 7th, 2007, 17:59
I decided to do the grunt work this time around

I'm not sure what the copyright of the IDA SDK permits, so I've left the .lib's out and provide the tool needed for "fixing" them.

Let me know if you encounter any problems with the libs. I've been as thorough as humanly possible but I can't rule out a few mistakes out of the 1091 exports.
sarge
November 9th, 2007, 17:37
Also, in my case, I've got 4.8 with all the trimings that came with it. It looks like 4.9 free, having some limitations, is actually a backstep. Some serious homework and investigation is involved before I'll dump the paid-for 4.8 to get the free 4.9.

Alternatively, I can of course use both. But given that 4.8 is, so far, reasonably satisfactory for me, I'm not even sure I even want to worry about it.

Maybe by the time they get to 6.0......?

Sarge
LLXX
November 10th, 2007, 04:13
Quote:
[Originally Posted by dELTA;70006]Here are the complete change logs for all new and old versions:

http://www.datarescue.com/idabase/idanew48.htm

(yes, the URL is named stupidly, but it is the right one, and the older ones are linked from it too)
That's the changelog for the Pro version, which mentions
Quote:
Major Features

'instant debugger': the debugger can be launched and a process started without a database. This feature is available locally and remotely and allows the debugger to be attached to any running process in the system. IDA can be used as the default system debugger.
Remote 64-bit debugger for MS Windows 64 running on AMD64/EMT64. IDA itself runs in 32-bit mode while the debugger server runs in 64-bit mode to launch and debug 64-bit applications.
full type system support for the ARM processor. IDA supports the function calling conventions and comments function parameters in the same way as it does on PC. The ARM module has been significantly improved: see a list of all the ARM specific enhancements below.
Wizard-like interface to load new files. IDA assists the user in the initial load process by asking relevant questions about the file. This interface is configurable with XML files.
Free doesn't have a debugger, so #1 and #2 are irrelevant, and I'm not too fond of a "Wizard-like interface" nor "configurable with XML files" either; the load file dialog was OK in the previous versions, though I would appreciate a "custom load" option where you can create the segment mapping and select the appropriate bytes to be loaded from a binary file of any arbitrary format manually. As for the other features... "the btree upgrade and the demangler support" it's not very often that I have to disassemble anything above 10MB, and the demangler is just cosmetic...

I think I'll stay with 4.3 free (and my own currently nameless decompiler/disassembler/analyser) for now.
rotty
November 10th, 2007, 06:33
I have downloaded and installed 4.9 free in VMWare and I can confirm that it has the debugger included Maybe there are features disabled within it, but I could not see them.
dELTA
November 10th, 2007, 08:40
Thanks for the fix xtc, very nice.

Also, from where comes all this info about limitations (except the SDK problem) compared to the "real" 4.9 version? Are these "limitations" only a rumor, or could anyone please point to some real documentation and tangible details about these limitations?

E.g. LLXX, what made you say that there is no debugger in the 4.9 free version?
TiGa
November 10th, 2007, 16:06
Most visible limitations of IDA 4.9 freeware compared to full:

No remote debugging
No Linux debugging (disassembling only)
No other OS support at all (Mac OSX, WinCE)
Only PE, COFF, OMF, ELF and Dos is supported (not NE)
No console version (idaw.exe)
No graphical view (5.0+)
Only x86 family processor module included (metapc)
No x64 support at all
Some FLIRT signatures are out-dated
Fewer included plugins
Difficulty identifying parameters in some cases (no PIT)
Buggy WINE support

The name demangler can be useful sometimes even if only cosmetic.
Code:
jmp     CString::~CString(void)

call    CWnd::GetDlgItemTextA(int,char *,int)

call    CString::Format(char const *,...)

call    CWnd::SetDlgItemTextA(int,char const *)
instead of:
Code:
jmp     ??1CString@@QAE@XZ

call    ?GetDlgItemTextA@CWnd@@QBEHHPADH@Z

call    ?Format@CString@@QAAXPBDZZ

call    ?SetDlgItemTextA@CWnd@@QAEXHPBD@Z


Even with limitations, IDA freeware 4.9 is still a better than average debugger.

TiGa
LLXX
November 11th, 2007, 06:05
Quote:
[Originally Posted by dELTA;70165]E.g. LLXX, what made you say that there is no debugger in the 4.9 free version?


From http://www.datarescue.com/idabase/idadownfreeware.htm
Quote:
The evaluation version has the following limitations

no commercial use allowed
lacks all features introduced in IDA Pro 5.x (5.0, 5.1)
lacks support for many processors, file format, debugging etc..
...and then two lines above it says "IDA Pro 4.9 Freeware Version"

I am thoroughly confused by their site.