Files
Amante4's IDA Plugins - W32Dasm style IDA add-ons (80k).BinDiff v2 Evaluation Version - Plugin for IDA for graphical DIFF'ing and binary analysis (6.79Mb's).
Delphi 6 & Delphi 7 signature files for recognition (691k & 797k).
FLAIR tools v4.9 for IDA - Fast library recognition for IDA (1Mb).
Gerbay's Plugin - enables FLIRT by loading obj/lib files (38k).
ida-x86emu - IDA plugin for single stepping through obfuscated code and updating the disassembly, v0.9.3.2 here (76k).
IDA Free v5.0 - Free version 5.0, perfect for getting started (15.6Mb's).
IDA to SoftICE Symbol Loader v0.02 - Mostek's IDA invaluable plugin (1.25Mb).
IDA IDC Scripts - Courtesy of IDA guru Mammon_ (65k).
IDA MFC 7.0/7.1/8.0 ordinal imports to meaningful names conversions, mirrored here (369k).
IDA MFC import fix by sendersu - MFC 4.2/8.0/9.0 & 10.0, converts ordinal imports to meaningful names (2.23Mb's).
IDA Utilities v5.2 - Flair v5.2, idsutils v5.10, TVision, LoadInt v5.2 (2.08Mb's).
IDA Utilities v6.1 - Flair, idsutils, LoadInt, TiLib & TVision v6.1 (4.57Mb's).
Procdump v1.62 IDB - Procdump IDB released and commented by Rolf Rolles (365k).
The IDA Pro Book 2nd Edition - Excellent unofficial guide by Chris Eagle (6.02Mb's).
Zynamics BinDiff v4.0.1 - Premium Diff'ing tool for IDA (16.5Mb's).
Zynamics BinNavi v4.0.4.19.14393 - Premium graph visualization tool for IDA (49.8Mb's).
Zynamics BinDiff & BinNavi patchs - Use at your own risk! (1.65Mb's).
SDK's
IDA SDK v4.1.4 - SDK for v4.1.4 kernel (402k).IDA SDK v4.3 - SDK for v4.3.0.735 kernel (554k).
IDA SDK v4.5 - SDK for v4.5 (640k).
IDA SDK v4.7 - SDK for v4.7 (v4.7 Build 830) (4.08Mb's).
IDA SDK v4.9 - SDK for v4.9 (v4.8 Build 849 kernel) (6.37Mb's).
IDA SDK v5.0 - SDK for v5.0 kernels (6.58Mb's).
IDA SDK v5.1 - SDK for v5.1 kernels (7.10Mb's).
IDA SDK v5.2 - SDK for v5.2 kernels (7.25Mb's).
IDA SDK v5.5 - SDK for v5.5 kernels (6.28Mb's).
IDA SDK v5.6 - SDK for v5.6.0.931 (5.8Mb's).
IDA SDK v5.7 - SDK for v5.7.0.935 kernel (5.3Mb's).
IDA SDK v6.1 - SDK for v6.1 kernel (7.67Mb's).
IDA SDK v6.2 - SDK for v6.2 kernel (9.55Mb's).
IDA SDK v6.3 - SDK for v6.3 kernel (includes FLAIR, IDS, LOADINT & TILIB utilities, (12.6Mb's)).
IDA SDK v6.5 - SDK for v6.5 kernel (includes utilities above, (14.2Mb's)).
IDA SDK v6.6 - SDK for v6.6 kernel (includes all utilities, (20.5Mb's)).
Guides & Links
Hex Blog - Blog authored by Ilfak.IDA Palace - Lots of useful plugins, guides and scripts for IDA.
IDA Plug-In Writing in C/C++ - Introduction to writing IDA plug-ins by Steve Micallef (530k).
IDAPython - Python integration for IDA allowing scripts to be run (requires Python to be installed).
IDA Tutorial by |nAbOo| - Must read guide to using IDA for newbies (502k).
Released Versions (Archive)
Copies of IDA are often either leaked or stolen from legitimate end-users and appear sometimes in a non-chronological order. v6.7v6.6
v6.5
APT Release
v6.2 / v6.3
v6.1
v5.7 + HexRays 1.2
v5.5
v5.2
v5.1
v5.0
v4.9
v4.3
v6.7 (Jan-Feb 2015)
Released as 'idapronw_hexarmw_hexx64w_hexx86w_141229_LSCSA.exe', this is v6.7.14.1229 and is included for reference only. This appears also to be a leaked copy however without the InnoSetup password the installation cannot proceed. A brute force attack on the password is all but impractical.v6.6 (January 2015)
Released as 'idapronw_hexx86w_hexarmw_140604_8e881c7073422b06ad99444a1b085e32.exe'. This copy is licensed to "Zhou Tao, Jiangsou Australia Sinuo Network Technology Co., Ltd" and includes HexRays & ARM Decompiler. This looks to me like an illegally obtained copy most likely from an IDA reseller either that or Ilfak has gotten slack with checking out his customers.v6.5 (August 2014)
Released as 'Hex-Rays.IDA.Pro.v6.5.READ.NFO-DVT', this is v6.5.14.116 and licensed personally to "Rico Baumgart". My guess would be this is simply an illegally obtained version using false or stolen details although I can't be sure.Lots of Versions from APT (August 2014)
Released to me by an anonymous source (APTguy) although I think I do know who he is ;-), this archive contains many unreleased and old versions obtained from a variety of IDA customers. IDA v5.3IDA Pro Advanced v5.3.0.916 (Windows) (Kaspersky Labs) (c) Hex-Rays
IDA Pro Advanced v5.3.0.916 (Linux) (Kaspersky Labs) (c) Hex-Rays
IDA Pro Advanced v5.3.0.916 (MacOS) (Kaspersky Labs) (c) Hex-Rays
IDA Pro Advanced v5.3.0.916 SDK and Tools (c) Hex-Rays
IDA v5.4
IDA Pro Advanced v5.4.0.921 (Windows) (Kaspersky Labs) (c) Hex-Rays
IDA Pro Advanced v5.4.0.921 (Linux) (Kaspersky Labs) (c) Hex-Rays
IDA Pro Advanced v5.4.0.921 (MacOS) (Kaspersky Labs) (c) Hex-Rays
IDA Pro Advanced v5.4.0.921 SDK and Tools (c) Hex-Rays
IDA v5.5
Hex-Rays Decompiler v1.1.0.90612 for IDA Pro Advanced v5.5 (Kaspersky Labs) (c) Hex-Rays
IDA Pro Advanced v5.5.0.925 (Windows) (Kaspersky Labs) (c) Hex-Rays
IDA v5.6
Hex-Rays ARM Decompiler v1.0.0.100603 for IDA Pro Advanced v5.6 (WBSnet) (c) Hex-Rays
Hex-Rays Decompiler v1.2.0.100201 for IDA Pro Advanced v5.6 (WBSnet) (c) Hex-Rays
Hex-Rays Decompiler v1.2.0.100202 for IDA Pro Advanced v5.6 (Kaspersky Labs) (c) Hex-Rays
IDA Pro Advanced v5.6.0.931 (Windows) (Kaspersky Labs) (c) Hex-Rays
IDA Pro Advanced v5.6.0.931 (Windows) (Microsoft) (c) Hex-Rays
IDA Pro Advanced v5.6.0.931 (Windows) (TrendMicro) (c) Hex-Rays
IDA Pro Advanced v5.6.0.931 (Windows) (WBSnet) (c) Hex-Rays
IDA Pro Advanced v5.6.0.931 (Linux) (Kaspersky Labs) (c) Hex-Rays
IDA Pro Advanced v5.6.0.931 (Linux) (Microsoft) (c) Hex-Rays
IDA Pro Standard v5.6.0.931 (Linux) (TrendMicro) (c) Hex-Rays
IDA Pro Advanced v5.6.0.931 (MacOS) (Kaspersky Labs) (c) Hex-Rays
IDA Pro Advanced v5.6.0.931 (MacOS) (Microsoft) (c) Hex-Rays
IDA Pro Standard v5.6.0.931 (MacOS) (TrendMicro) (c) Hex-Rays
IDA Pro Advanced v5.6.0.931 SDK and Tools (c) Hex-Rays
IDA v5.7
IDA Pro Advanced v5.7.0.935 (Windows) (Kaspersky Labs) (c) Hex-Rays
IDA Pro Advanced v5.7.0.935 (Linux) (Kaspersky Labs) (c) Hex-Rays
IDA Pro Advanced v5.7.0.935 (MacOS) (Kaspersky Labs) (c) Hex-Rays
IDA Pro Advanced v5.7.0.935 SDK and Tools (c) Hex-Rays
IDA v6.1
IDA Pro Standard v6.1 (MacOS) (Fraunhofer-Institut) (c) Hex-Rays
IDA Pro Advanced v6.1 SDK and Tools (c) Hex-Rays
IDA v6.3
IDA Pro v6.3 (Windows) (RSA) (c) Hex-Rays
IDA Pro v6.3 SDK and Tools (c) Hex-Rays
IDA v6.4
IDA Pro v6.4 SDK and Tools (c) Hex-Rays
v6.2 & v6.3 (August 2014)
v6.2.11.1005 & v6.3.12.531, these 2 versions are licensed to Seagate Technology, the story seems to go that these versions were being shared privately amongst several users and one decided to leak the ARM Decompiler. This effectively compromised the IDA license also and therefore the sharers decided the damage had been done, hence the release.v6.1 (June to July 2011)
2 versions of IDA v6.1 have thus far been leaked, the first circa June 2011 was a Chinese copy in the name of "Gu Tian Ren, Cai", this was a functional release although lacking the full file set. The second v6.1 leak has been released to the scene by the group RDW, specifically by sp0raw (an old friend). This is a fully functioning multi-user licensed copy belonging to the security company Eset spol. s.r.o. I can confirm after having spoken with sp0raw this is a 100% leaked copy, a name that appears continually is 'Juraj Malcho' the Chief Research Officer of ESET, sp0raw indicated that as an insurance policy he also obtained other confidential ESET property. The RDW nfo file documents sp0raw's long standing disagreement with Ilfak regarding the licensing of IDA, this should serve as an example to everyone that it is best to heed the advice of Sun-Tzu and "keep your friends close and your enemies even closer".v5.7 (approximate public release date August 2014)
This is v5.7.0.935 & features HexRays v1.2. The 12 user multi-license belongs to Kapersky Lab (filename 'idapro_935_ce72d06d15252ad585109143748a25a0.exe'). In light of the actual release date this copy has most likely been obtained by an ex-employee of Kapersky.v5.5 (18th December 2009)
This is v5.5.0.925t (the 't' denoting a training copy), the file dates suggest the leak came from someone who had attended IDA training a few months earlier and then shared the copy with a few friends. The keygen however isn't nearly as clever as the release would have you believe, a simple patch having been applied to the modulus. Soon after this became public Ilfak announced v5.6. The release name is IDA.Pro.Advanced.v5.5.incl.Hex.Rays.Decompiler.v1.1-iND. Incidentally, Hex-Rays worked out very quickly who leaked this copy, it has been known for a while that IDA is watermarked based on link-time ordering, i.e. the order in which you pass the object files to the linker, as there are probably many modules there are plenty of 'orderings' which makes this a rather good scheme.v5.2 (31st November 2007) & Hex-Rays v1.0
This is v5.2.0.098. Few details are known at the moment about this release, however identity theft seems a likely explanation. The license key reads 'Mach EDV Dienstleistungen, Jan Mach, 1 user, adv, 11/2007'.v5.1 (9th October 2007)
This release is v5.1.0.899 and is a full advanced version licensed to 'GVU - Gerhard Uphoff'. Not much information has yet surfaced about this release, but as is per usual with IDA releases, an illegally obtained purchase or unfortunate customer seems the most likely explanation.
v5.0 (20th July 2006)
This release is v5.0.0.879 and is a full version licensed to 'Paul Ashton - Blue Lane Technologies', it seems likely to me this version was either shared or stolen and then leaked to the scene, oddly this also seems to be Pierre's synopsis as well. Some images I've retained for when they disappear from other parts of the web. The initial ExeTools advertisement for the leak:
A screen grab of the directory:
Finally a whois of the domain:
A full explanation has now been provided by Ilfak in his Hall of Shame. It doesn't seem to have hurt Andre's career though ;-).
26th August 2006
DataRescue have decided fairly recently to close their Message Boards to public access, this seems likely to be a direct result of the wide-spread leaking of v5.0 to the scene, the desired effect of this decision is probably to try and snuff out support requests from pirates, yet this pretty much neglects the status quo since no-one who wasn't a legitimate customer could post any requests or download updates before anyway.v4.9
This release of IDA is v4.9.0.863 (Datarescue.IDA.Pro.Advanced.v4.9.0.863.Russian.Retail.Cracked-ZWT if you are looking for something to plug into Google), this is apparently a legitimate Russian version released by a disgruntled end-user, when launching the program (under a non-Russian version of Windows) a message box will be displayed and IDA will then close. The best solution is from the group Lz0 (DataRescue.IDA.Pro.Advanced.v4.9.0.863.PROPER.FIX.READ.NFO-Lz0), their fix ships the following files to replace.ida.wll
ida64.wll
idag.exe
idag64.exe
idau.exe
idau64.exe
idaw.exe
idaw64w.exe
I have not 'extensively' tested this fix, but the nfo file mentions 2 names I do know fairly well so I'd be inclined to trust it unless information surfaces to suggest otherwise.
