IDA 9.5 is here, and it’s one of our biggest releases yet.

Three new decompilers for Android Dalvik, Infineon TriCore, and Qualcomm Hexagon significantly expand platform coverage, while Apple kernelcache and DriverKit analysis take a major step forward. Support for AVX/SSE, Armv9, MIPS Release 6, WebAssembly 3.0, PowerPC, and ARC gets stronger too.

Decompilation of Rust, Swift, Go, and modern C++ also improves, notably through verbatim name preservation and individual bitfield recovery, while recursive decompilation expands across call graphs to reveal entire subsystems.

Other enhancements include performance improvements, bug fixes, the new Pathfinder widget, a UEFI loader and plugin, FLIRT 2.0 signatures that recognize far more library functions, a revamped demangler and parser, and Domain API upgrades.

Alongside IDA 9.5, Hex-Rays is also introducing three major companion capabilities designed for the agentic AI era:

• IDA MCP, Hex-Rays' official advanced MCP server, connects IDA to frontier LLMs while reducing token consumption by approximately 20% compared to conventional function-calling IDA MCP implementations.

• Assist is an AI harness purpose-built for reverse engineering, boosting analyst productivity without requiring users to leave IDA. It augments AI models with specialized contexts, memories, and tools.

• IDA Pro Headless enables fleets and swarms of AI agents to run IDA with their own licenses. Optimized for agentic workloads, it offers a smaller memory footprint and faster startup times, while an updated license server lets agents obtain or borrow licenses for execution in pipelines, VMs or sandboxes.

Hex-Rays is also introducing a new optional Malware Analysis add-on alongside IDA 9.5, that lets analysts unpack evasive binaries, step through suspicious code in isolated execution environments, and import runtime artifacts directly from sandboxes such as VMRay and Speakeasy.

Meanwhile, IDA Home 9.5 now includes 11 cloud decompilers instead of 2 and 70+ disassemblers, at the same price.

Whether you're reversing Android apps, automotive ECUs, DSP firmware, or macOS kernels, IDA 9.5 helps you spend less time navigating complexity and more time finding answers. Here's what's new:

Download IDA 9.5

Explore what's new in IDA 9.5

Select a topic to jump directly to that section.

Three new decompilers
Dalvik, TriCore, Hexagon

Smarter decompilation
Bitfields, AVX, switch reovery

Apple kernalcache analysis
KEXTs, IOKit, DriverKit

Firmware and platform support
UEFI, WebAssembly, consoles

Function recognition and names
FLIRT 2.0, Rust, Go, Swift

Workflow improvements
Pathfinder, Jump Anywhere, HTML export

Performance and reliability
Teams, Lumina, large binaries

IDA Home upgrades
11 cloud decompilers, 70+ disassemblers

AI and malware analysis
Assist, Malware Analysis, IDA MCP

Read the full release notes 
The full release notes cover hundreds of improvements and fixes across every part of IDA.

Get IDA 9.5
Downloads and licensing

Three new decompilers: Dalvik, TriCore, and Hexagon

Dalvik: Android bytecode, decompiled to Java

IDA now turns Android DEX bytecode into Java pseudocode. Classes, fields, methods and parameters are real entities: rename or retype one, and the change flows through every view.

The new class view is where you work. It reads like source: string concatenation shows as "a" + b instead of a StringBuilder chain, nested classes print as Outer.Inner, and try/catch/finally blocks are rebuilt. Original names come back from Kotlin metadata and debug info when the file still carries them, and multidex apps are handled as one program.

TriCore: automotive and industrial firmware

The new decompiler for Infineon TriCore supports both the EABI and Tasking ABI families. Pointer arguments are recognized in the address registers, and the division step sequences of pre-1.6 cores fold back into a single, readable division.

Hexagon: Qualcomm DSP code

The Qualcomm Hexagon (QDSP6) decompiler models what makes DSP code hard to read: packet semantics, hardware loops, predication and compound branches. HVX vector and system instructions appear as intrinsics named after Clang's, so you can look them up straight away.

Pseudocode that reads like the source

Bitfields, finally readable

Shift and mask arithmetic is gone. Once your types are defined, the decompiler shows bitfield accesses as plain member accesses, on every supported architecture. An MSVC xor toggle that used to fill a whole line now reads as it was written:

// 9.4
*(_DWORD *)p ^= ((unsigned __int8)*(_DWORD *)p ^ (unsigned __int8)(*(_DWORD *)p + 1)) & 0xF;
// 9.5
++p->a;

AVX, AVX2 and AVX-512 without __asm blocks

The new avxlifter turns vector code into C and _mm* intrinsics instead of inline assembly. Wide loads and stores become plain assignments, packed logic becomes C operators, and scalar min/max and FMA become ordinary math.

// 9.4
__asm { vmovapd ymm0, ymmword ptr [rcx]; vaddpd ymm0, ymm0, ymmword ptr [rdx] }
// 9.5
return _mm256_add_pd(*m1, *m2);

Smarter switch-case recovery

Switches that compilers split into binary-search trees are put back together, with real case labels, sorted cases and clean fall-through instead of chains of goto. The decompiler now finds jump tables with its own data-flow analysis on every architecture, so switches the disassembler missed are recovered too.

More highlights

• Scattered register pairs: 64-bit values split across reversed or non-adjacent registers on 32-bit targets become a single variable.
• Jump to function pointer targets: Enter on a called struct member goes to the function it points to, not its declaration.
• Split variable for registers, not just stack variables.
• Recursive Create C file: export a function and all its callees, decompiled from the leaves up for better prototypes.

Apple kernelcaches, done right

IDA 9.5 does for Apple kernelcaches what 9.4 did for dyld shared caches. Instead of one giant Mach-O, a kernelcache is now treated as what it is: a collection of KEXTs.

• KC Index: browse every KEXT and map them on demand, starting with the kernel.
• IOKit classes reconstructed: class hierarchies, vtables and virtual methods, even for classes the type library only forward-declares.
• Typed allocations: on iOS 16 and macOS 13 and later, IDA reads kalloc_type descriptors so allocations get their real types.
• Search the whole cache: find symbols, strings and addresses across every KEXT, loaded or not, even on stripped caches.
• Resolved arm64e virtual calls: authenticated calls get cross-references to the methods they can reach. On a fully mapped kernelcache, 92% of them name their callee.

DriverKit drivers get the same treatment: classes, vtables and IORPC messages are recovered and named. In a macOS 26 DriverKit shared cache, all 599 classes are now typed correctly, up from 49.

Firmware, consoles and the web

UEFI: whole firmware images in one database

Load an SPI flash dump, a capsule body or a firmware volume, and the new UEFI plugin does the groundwork for you. Service tables like gBS and gRT are found and typed, protocols are named, and known protocol calls decompile to readable code:

EFI_STATUS __fastcall DiskIoDxe(EFI_HANDLE ImageHandle, EFI_SYSTEM_TABLE *SystemTable)
{
  ...
  DiskIoDxe_gST = SystemTable;
  DiskIoDxe_gBS = SystemTable->BootServices;
  DiskIoDxe_gRT = SystemTable->RuntimeServices;
  v7 = DiskIoDxe_gBS->LocateProtocol(
         &DiskIoDxe_gEfiDevicePathUtilitiesProtocolGuid,
         nullptr,
         (void **)&DiskIoDxe_gEfiDevicePathUtilitiesProtocol);
  ...
  DiskIoDxe_mEfiDriverBindingProtocol.ImageHandle = ImageHandle;
  DiskIoDxe_mEfiDriverBindingProtocol.DriverBindingHandle = ImageHandle;
  v11 = DiskIoDxe_gBS->InstallMultipleProtocolInterfaces(
          &DiskIoDxe_mEfiDriverBindingProtocol.DriverBindingHandle,
          &DiskIoDxe_gEfiDriverBindingProtocolGuid,
          &DiskIoDxe_mEfiDriverBindingProtocol,
          &DiskIoDxe_gEfiComponentNameProtocolGuid,
          &DiskIoDxe_mEfiComponentNameProtocol,
          &DiskIoDxe_gEfiComponentName2ProtocolGuid,
          &DiskIoDxe_mEfiComponentName2Protocol,
          0);
  ...
}

A new UEFI protocols window lists every install, locate and notify, and cross-references link protocol calls to their implementations across modules.

WebAssembly 3.0, in minutes

Modules using garbage collection, typed references, exceptions or SIMD now load, including Kotlin/Wasm. Large modules load several times faster: a 27.8 MB module with 68,069 functions now loads in 1 min 17 s instead of almost 40 minutes.

Game consoles and more

PlayStation 3, Xbox 360, Wii U and PSP binaries get first-class support, from ILP32 PowerPC code to AltiVec intrinsics named after the Xbox 360 XDK. MIPS Release 6 is fully supported in the disassembler and decompiler, and the Renesas RX processor module now supports big-endian mode.

More functions named, real names kept

FLIRT 2.0

Classic FLIRT recognizes a library function by its bytes, but forgets where its calls lead. FLIRT 2.0 signatures also record what each library module refers to, so once one function is matched, IDA can name the helpers it calls, even those with no reliable signature of their own.

The gains are significant. On a stripped, statically linked sqlite3:

Verbatim names for Rust, Go and Swift

IDA no longer replaces non-C characters with underscores. runtime__ptr_Func_FileLine is now runtime.(*Func).FileLine, and Rust types read as &mut dyn core::fmt::Write. New databases show demangled names by default.

Go symbols in 9.4

Go symbols in 9.5

Modern languages, better covered

• Swift: strings are decoded in the disassembly and the decompiler, and listed in the Strings window. Stripped Swift binaries now keep their calling convention and error handling.
• Go: binaries with corrupt or obfuscated metadata load, including garble-obfuscated ones, and Go 1.27 is supported.
• Rust: the Rust ABI now covers ARM, ARM64, MIPS, PowerPC and RISC-V, not just x86.

A smoother daily workflow

• HTML export: copy any listing as HTML with its colors, or export a standalone or interactive page with a function sidebar and working cross-reference links. Perfect for reports, write-ups and sharing findings.
• Interactive Pathfinder: build a path as you go by adding waypoints and exclusions from any window. IDA shows how many functions connect two waypoints and the shortest route, and saves paths in the database.
• Jump Anywhere: one box finds functions, names, strings, types, members and enum constants, with a live preview of each result.
• Quick filter: start typing in any list window to filter it instantly.
• Qt 6.12 LTS: IDA now follows your desktop's light or dark scheme.
• Clang by default: C, C++, Objective-C and Objective-C++ declarations parse out of the box.

Faster, more reliable, at any scale

Teams and Lumina

Teams checkouts are much faster: databases are now packed so they can be decoded in parallel, and a 9 GB database checks out in 0.3 s instead of 2.3 s. A new status bar panel shows your current workspace at a glance, and Teams and Lumina now live together in a new Extensions menu.

When a Lumina, license or Vault server misbehaves, IDA tells you which server failed and why, and it no longer freezes while waiting for one that stopped responding.

Large binaries

• DWARF: debug sections are memory-mapped, saving about 2 GB on a 2.6 GB C++ binary.
• dyld shared caches: UI freezes during initial load drop from over 40 s to 8.1 s in total on a 2.7 GB cache.
• Decompiler: a function with one 5,506-instruction basic block now decompiles in 148 s instead of 2,929 s.
• Hostile binaries: new limits protect analysis against files built to slow IDA down.

IDA Home now includes 11 cloud decompilers and 70+ disassemblers, at the same price

Starting with IDA 9.5, IDA Home gives you 11 cloud decompilers instead of 2, together with 70+ disassemblers, with no price change. Alongside x86-32 and x86-64, you can now decompile ARM-32, ARM-64, MIPS-32, MIPS-64, PowerPC-32, PowerPC-64, RISC-V-32, RISC-V-64 and Android DEX.

With 70+ processors to disassemble and 11 to decompile, IDA Home covers the platforms most hobbyists and independent researchers actually meet: phones, routers, embedded boards, Android apps and much more. No upgrade or add-on needed.

Already on IDA Home? Download your updated license file from My Hex-Rays and replace your current one to unlock the new decompilers.

Discover IDA Home

New add-ons: Assist and Malware Analysis

Malware Analysis

Built for malware analysts, this add-on brings one-click unpacking, safe emulation of suspicious code, and sandbox results shown directly in the disassembly. Spend less time setting up and more time understanding the threat.

Learn more about Malware Analysis

Assist

Assist is an AI harness for reverse engineering, built right into IDA. It works with any capable AI model, local or cloud, and combines it with IDA's own analysis engines, emulation and an SMT solver. The result: explainable answers you can verify, even across several databases at once.

Learn more about Assist

Plus: IDA MCP

IDA MCP is a first-party, open-source MCP server that connects your AI agents to IDA. It runs fully locally and works across multiple databases at once.

Get IDA MCP