[RDW] Hex-Rays IDA Pro 6.1

Hex-Rays IDA Pro 6.1 properly cracked by our russian friends (RDW).

Please note that I have not cracked the application, full credit goes to RDW.

______________________________________________________


...,rUSSIANS dOING ThE wORLD,...

Type of release:
[ ] Keymaker [ ] Emulator [ ] Tutorial
[ ] Patch [x] Util [ ] Documentation
[ ] Serial [ ] Demo [x] Other

RELEASE INFORMATION

supplier: [Juraj Malcho, ESET ] date : [13/Jul/2011 ]
cracker : [Sp0Raw (sporaw) ] protection: [Keyfile; custom ]
packager: [Sp0Raw (sporaw) ] OS system : [Windows ]
type : [disassembler/debuggr] disks : [xx/22, 5 Mb ]

RELEASE NOTES


* IDA Pro Advanced v6.1 (Windows)
* HexRays x86 Decompiler v1.5
* HexRays Decompiler v1.5 SDK

http://www.hex-rays.com

1. *** FOR NUKERS ***
This is a TOTALLY ANOTHER RELEASE! COMPLETE PACKAGE, ORIGINAL AND
FULL-FUNCTIONAL. MORE FILES, NEW VERSIONS. MY PERSONAL SUPPLY TO
THE SCENE.

It contains original files that were missed in this release:
061311 Hex-Rays.IDA.Professional.v6.1-UNiQUE
(this release were based on Chinese leaked package)
Also it contains latest version of the HexRays Decompiler - HexRays x86 v1.5 (08-Apr-2011).
http://www.hex-rays.com/news1.shtml#110408

Moreover, this package is not a Chinese leakage (Licensed to: "Gu Tian Ren, Cai") and HAVE NO any files from it. This package was got by own efforts, resources and diligence. All files are from well-known antivirus company - ESET (www.eset.sk, www.eset.com) (Licensed to: "ESET spol. s r.o.").

You can checkout this by comparing watermarks in files:

.loaders*.ldw and *.l64
.procs*.w32 and *.w64

Please checkout more detailed analysis (comparison) below.

For persons, who are interested about details of this release please see below, "Details about release" section (Russian or English version).

1.1. IDA v6.1 Advanced Pro x86/x64 Comparison
Missed files in Chinese leaked package:

.ida.key - main keyfile to make software properly working
.idag.ico IDA v6.1 Advanced Pro GUI
.idag.exe
.idag64.exe - IDA v6.1 Advanced Pro (x64 Analysis) GUI
.idaq64.exe - IDA v6.1 Advanced Pro (x64 Analysis) QT-GUI

Badly patched in Chinese leaked package:
.idaq.exe - IDA v6.1 Advanced Pro QT-GUI, badly patched with lost of bytes (invalid relocation; crash on every modern OS with ASLR) (later it was recovered by other cracker)

Summary:
Chinese package does not allow x64 analysis, because unknown guys deleted GUI files (original, QT) that are required to load x64-files for analysis. I.e. x64 version is not available totally.

1.2. HexRays Decompiler Comparison
Chinese leaked package have no original HexRays at all.
It contains pirated version of HexRays x86 v1.1 (very old) from IDA v5.5t warez release. Here is a list of the latest original HexRays x86 v1.5.0.110408 (v1.5 from 08-Apr-2011) files in the current release:

.cfghexrays.cfg
.pluginsdefs.h
.pluginshexrays.plw
.pluginshexrays_license.txt
.pluginshexrays_sdkincludehexrays.hpp
.pluginshexrays_sdkpluginsvds1hexrays_sample1.cpp
.pluginshexrays_sdkpluginsvds1makefile
.pluginshexrays_sdkpluginsvds2hexrays_sample2.cpp
.pluginshexrays_sdkpluginsvds2makefile
.pluginshexrays_sdkpluginsvds3hexrays_sample3.cpp
.pluginshexrays_sdkpluginsvds3makefile
.pluginshexrays_sdkpluginsvds4hexrays_sample4.cpp
.pluginshexrays_sdkpluginsvds4makefile
.pluginshexrays_sdkpluginsvds5hexrays_sample5.cpp
.pluginshexrays_sdkpluginsvds5makefile
pluginshexrays_sdkpluginsvds6hexrays_sample6.cpp
.pluginshexrays_sdkpluginsvds6makefile
.pluginshexrays_sdkpluginsvds7hexrays_sample7.cpp
.pluginshexrays_sdkpluginsvds7makefile
.pluginshexrays_sdkeadme.txt

Summary:
Chinese package does not have HexRays.

1.3. Keyfile Details
36 network licenses (users) for IDA and HexRays x86!

LICENSE_ID PRODUCT # SUPPORT EXPIRES DESCRIPTION
--------------- -------- -- ---------- --------- -----------------------------
48-327F-7274-B7 IDAADVCW 36 2011-04-15 Never IDA Pro Advanced Computer License (Windows)
48-B373-75F4-1F IDAADVCM 36 2011-04-15 Never IDA Pro Advanced Computer License (Mac)
48-3177-75F4-F9 IDAADVCL 36 2011-04-15 Never IDA Pro Advanced Computer License (Linux)
57-3B73-7AE4-E2 HEXX86W 36 2011-04-15 Never x86 Decompiler License (Windows)
57-3E39-7844-DB HEXX86M 36 2011-04-15 Never x86 Decompiler License (Mac)
57-BE7D-7804-17 HEXX86L 36 2011-04-15 Never x86 Decompiler License (Linux)
56-3E15-5614-AD HEXARMW 2 2011-09-22 Never ARM Decompiler License (Windows)
56-3E51-5694-25 HEXARMM 2 2011-09-22 Never ARM Decompiler License (Mac)
56-BE15-5694-AD HEXARML 2 2011-09-22 Never ARM Decompiler License (Linux)

(this is not a serial numbers, it just an information about key)
Please see more details in ida.key.

Summary:
Chinese package does not have keyfile at all.

2. About released software
Most scene guys know what is IDA and HexRays Decompiler.

2.1. IDA Pro
The IDA Pro Disassembler and Debugger is an interactive, programmable, extendible, multi-processor disassembler hosted on Windows, Linux, or Mac OS X. IDA Pro has become the de-facto standard for the analysis of hostile code, vulnerability research and COTS validation.
http://www.hex-rays.com/idapro/

IDA Pro v6.1 what's new: http://www.hex-rays.com/idapro/61/index.html

2.2. HexRays Decompiler
Hex-Rays Decompiler brings binary software analysis within reach of millions of programmers. It converts executable programs into a human readable C-like pseudocode text.
In comparison to low level assembly language, high level language representation in Hex-Rays has several advantages:

* concise: requires less time to read it
* structured: program logic is more obvious
* dynamic: variable names and types can be changed on the fly
* familiar: no need to learn the assembly language
* cool: the most advanced decompiler ever built!

The pseudocode text is generated on the fly. Our technology is fast enough to analyze 99% of functions within a couple of seconds.
Currently the decompiler supports 32bit compiled generated code for the x86 and ARM processors. We plan to port it to other platforms and add a programmatic API. This will allow our customers to implement their own analysis methods. Vulnerability search, software validation, coverage analysis are the directions that immediately come to mind.
The decompiler runs on MS Windows. The GUI and text IDA versions are supported. In the text mode, only batch operation is available.
http://www.hex-rays.com/decompiler.shtml

HexRays comparison between different versions:

* Initial: non-HexRays vs HexRays v1.0: http://www.hex-rays.com/compare.shtml
* HexRays v1.0 vs HexRays v1.1: http://www.hex-rays.com/hexcomp11.shtml
* HexRays v1.1 vs HexRays v1.2: http://www.hex-rays.com/hexcomp12.shtml
* HexRays v1.2 vs HexRays v1.3: http://www.hex-rays.com/hexcomp13.shtml

HexRays v1.5 what's new: http://www.hex-rays.com/news1.shtml#110408

INSTALLATION
IDA and HexRays Decompiler as is:
Just put content of this archive to any directory like C:IDA61 and use it! It is a full functional original copy with required keyfile.
One restriction: it will not allow to open .idb bases made with previously pirated versions of IDA. You will see an error message: "Sorry, this database has been created by a pirate version of IDA Pro" (in case if .idb were created using IDA with stolen keyfile) or "Database is corrupt" (in case if .idb were created using IDA with generated keyfile with pre-patching to change RSA-1024 key for example, IDA v5.5 release). If it is annoying you, please follow to the next section and use "antipirate" fix to have no problems with opening any .idb bases.

Loader-Fix to load old IDB from previously pirated IDA versions:
Please checkout "_RDW-ANTIPIRATE" directory. You will find three files: ida.wll, ida64.wll and ida-antipirate.dll. Just copy them to IDA root directory, overwriting previous copy of files (you can backup them for the future needs). Now you will be able to open any old .idb files, including .idb files made with pirated versions of IDA.

IDAPython:
Homepage of the project: http://code.google.com/p/idapython/downloads/list
If you want to use IDAPython plugin (it is included to IDA package as standard plugin), you will require to install Python v2.7.x older and not newer to use with IDA v6.1!). You can get required installation package here (select 2.7 or 2.7.x only!): http://www.python.org/ftp/python/
But this is not enough. If you will not configure user/system environment variables (even MSI installer of Python does not configure them!), you will get following error when you will start IDA:

LoadLibrary(c:ida61pluginspython.plw) error: The specified c:ida61pluginspython.plw: can't load file or another error message box: IDAPython: error executing init.py

To have no such errors you need to edit environment variables and setup:

PYTHONHOME=C:Python27
PATH=%PATH%;C:Python27
LIB=%LIB%;C:Python27Lib

If you have a few versions of Python installed, please specify a path to v2.7 version at first position, for example:

PATH=%PATH%;C:Python27;C:Python25
LIB=%LIB%;C:Python27Lib;C:Python25Lib

If you are configured all correctly, you will have no any error message box about python or any error messages in status bar, when you will start IDA. These files will be automatically compiled from the sources on the first start of IDA:

.pythonidaapi.pyc
.pythonidautils.pyc
.pythonidc.pyc