2

I am looking for a way to obtain the pseudocode of a function via a script. I am using IDAPro 6.9 on OS X 10.11.4 (El Capitan).

I did locate this documentation on using the decompiler in batch mode:

https://www.hex-rays.com/products/decompiler/manual/batch.shtml

If I am interpreting the documentation correctly, it would seem to indicate that I can execute:

idal -Ohexx86:decompiled_output:function_name -A myidapro.idb

and it will produce the pseudocode for function_name and write the result to decompiled_output. Is this correct?

When I try this, it just launches the text interface and no output file is created. I can, of course, launch the GUI and view the pseudocode of function_name.

Additionally, if there is a way to obtain the pseudocode of a function via a python script running within idapro, that would be the preferred option, but it is unclear to me whether that is possible.

2

You can use the following function:

def decompile_func(ea):
  if not init_hexrays_plugin():
    return False

  f = get_func(ea)
  if f is None:
    return False

  cfunc = decompile(f);
  if cfunc is None:
    # Failed to decompile
    return False

  lines = []
  sv = cfunc.get_pseudocode();
  for sline in sv:
    line = tag_remove(sline.line);
    lines.append(line)
  return "\n".join(lines)

print decompile_func(here())

This is a modification of the example vds1.py script.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.