If i have a large set of files and I'd like to run Hex-rays over them to produce output as C - can I do so in python?
- I see there is IDA Python
- And I see Hex-rays has a C++ SDK
Is there a python Hex-rays API?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
Yes. The newer versions of IDA has official bindings for the Hex-Rays decompiler.
Originally, the Python bindings were written by EiNSTeiN around the Hex-Rays Decompiler SDK API. Later it has been merged into IDAPython.
You can check IDA Batch Decompile plugin which aims, as stated by the author, to batch decompile files in a folder:
IDA Batch Decompile is a plugin for Hex-Ray's IDA Pro that adds the ability to batch decompile multiple files and their imports with additional annotations (xref, stack var size) to the pseudocode .c file
Notice that this is a work-in-progress project so you might encounter some bugs.
It depends on IDA version you're using.
Version 7.0 (and AFAIR version 6.9) has ida_hexrays python module which has functions
If I remember it correctly the older IDA versions had these functions in
idaapi module and these functions already had been introduced in IDA 6.6.
Well,there exist some examples at the idapython's github, see the idapyhton/examples/vds1.py,you can get a demo.
import idaapi f=idaapi.get_func(ea) cfunc=idaapi.decompile(f)
I have tried this on ida pro 6.8
Thanks for all the answers. In the end I used retdec due to some licensing restrictions. I can't share the exact code used, but this might be useful for others looking at this too:
Docker-IDA - https://github.com/intezer/docker-ida - Can be changed to work on HexRays fairly easily
Then commands such as the following may be useful:
['/ida/idat','-Ohexrays:outfile:ALL','-A',folder + 'input.bin'])