How to decompile with Hex Rays via a Python API?

Question

If i have a large set of files and I'd like to run Hex-rays over them to produce output as C - can I do so in python?

• I see there is IDA Python
• And I see Hex-rays has a C++ SDK

Is there a python Hex-rays API?

Answer 1

Yes. The newer versions of IDA has official bindings for the Hex-Rays decompiler.
Originally, the Python bindings were written by EiNSTeiN around the Hex-Rays Decompiler SDK API. Later it has been merged into IDAPython.

You can find the documentation under "ida_hexrays" in the IDAPython docs.
Examples can be found in IDAPython repository. Check the scripts which starting with "vds".

You can check IDA Batch Decompile plugin which aims, as stated by the author, to batch decompile files in a folder:

IDA Batch Decompile is a plugin for Hex-Ray's IDA Pro that adds the ability to batch decompile multiple files and their imports with additional annotations (xref, stack var size) to the pseudocode .c file

Notice that this is a work-in-progress project so you might encounter some bugs.

Answer 2

It depends on IDA version you're using. Version 7.0 (and AFAIR version 6.9) has ida_hexrays python module which has functions decompile and decompile_many. If I remember it correctly the older IDA versions had these functions in idaapi module and these functions already had been introduced in IDA 6.6.

Answer 3

Well,there exist some examples at the idapython's github, see the idapyhton/examples/vds1.py,you can get a demo.

import idaapi
f=idaapi.get_func(ea)
cfunc=idaapi.decompile(f)

I have tried this on ida pro 6.8

Answer 4

Thanks for all the answers. In the end I used retdec due to some licensing restrictions. I can't share the exact code used, but this might be useful for others looking at this too:

Docker-IDA - https://github.com/intezer/docker-ida - Can be changed to work on HexRays fairly easily

Then commands such as the following may be useful:

['/ida/idat','-Ohexrays:outfile:ALL','-A',folder + 'input.bin'])

['mono','/dnSpy/dnSpy.Console.exe',filename,'-o', outdir]

['/retdec/bin/decompile.sh','-l','py',filename]