How can I control the Hex-Rays decompiler plugin from IDA with scripts?

Question

I want to use IDA with the Hex-Rays decompiler plugin as part of automated static analysis, possibly on a large number of files without opening each one and telling it to produce a C file individually.

Ideally, I'd like to run IDA from the command line, and get the decompilation based on initial autoanalysis as output. This way I can run it as part of Mastiff or grep for certain functions in a set of binaries. By my reading of On batch analysis from the Hex Blog, what I need is an IDA script that interacts with the decompiler plugin, but I can't figure out how to actually do so.

So this leaves me with 2 subquestions:

• How can I tell the Hex-Rays decompiler to "Produce C file" (decompile all functions) from a script?
• Does that script need to be IDC, or is IDAPython possible?

Answer 1

[Back in 2013] the decompiler did not have a scripting API. So you had these choices:

• Add necessary functions to IDC using a native plugin that calls the decompiler API.
• Use ctypes or similar to call the C++ API directly from Python. I posted a small PoC script doing it to the Hex-Rays forum a couple years ago.
• If you just want to have the decompiled text, you can use the command line option.

IDA 6.6 (released in June 2014) added official Python bindings for the decompiler, so it now can be scripted from Python. For sample code, see vds*.py scripts in the IDAPython repository.