In version 6.x of Ida (tweaks will likely need to be made for more recent versions), you would want walk each Segment
, then you can enumerate each Function
, and from there, run the hexrays decompiler.
This will enumerate all the functions, dump the pseudo code, and then search for the string 'foobar':
import sys, idc, idautils, idaapi
# Writes out the C function pseudo code, with the starting effective address
# returns: string
def DumpPseudoCode(ea):
if not idaapi.init_hexrays_plugin():
return ""
f = idaapi.get_func(ea)
if f is None:
return ""
try:
cfunc = idaapi.decompile(f);
if cfunc is None:
# Failed to decompile
return ""
except:
return ""
lines = []
sv = cfunc.get_pseudocode();
for sline in sv:
line = idaapi.tag_remove(sline.line);
lines.append(line)
return "\r\n".join(lines)
# enumerate all the functions and search for a string in the generated pseudo code
for segea in Segments():
for funcea in Functions(segea, SegEnd(segea)):
ccode = DumpPseudoCode(funcea)
if ('foobar' in ccode)
# do something