0

How can I search pesudo code string in all functions in binary with Ida??

Pesudo code I mean when press F5 in Ida I can see psedo code of the binary (like in c)

I want to search for example where there is while string or break string in psudo code

  • 2
    please add some example of what do you mean – Paweł Łukasik Jun 7 at 6:03
  • @Paweł Łukasik I edit my post with more details – Keystone Jun 7 at 13:07
  • But pseudo-code is only ever created on-demand, right? Really unclear what it is you want. – 0xC0000022L Jun 11 at 16:14
3

In version 6.x of Ida (tweaks will likely need to be made for more recent versions), you would want walk each Segment, then you can enumerate each Function, and from there, run the hexrays decompiler.

This will enumerate all the functions, dump the pseudo code, and then search for the string 'foobar':

import sys, idc, idautils, idaapi

# Writes out the C function pseudo code, with the starting effective address
# returns: string
def DumpPseudoCode(ea):
    if not idaapi.init_hexrays_plugin():
        return ""

    f = idaapi.get_func(ea)
    if f is None:
        return ""

    try:
        cfunc = idaapi.decompile(f);
        if cfunc is None:
            # Failed to decompile
            return ""
    except:
        return ""

    lines = []
    sv = cfunc.get_pseudocode();
    for sline in sv:
        line = idaapi.tag_remove(sline.line);
        lines.append(line)
    return "\r\n".join(lines)

# enumerate all the functions and search for a string in the generated pseudo code
for segea in Segments():
    for funcea in Functions(segea, SegEnd(segea)):
        ccode = DumpPseudoCode(funcea)
        if ('foobar' in ccode)
            # do something

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.