Search string in all binary pesudo-code

Question

How can I search pesudo code string in all functions in binary with Ida??

Pesudo code I mean when press F5 in Ida I can see psedo code of the binary (like in c)

I want to search for example where there is while string or break string in psudo code

Answer 1

In version 6.x of Ida (tweaks will likely need to be made for more recent versions), you would want walk each Segment, then you can enumerate each Function, and from there, run the hexrays decompiler.

This will enumerate all the functions, dump the pseudo code, and then search for the string 'foobar':

import sys, idc, idautils, idaapi

# Writes out the C function pseudo code, with the starting effective address
# returns: string
def DumpPseudoCode(ea):
    if not idaapi.init_hexrays_plugin():
        return ""

    f = idaapi.get_func(ea)
    if f is None:
        return ""

    try:
        cfunc = idaapi.decompile(f);
        if cfunc is None:
            # Failed to decompile
            return ""
    except:
        return ""

    lines = []
    sv = cfunc.get_pseudocode();
    for sline in sv:
        line = idaapi.tag_remove(sline.line);
        lines.append(line)
    return "\r\n".join(lines)

# enumerate all the functions and search for a string in the generated pseudo code
for segea in Segments():
    for funcea in Functions(segea, SegEnd(segea)):
        ccode = DumpPseudoCode(funcea)
        if ('foobar' in ccode)
            # do something