0

How can I search pesudo code string in all functions in binary with Ida??

Pesudo code I mean when press F5 in Ida I can see psedo code of the binary (like in c)

I want to search for example where there is while string or break string in psudo code

3
  • 2
    please add some example of what do you mean Commented Jun 7, 2019 at 6:03
  • @Paweł Łukasik I edit my post with more details
    – Keystone
    Commented Jun 7, 2019 at 13:07
  • But pseudo-code is only ever created on-demand, right? Really unclear what it is you want.
    – 0xC0000022L
    Commented Jun 11, 2019 at 16:14

1 Answer 1

3

In version 6.x of Ida (tweaks will likely need to be made for more recent versions), you would want walk each Segment, then you can enumerate each Function, and from there, run the hexrays decompiler.

This will enumerate all the functions, dump the pseudo code, and then search for the string 'foobar':

import sys, idc, idautils, idaapi

# Writes out the C function pseudo code, with the starting effective address
# returns: string
def DumpPseudoCode(ea):
    if not idaapi.init_hexrays_plugin():
        return ""

    f = idaapi.get_func(ea)
    if f is None:
        return ""

    try:
        cfunc = idaapi.decompile(f);
        if cfunc is None:
            # Failed to decompile
            return ""
    except:
        return ""

    lines = []
    sv = cfunc.get_pseudocode();
    for sline in sv:
        line = idaapi.tag_remove(sline.line);
        lines.append(line)
    return "\r\n".join(lines)

# enumerate all the functions and search for a string in the generated pseudo code
for segea in Segments():
    for funcea in Functions(segea, SegEnd(segea)):
        ccode = DumpPseudoCode(funcea)
        if ('foobar' in ccode)
            # do something

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.