1

I'm working on a crack me, specifically: jaunsacco's DragonCrack and the first thing I've gotten stuck on is that the program is built mostly as a enormous main function. After attempting to decompile I get the error:

Decompilation failure: 11E1640: too big function

I've increased my max function size for decompilation to 512K (defaults at 64), the main function is approx. 400K. But this is too much processing and IDA froze for at least 5 minutes before I gave up.

Is there an alternative approach to decompiling a large (400K) function using Hex-Rays decompiler? Maybe partial decompilation, or non-default decompiler configuration.

IDA: Version 7.2.181105

Hex-Rays Decompiler: v7.0.0.170914

  • 3
    Hi and welcome to RE.SE. So you're working with the Hex-Rays decompiler plugin, right? It'd be good if you would state both the IDA and Hex-Rays versions, so there is a chance we can better help. Alternatively you could send an email to the Hex-Rays support. In the past they were generally very helpful whenever I ran into an issue. – 0xC0000022L Aug 1 '19 at 7:38
  • From my experience, latest versions of IDA fix those problems. – Nark Jan 8 at 12:09
0

You can give https://retdec.com/idaplugin/ a try. I've heard it can decompile larger functions without much error.

According to them it supports decompiling a whole binary file. So it possibly could decompile this function without much hesitation. Although I can't promise anything.

Good luck! :-)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.