4

I'm working on a crack me, specifically: jaunsacco's DragonCrack and the first thing I've gotten stuck on is that the program is built mostly as a enormous main function. After attempting to decompile I get the error:

Decompilation failure: 11E1640: too big function

I've increased my max function size for decompilation to 512K (defaults at 64), the main function is approx. 400K. But this is too much processing and IDA froze for at least 5 minutes before I gave up.

Is there an alternative approach to decompiling a large (400K) function using Hex-Rays decompiler? Maybe partial decompilation, or non-default decompiler configuration.

IDA: Version 7.2.181105

Hex-Rays Decompiler: v7.0.0.170914

2
  • 3
    Hi and welcome to RE.SE. So you're working with the Hex-Rays decompiler plugin, right? It'd be good if you would state both the IDA and Hex-Rays versions, so there is a chance we can better help. Alternatively you could send an email to the Hex-Rays support. In the past they were generally very helpful whenever I ran into an issue.
    – 0xC0000022L
    Commented Aug 1, 2019 at 7:38
  • From my experience, latest versions of IDA fix those problems.
    – Nark
    Commented Jan 8, 2020 at 12:09

2 Answers 2

4

You can give https://retdec.com/idaplugin/ a try. I've heard it can decompile larger functions without much error.

According to them it supports decompiling a whole binary file. So it possibly could decompile this function without much hesitation. Although I can't promise anything.

Good luck! :-)

3

The question is too old, but I'll answer it anyway, maybe it'll be useful for someone else.

You can change the MAX_FUNCSIZE variable in the \IDA\cfg\hexrays.cfg

The default is 64, put a bigger number. For example, I'm using 4096

Reference: https://www.hex-rays.com/products/decompiler/manual/config.shtml

4
  • If you read the question properly, you will note that I have already tried this.
    – Naxin
    Commented Feb 13, 2023 at 23:51
  • Maybe it was not enough. Now I have 16384. It just a thought, I tried and it worked for me and I shared the results. also after changes you need to restart IDA
    – NetCat
    Commented Feb 18, 2023 at 22:20
  • As I said, please read the question properly. I set mine to 512K. Thats 512000. Thats 31.25 larger than what you're suggesting. It froze my IDA because the function seems to be too large for the decompiler.
    – Naxin
    Commented Feb 19, 2023 at 4:12
  • Ok, understood. I just shared a solution I used with exactly the same error and worked for me. If you'll find some useful things, please let us know via this post reply
    – NetCat
    Commented Feb 20, 2023 at 17:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.