1

When I am working on a source code recovery project I am usually left with a lot of code that needs to be manually cleaned up by hand. This can take a lot of time and as projects get larger , I am looking for a way to accomplish this quicker.

EXAMPLE Code before cleanup

int __cdecl main(int argc, const char **argv, const char **envp)
{
  __int64 v3; // rax
  __int64 v4; // r8
  __int64 v5; // rax
  __int64 v6; // r8
  __int64 v7; // rax
  __int64 v8; // r8
  __int64 v9; // rax
  __int64 v10; // r8
  __int64 v11; // rax
  __int64 v12; // r8
  __int64 v13; // rax
  __int64 v14; // r8
  __int64 v15; // rax
  __int64 v16; // rax
  Books books; // [rsp+20h] [rbp-E8h]

  strcpy(books.title, "Learn C++ Programming");
  strcpy(books.author, "Chand Miyan");
  strcpy(books.subject, "C++ Programming");
  LODWORD(books.id) = 6495407;
  v3 = sub_1400011D0(std::cout, "Book 1 title : ", envp);
  v5 = sub_1400011D0(v3, &books, v4);
  std::basic_ostream<char,std::char_traits<char>>::operator<<(v5, sub_1400013A0);
  v7 = sub_1400011D0(std::cout, "Book 1 author : ", v6);
  v9 = sub_1400011D0(v7, books.author, v8);
  std::basic_ostream<char,std::char_traits<char>>::operator<<(v9, sub_1400013A0);
  v11 = sub_1400011D0(std::cout, "Book 1 subject : ", v10);
  v13 = sub_1400011D0(v11, books.subject, v12);
  std::basic_ostream<char,std::char_traits<char>>::operator<<(v13, sub_1400013A0);
  v15 = sub_1400011D0(std::cout, "Book 1 id : ", v14);
  v16 = std::basic_ostream<char,std::char_traits<char>>::operator<<(v15, LODWORD(books.id));
  std::basic_ostream<char,std::char_traits<char>>::operator<<(v16, sub_1400013A0);
  return 0;
}

Looking at the code we can see that std::cout is simply printing the variables . but this code while it makes sense to us humans should be cleaned up more before it becomes useful.

This is AFTER my clean up. By hand...

typedef struct Books {
    char title[44];
    char author[56];         
    char subject[100];       
    int id;

} books;



int main(){

    __int64 v3; // rax
    __int64 v4; // r8
    __int64 v5; // rax

    Books books; // [rsp+20h] [rbp-E8h]


    strcpy(books.title, "Learn C++ Programming");
    strcpy(books.author, "Chand Miyan");
    strcpy(books.subject, "C++ Programming");
    LODWORD(books.id) = 6495407;


    std::cout << "Book 1 title   : " << &books.title << std::endl;
    std::cout << "Book 1 author  : " << &books.author << std::endl;
    std::cout << "Book 1 subject : " << books.subject << std::endl;
    std::cout << "Book 1 id : "      << LODWORD(books.id) << std::endl;

    return 0;
}

The answer doesn't have to be through IDAPython, but I think it would be a good place to start.

So far what I have , is this and I am not sure if these is even the right step to go.

c=idaapi.decompile(0x0000000140001000 ) //
for v in c.lvars:
  print v.name

This though, just prints off the variable names.

How can I more automate clean up Ida produced code. Here is a similar question to mine , but I don't think this explores the possiblity of other options or using IDAPython.

Cleaning HexRays Output

  • How did you edit the code to std::cout? – Biswapriyo Sep 4 at 5:31
  • By hand as mentioned before. I clean code often by hand. – Qndel Sep 4 at 6:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.