1

When I am working on a source code recovery project I am usually left with a lot of code that needs to be manually cleaned up by hand. This can take a lot of time and as projects get larger , I am looking for a way to accomplish this quicker.

EXAMPLE Code before cleanup

int __cdecl main(int argc, const char **argv, const char **envp)
{
  __int64 v3; // rax
  __int64 v4; // r8
  __int64 v5; // rax
  __int64 v6; // r8
  __int64 v7; // rax
  __int64 v8; // r8
  __int64 v9; // rax
  __int64 v10; // r8
  __int64 v11; // rax
  __int64 v12; // r8
  __int64 v13; // rax
  __int64 v14; // r8
  __int64 v15; // rax
  __int64 v16; // rax
  Books books; // [rsp+20h] [rbp-E8h]

  strcpy(books.title, "Learn C++ Programming");
  strcpy(books.author, "Chand Miyan");
  strcpy(books.subject, "C++ Programming");
  LODWORD(books.id) = 6495407;
  v3 = sub_1400011D0(std::cout, "Book 1 title : ", envp);
  v5 = sub_1400011D0(v3, &books, v4);
  std::basic_ostream<char,std::char_traits<char>>::operator<<(v5, sub_1400013A0);
  v7 = sub_1400011D0(std::cout, "Book 1 author : ", v6);
  v9 = sub_1400011D0(v7, books.author, v8);
  std::basic_ostream<char,std::char_traits<char>>::operator<<(v9, sub_1400013A0);
  v11 = sub_1400011D0(std::cout, "Book 1 subject : ", v10);
  v13 = sub_1400011D0(v11, books.subject, v12);
  std::basic_ostream<char,std::char_traits<char>>::operator<<(v13, sub_1400013A0);
  v15 = sub_1400011D0(std::cout, "Book 1 id : ", v14);
  v16 = std::basic_ostream<char,std::char_traits<char>>::operator<<(v15, LODWORD(books.id));
  std::basic_ostream<char,std::char_traits<char>>::operator<<(v16, sub_1400013A0);
  return 0;
}

Looking at the code we can see that std::cout is simply printing the variables . but this code while it makes sense to us humans should be cleaned up more before it becomes useful.

This is AFTER my clean up. By hand...

typedef struct Books {
    char title[44];
    char author[56];         
    char subject[100];       
    int id;

} books;



int main(){

    __int64 v3; // rax
    __int64 v4; // r8
    __int64 v5; // rax

    Books books; // [rsp+20h] [rbp-E8h]


    strcpy(books.title, "Learn C++ Programming");
    strcpy(books.author, "Chand Miyan");
    strcpy(books.subject, "C++ Programming");
    LODWORD(books.id) = 6495407;


    std::cout << "Book 1 title   : " << &books.title << std::endl;
    std::cout << "Book 1 author  : " << &books.author << std::endl;
    std::cout << "Book 1 subject : " << books.subject << std::endl;
    std::cout << "Book 1 id : "      << LODWORD(books.id) << std::endl;

    return 0;
}

The answer doesn't have to be through IDAPython, but I think it would be a good place to start.

So far what I have , is this and I am not sure if these is even the right step to go.

c=idaapi.decompile(0x0000000140001000 ) //
for v in c.lvars:
  print v.name

This though, just prints off the variable names.

How can I more automate clean up Ida produced code. Here is a similar question to mine , but I don't think this explores the possiblity of other options or using IDAPython.

Cleaning HexRays Output

2
  • How did you edit the code to std::cout?
    – Biswapriyo
    Sep 4, 2019 at 5:31
  • By hand as mentioned before. I clean code often by hand.
    – LUser
    Sep 4, 2019 at 6:06

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.