0

While I was reversing a binary I noticed that IDA Pro had adjusted the pseudocode that initially was generated. This happened after I started reversing the binary and renamed functions and variables to more appropriate names. IDA Pro had then "prettified" or re-analyzed the pseudocode somehow.

I am not sure what keys I pressed or options I clicked to achieve this, but it was extremely useful.

How can I replicate this?

1
  • Hi and welcome to RE.SE. Please be more specific. Also, since you mentioned pseudo-code (which IDA does not generate), I replaced ida by hexrays. The latter is the plugin for IDA providing decompilation (and generating pseudo-code).
    – 0xC0000022L
    Feb 28, 2020 at 7:54

2 Answers 2

3

While in the pseudocode view pressing F5 will re-decompile the current function.

0

Coming back to answer this question with the actual answer I was looking for now that I have some more experience and figured out what happened.

When opening a binary in IDA Pro that has the Hex-Rays decompiler plugin you may open the pseudocode view using the hotkey F5, and also re-analyze the current function by pressing F5 again as @Avery3R posted in his answer.

However, if you work your way through the binary by double-clicking functions you can go back to one of the functions you already have decompiled and re-analyze it. The pseudocode will then change to reflect the changes you have done (or simply the optimizations done by the Hex-Rays decompiler). Typical changes you will see are the number of function arguments that will be adjusted to be more correct.

Usually what I do if I encounter pseudocode that seems incorrect in terms of function arguments, I will click around and "peek" into the different problematic functions before I go back to the initial function I started with and re-analyze it. The pseudocode will then look way better and be easier to work with.

And if you would like to re-analyze the whole binary you coud always do that by going to Options -> General -> Analysis -> Reanalyze program, and Ctrl+F5 to decompile all functions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.