Does anyone know about obtaining pseudocode for x86-64 in IDA Pro? I already tried the Hex-Rays plugin to obtain pseudocode, but when I try it, the following error pops up: "only 32bit code is supported".
-
4well, what kind of binary do you have? x86, x86_64 , ARM ... ?– 0xeaJul 28, 2013 at 9:15
Add a comment
|
3 Answers
The two other answers here are outdated.
From hex-rays website, in the page about the the hex-rays decompiler:
Currently the decompiler supports compiler generated code for the x86, x64, ARM32, ARM64, and PowerPC processors. We plan to port it to other platforms and add a programmatic API. This will allow our customers to implement their own analysis methods. Vulnerability search, software validation, coverage analysis are the directions that immediately come to mind.
On 2014/06/04, with the release of IDA 6.6 hex-rays officially released their 64bit x86 decompiler, and it has been steadily improved since then. The official release can be seen on IDA 6.6 page as the first new feature as well as on their changelog.
It is a separate product and sold apart from their x86 32bit decompiler, and is currently quoted at the same price as the other decompilers (see price quotes page for named licenses).
More than two years after the first release, the decompiler is fully featured and is considered high-grade.
Two images of using IDA's 64 bit x86 disassembly and decompilation (from hex-ray's IDA 6.6 page):
(source: hex-rays.com)
Other solutions
There are, however, other solutions that provide an IDA plugin for decompilation. Although not precisely what you were looking for, those provide another possible way to achieve your desired goal:
- Snowman, A full-blown decompiler with an IDA plugin
- a plugin for AVG's Retargetable Decompiler online decompiler (Mentioned by @ws)
- A python-only IDA decompiler plugin called ida-decompiler (Mentioned by @0xea)
-
1There is also a plugin from retdec.com/idaplugin . It supports Intel x86, ARM, ARM+Thumb, MIPS, PIC32, PowerPC in ELF, PE, COFF, AR (archive) and Intel HEX formats. Please note that the decompilation process happens at their server, not locally.– w sSep 28, 2016 at 11:03
-
Snowman does not work at all. Look which garbage it creates: _memset(ecx, edi79, 0, 0x13c, "p", 0, 0, 1, v6, 0x130b, 0, 0, v5, edi7, esi8, ebx9, v82, v18, 0, v80, v83, v84, v11); and MessageBoxW_CWnd_QAEHPB_W0I_Z(ecx, "o", 0, 0, edi66, eax68, 3, v60, 1, v6, 0x130b, 0, 0, v5, edi7, esi8, ebx9, v85, v18, v21, v24, v86, v87, v11, v42); Better use Ghidra– ElmueJan 30 at 16:25
As far as I know, IDA Hex-ray plugin supports only x86 and ARM decompiling (if you have a licence for ARM). It doesn't work on x86_64.
However, if you need something that will work on x86_64 take a look at ida-decompiler:
An IDA plugin that attempts to decompile a function. Written in Python. To try it in IDA, place your cursor on a function, and execute the plugin. The decompiled function will appear in the output window.
Obviously, it's not as advanced as Hex-Rays, but it's a good step toward a good, open decompiler.
-
This was correct at original time of writing but is no longer so. Please take a look at my answer.– NirIzrAug 20, 2016 at 15:03
If you absolutely want pseudo-code and are out of luck with IDA Pro, you might want to give a try to demo version of hopper : it can generates pseudo-code for x86, x86-64, and ARM.
