How to make pseudocode in IDA more human readable

Question

Some codes in IDA are not clear enough. Especially when they do reference after calculation

while ( dx33[rdi24] );
  if ( rax35 != &WPP_GLOBAL_Control && (*((_BYTE *)rax35 + 68) & 2) != 0 && *((_BYTE *)rax35 + 65) >= 4u )
  {
    WPP_SF_sd(
      (unsigned int)rax35[7],
      22,
      (unsigned int)&WPP_b7e02e4f98cc3b1bbc566e561d210229_Traceguids,
      (_DWORD)dx33,
      rdi24 - 1);
    dx33 = Str;
  }
  if ( (_DWORD)rdi24 != 1 && dx33[(int)rdi24 - 1] == 46 && dx33[(int)rdi24 - 2] == 46 )
  {
    dx33[(int)rdi24 - 1] = 0;
    dx33 = Str;
  }

For some parts like

(*((_BYTE *)rax35 + 68) & 2)

Can I change it to a more human-readable form? I remember changing the function argument type like int a1 to JNIEnv* can make the pointer reference more readable because it recovers some JNI function names so that

...(_DWORD)(a1+312)(a1,v9)

will become something like

->func(a1,v9)

But I'm not sure how to do this for other types.

Answer 1

To make the listing more human-readable, you just need to add structure definitions, for example: type of variable rax35 - obviously not unsigned int

there should be a pointer to the structure you need to define.

---

The first thing you need is to find the size of this struct or class. To do this, you need to find its constructor.

• If the memory for this object is allocated using the operator New, you can determine the size.
• If memory is allocated on the stack, then heuristic methods must be used here. That is, you have to manually parse the stack frame.

After the size of the structure or class is found, it's time to add it to Local Types in IDA Pro.

To simplify static analysis as much as possible, you should:

• add, if any, pdb-file to the project.
• for each function declaration - restore prototypes

Answer 2

There’s no single solution for every case but basically you need to use the decompiler’s interactive features:

• Renaming
• Retyping
• Commenting
• Navigation between different functions

Just looking at small parts of the function and renaming a few variables to some name which makes sense can go a long way. Start small and keep making changes until things start to make sense. Sometimes you may need yo visit multiple functions to see how a specific variable is used to figure out its type.