1

I am trying to iterate all the C statement (could be very coarse-grained, it's fine) in IDA-Pro recovered assembly program.

Suppose I only consider these statements:

State :: =
  | if-else cond;
  | loop;
  | assignment;
  | function call
  | return
  | {s1; s2; s3 ...}

And after some quick search, I know that there are some (third-party) plugins that can help to identify some C control-flow structure, and I list some of them below:

if-else cond : N/A

loop : link1 link2 link3

So my questions are:

  1. Is there any plugins that can recover if/else statement? It looks easier than loop, but I just cannot find a well-developed way to recover the statement.

  2. Is there anyway/api/scripts to iterate C statements in IDA-Pro? Or I have to implement myself?

Ideally it should look like this as this is essentially used in source code analysis... (sorry for this pseudo code, I just want to clarify)

let aux s =
    match s with
    | If e1 b1 b2 -> analyze e1 b1 b2
    | Loop e1 e2 e3 b1 -> analyze e1 e2 e3 b1
    | Assign v1 v2 -> analyze v1 v2 
    | States sl -> List.iter analyze sl
    | ...  in
List.iter aux statement_list
...

1 Answer 1

1
  1. Is there any plugins that can recover if/else statement? It looks easier than loop, but I just cannot find a well-developed way to recover the statement.

Yes, the Hex-Rays Decompiler recovers if/else statements.

  1. Is there anyway/api/scripts to iterate C statements in IDA-Pro? Or I have to implement myself?

Yes, the Hex-Rays SDK allows you to iterate the items (including if-else statements) in a decompilation tree.

3
  • 1
    A lot of functionality of HexRays SDK exists in IDAPython as a part of idaapi module in latest IDA versions (6.6 +).
    – w s
    Commented Apr 6, 2015 at 15:35
  • @ws, would you mind to give an example here? thank you Commented Apr 6, 2015 at 18:36
  • The only thing I can give is a IDAPython samples at google code: code.google.com/p/idapython/source/browse/… Desired code is in python files starting with vds
    – w s
    Commented Apr 6, 2015 at 19:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.