Questions tagged [hexrays]
A C/C++ decompiler that has been developed by the same company than IDAPro in response to users needs. It works in close relationship with the IDAPro user interface.
0
votes
0answers
31 views
IDA Hex-Rays: There are no xrefs to
I defined a new type and changed the function signatures and local variables in the Pseudocode window so that they use this type. But IDA itself displays this type as unused. She did not see ...
1
vote
2answers
89 views
Nested Structures in IDA
I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app;
int main() {
const int kBits = 1024;
const int kExp = 3;
RSA *rsa =...
0
votes
0answers
42 views
How to remove all goto statements in pseudocode?
IDA shows multiple goto statements in the decompiled pseudocode. I've read this manual page: https://www.hex-rays.com/products/decompiler/manual/config.shtml and tried to disable/enable these flags ...
1
vote
0answers
28 views
IDA 7 handling strings in debugger pseudocode
When running a remote debugger to a linux server, is there a way to get IDA (7.0) to properly handle strings? When I go to the pseudocode view, I get things like this;
v7 = sub_804AD60((std::string *)...
0
votes
0answers
48 views
IDA Hex-Rays turns __cdecl into __usercall
IDA 6.8 + Hex-Rays
Plugins: HexRaysCodeXplorer, HexRaysPyTools
I am faced with strange things.
// Before
int sub_406350()
// After
int __usercall sub_406350@<eax>(int a1@<ebp>)
// ...
1
vote
2answers
104 views
.NET assembly IDA PRO, using LDSTR IL op code, how to patch a string?
I'm trying to patch a string. So right now I'm trying to replace instruction LDSTR with LDSTR "mystring"; however, I have been unsuccessful. After assembling the LDSTR op code, I don't quite ...
0
votes
0answers
96 views
How do I obtain database key in IDA pro/Hex RAYS from decompiled .SO lib?
I'm new to reverse engineering and I found a .SO library inside an android app. I wanted to reverse engineer it to find the key used to encrypt the local database that the game uses for characters. ...
4
votes
1answer
141 views
Resolving FLAGS bits with IDA
While disassembling a binary, IDA decompiler decompiles the call as mmap(0x80000000, 4096, 7, 50, -1, 0); While there is nothing wrong with the decompilation itself, it could be more useful to decode ...
0
votes
1answer
129 views
Translating ida macros and pseudocode into C++/C
What would be the translated C output of this hexrays decompiler pseudocode? The values of v6 and v5 are floats just as v8. The value of xmmword_108365D0 is 7FFFFFFF7FFFFFFF7FFFFFFF7FFFFFFFh
v8 = (...
1
vote
2answers
283 views
How to add/find parameters to a function declaration in IDA/HexRays?
I've a binary opened in IDA. It uses a function pointer from a COM vtable. I found that the COM method has 13 parameters (including this). But IDA shows only 4 parameters as shown in this pseudocode:
...
1
vote
2answers
467 views
IDA Hex-Rays Decompiler : Show strings instead of offset
How can i settings IDA show me string instead of offset_xxx?
1
vote
1answer
113 views
How do I resolve IDA pro Hexrays aliased local variables?
It appears to me that in my function the compiler has reused a stack slot for two variables of types. However, Hex-Rays has not recognized it as such. How can I split the local variable into two?
-2
votes
2answers
156 views
Some question about IDA [closed]
This binary was from a CTF challenge.
I found 2 way to solve this, one is run & debug the bin, set a break point and see result in flag after the bin running, another is trying to understand the ...
6
votes
2answers
254 views
Split variable in Hexrays decompiler?
With Microsoft Visual C++ executables, I often run into decompilations like this:
void __cdecl Pbdf::ReadString(char *dst, Pbdf *pbdfOrLength)
{
Pbdf *pbdf; // esi
pbdf = pbdfOrLength;
...
1
vote
1answer
143 views
Odd convention for accessing elements of an array?
While reverse engineering a game using the Hex Rays decompiler I was looking for how an array of NPC's was accessed. I found the array but I don't quite understand the unusual formula for getting the ...
2
votes
1answer
208 views
Hex-Rays function signature does not match demangled name
From the demangled name, I know that a function takes an std::string const& as a parameter but when generating psuedo-c code with Hex-Rays' decompiler it autodetects the parameters as (int a1, int ...
-2
votes
1answer
202 views
(Hex-Rays) How to define C macro?
Im want create reverse macro for constant integers, how i can do it?
Example:
#define MU_ITEM(x, y) (x * 512 + y)
My goal is make result of number format like: before & after.
1
vote
0answers
131 views
IDA Pro 7.0 showing incorrect LOCALS in pseudocode view
Whenever I debug something and I switch to pseudocode and then rename some of the "variables" that IDA Pro creates, the values shown in the LOCALS window don't match what the actual values of those ...
0
votes
2answers
196 views
IDA Hex-Rays suggests an invalid offset
While running Hex-Rays decompiler against an application, Hex-Rays gave the following output:
__int64 v29; // r10 ... v29 = 0i64; if( !v28) v19 = 0;
do
{
v30 = *(_BYTE *)(v29 + ...
4
votes
2answers
405 views
HexRays: Variadic methods like printf
I have identified a routine that behaves exactly like printf in an ARM64 binary. Arguments are passed in the standard fashion (e.g. X0, X1, X2 ...) and I have given the function the signature (Y) of:
...
2
votes
4answers
1k views
How to decompile with Hex Rays via a Python API?
If i have a large set of files and I'd like to run Hex-rays over them to produce output as C - can I do so in python?
I see there is IDA Python
And I see Hex-rays has a C++ SDK
Is there a python Hex-...
2
votes
0answers
338 views
STL map and map entry structures for IDA/HexRays
I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long ...
0
votes
2answers
64 views
Tracing the last written value of a memory location without slowdown
I'm trying to debug the corruption of a linked list structure inside of a Win32 DLL with IDA Pro and Hexrays. The offending assembly traverses a doubly-linked list forwards checking a condition, and ...
2
votes
0answers
890 views
IDA Pro PowerPC Decompiler Plugin supporting Floating Point Instructions
So I far I have been using Snowman for PowerPC decompilation. It is bad though but better than nothing. However, right now it doesn't support floating point instructions. They are simply written down ...
0
votes
1answer
120 views
Why does IDA identify so many non-existent methods in this binary?
The decompilation and auto-analysis of this binary is grossly inaccurate. I am providing the binary as well as the IDB. IDA v6.95, 32 bit was used for the analysis. Can anyone take a look and suggest ...
1
vote
1answer
1k views
Doesn't IDA Pro 6.95 support decompiling MIPS executable?
I am working on a MIPS binary: ELF 32-bit MSB executable, MIPS, MIPS-II version 1 (SYSV), statically linked, for GNU/Linux 2.6.32, BuildID[sha1]=76438e9ed749bcfc6e191e548da153d0d3b3ee28, not stripped
....
1
vote
0answers
167 views
Is there a from…import * equivalent of idaapi.require()?
Loading your own modules from your IDAPython scripts with idaapi.require() suggests using idaapi.require() to load user modules in IDAPython scripts. However in my script, I have extensively used from ...
1
vote
1answer
117 views
Is it possible to redirect IDAPython stack trace to console?
I am facing a weird problem! When my IDAPython script crashes, it produces a stack trace in the IDA default warning box that pops up right in front. The size of the box is neither adequate enough to ...
0
votes
1answer
310 views
Is there any IDA plugin to display AST?
Hex Ray has introduced a decompiler API as part of IDA v6.6. Is there any plugin which displays the detail Abstract Syntax Tree (AST) produced by the decompiler graphically?
I want something like ...
1
vote
1answer
234 views
How can I walk up along the AST using IDAPython decompiler API?
I am using IDAPython for my analysis. In IDA v6.95, the header file plugins/hexrays_sdk/include/hexrays.hpp defines the following:
typedef ctree_items_t parents_t;
parents_t parents; ///< ...
0
votes
1answer
161 views
How can I see the IDAPython implementation of HexRay's decompiler API?
I am trying to use HexRay's decompiler API, however having trouble due to its lack of documentation. Is there any means so That I can get to see the Python implementation of decompiler API?
3
votes
2answers
153 views
Cleaning HexRays Output
My HexRays decompiler output often looks like:
v0 = LoadLibraryW(L"wininet.dll");
v1 = v0;
if ( !v0 )
goto LABEL_1;
v2 = GetProcAddress(v0, "InternetOpenW");
v3 = GetProcAddress(v1, "...
4
votes
1answer
388 views
How to find matching braces in IDA's decompiled code?
For the source generated by Hex Ray's decompiler in IDA, is it possible to highlight matching braces once I place the pointer at the beginning of a block?
As an example, in the screenshot below, the ...
0
votes
1answer
950 views
What all are the built-in data types available in IDA?
Hex Rays decompiler assigns weird looking data types to variables, e.g. __int64. How do I get to know what all are the built-in data types available in IDA?
0
votes
1answer
125 views
DNameNode class from MSVC binaries
I'm reversing some old game (for fun, to restore its priceless rules). It's been most probably linked statically to MSVCRT, some very old version. Also it uses heavily WinAPI (like ODCBC drivers, ...
2
votes
1answer
417 views
Compile Hex-Rays code
I'm aware, that Hex-Rays provides pseudocode, which is not supposed to be compiled, but I'm trying to do it.
So far I stopped on instructions like that:
char (__usercall *__fastcall sub_947770(...
2
votes
2answers
3k views
What is *(_BYTE *), __usercall, eax and edi [closed]
I am trying to understand some algorithm of how the thing works. Here is the function I got from decompiling my executable with Hey Rays.
I want to run this function to see the result and then ...
2
votes
2answers
1k views
How do I evaluate Hex-Rays Decompiler without purchasing IDA Disassembler?
Hex-Rays, providers of IDA Disassembler, offers a companion product called Hex-Rays Decompiler (not to be confused with HexRaysCodeXplorer, a plugin for the Decompiler plugin rather than for IDA ...
0
votes
1answer
232 views
Change number to sizeof operator [closed]
So i have an structure, let's say it's name is Foo and it's size is 0xAC size and it's initializated in a function like this:
Foo foo;
qmemcpy(&foo, &g_Foo, 0xAC);
How i can change the last ...
2
votes
1answer
32 views
Reversing assembler DCD directive list into a c++ variable
For example we have assembler variable "foo" defined as:
.text:00001078 foo DCD 0xffffffff, 0xffffeeee
How it(variable foo) would look like in c++(or whatever higher lang)???
1
vote
2answers
1k views
Saving .so file in IDA
I have edited .so file in IDA. I don't know how to save it. Any idea for saving them?
6
votes
2answers
763 views
How to get IDA Pro to understand a virtual function table?
I'm reversing an old DirectDraw game that uses DirectX 7.
I have a LPDIRECTDRAWSURFACE7 g_lpDDSBack and g_lpDDSBack->BltFast is being called but this is how it is decompiled in HexRays:
(*(int (...
2
votes
1answer
1k views
Hex-Rays and IDA Python plugin loading order
I have made a plugin (using IDA Python) that requires the Hex-Rays plugin.
As per the instructions in the hexrays_sdk folder, I've named my plugin starting with hexrays_ to make sure it loads after ...
1
vote
1answer
278 views
IDA debugging SSE intrinsics
Whenever I hover over a SSE variable, e.g.:
correct = tmp_corr;
Which are both declared as __m128 IDA shows them as a string of bytes, e.g. "\x00\x00..." sometimes even weird characters...
Is ...
0
votes
1answer
137 views
What to do when IDA does not recognize return value?
I have a function which fetches the Glide screen width and height and passes it to some set-up function (sub_457048).
However, IDA does not recognize that the Glide API function to retrieve the width ...
1
vote
1answer
1k views
How to edit (insert new fields into) IDA structures?
I'm trying to reverse a bigger structure used in an old game. Obviously I didn't know all fields when I created the structure type, and now I want to edit in some new fields / change pure byte gaps ...
4
votes
3answers
2k views
IDApython and IDA-decompiler commenting
Looking at the functions exposed by idaapi I see that functions like the following are exposed.
get_user_cmt
set_user_cmt
save_user_cmts
As these functions are exposed I'm hoping that I have a way ...
1
vote
1answer
566 views
Any easy way to decompile virtual function instances?
What I mean is when the Hex-Rays compiler gives me something like this:
int v1;
CreateSomeInterface(&v1);
(*(int (__thiscall **)(int))(*(_DWORD *)v1 + 4))(0);
And I have a C++ header with the ...
2
votes
3answers
1k views
Reversing an MFC application: How to find class memory layouts?
I have an old computer game I want to reverse (Windows 95 "Hover!" to be exact), and I figured out that it uses the MFC.
HexRays often decompiles pseudocode like this, which, for example, deals with ...
0
votes
3answers
283 views
Hex-Rays decompiles array to int
I decompiled one dll using Hex-Ray but it decompiled array type input argument of dll to int. Any idea how to handle this ??
double dzSell(int a1, double a2, int a3, int a4, int a5)
int a1 is array ...
