Questions tagged [hexrays]

A decompiler plugin for IDA, producing (pseudo-)C/C++ code, developed by the company of the same name (Hex-Rays).

Filter by
Sorted by
Tagged with
0
votes
0answers
27 views

Ida pro 6.5 (BATCH MODE)

I have a question related to IDA pro 6.5 batch mode. I want to disassemble (.exe) files and generate (.asm) files. I have executed the cmd command for this and generated an asm file too. But it does ...
0
votes
2answers
93 views

asm snippet to pseudo-code

I'm looking into a way to generate pseudo-code from snippet of assembly, let's assume I have this ASM push rbp mov rbp, rsp mov DWORD PTR [rbp-4], edi mov DWORD PTR [...
0
votes
0answers
88 views

How to reverse engineer Apple MacBook SMC update firmware image using IDA Pro 7.2?

Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware: Charlie Miller: https://www.youtube.com/watch?v=...
0
votes
0answers
15 views

Hex Rays Mapping To Wrong Variable

The assembly file has multiple variables which both use the rax register. The decompiler did recognize that at least somewhat, since it did create two variables which use the rax register. However, it ...
0
votes
0answers
81 views

IDA/Hexrays: local variable allocation has failed; how to fix this?

I'm reverse engineering an old DOS game that's using the DOS/4GW extender. The game includes some libraries that I already successfully reversed in a different application, so I'm pretty sure that the ...
0
votes
1answer
74 views

Re-analyzing pseudocode IDA Pro

While I was reversing a binary I noticed that IDA Pro had adjusted the pseudocode that initially was generated. This happened after I started reversing the binary and renamed functions and variables ...
1
vote
0answers
215 views

IDA Hex-Rays structure inline functions recognition

I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve. I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I ...
1
vote
0answers
63 views

Hex-Ray Decompiler: inline function not recognized

While trying to decompile an application with Hex-Ray 7.0, I stumbled upon the problem that in nearly all cases, what seems to be a certain inline function will not be recognised, which bloats the ...
1
vote
2answers
238 views

Methods for preventing IDA decompiler

I want to write a C function, such that hex-rays decompiler will fail on it. I want to do it for study purposes, and not for an actual anti-reversing method. Do you have any recommendations/approaches ...
2
votes
1answer
105 views

IDA pseudocode support

How can I know which processors IDA knows how to view pseudocode of? If IDA does not know to view pseudocode for my processor, how can I fix that??
0
votes
2answers
205 views

Hex-Rays skips code

have using IDA Pro 6.8 (Hex-Rays 2.2), default settings. Problem starts happens when i trying to analyze function (which actual size ~2886 bytes), pressing F5 (without errors or alerts) and getting ...
0
votes
2answers
529 views

How to help IDA to auto complete libc functions?

I have a x86_64 ELF binary which is statically compiled. With some digging, I have found the C library is musl. In IDA Pro 7.0, the decompiled pseudo code shows sycalls as inline assembly code. But in ...
1
vote
1answer
124 views

Is there a way to show exceptions handlers in Hex-Rays decompiler output?

Is there a way to show these exception handlers in the decompiled code? I can't tell that a block is in a __try block without looking into the disassembly. __int64 __fastcall ...
2
votes
1answer
79 views

How to migrate IDA/HexRays database to the new version of the same application?

I have an .idb and PE file of an old version of an application. Now I want to transfer all knowledge to a new database for the new version of PE. How can I do this? It seems that I need to compare ...
1
vote
0answers
57 views

How Can I Clean Up After IDA Decompation with IDAPython or other resource

When I am working on a source code recovery project I am usually left with a lot of code that needs to be manually cleaned up by hand. This can take a lot of time and as projects get larger , I am ...
-1
votes
1answer
126 views

Understanding (pseudo-)C function from a video game [closed]

I recently found a function using IDA within a game that creates a CRC from a string. I don't understand much of the code or how the game takes in the string as data. __int64 __fastcall ITF::...
1
vote
1answer
1k views

Decompile large function in IDA

I'm working on a crack me, specifically: jaunsacco's DragonCrack and the first thing I've gotten stuck on is that the program is built mostly as a enormous main function. After attempting to decompile ...
1
vote
1answer
166 views

Weird IDA/Decompiler floating point output

I stumbled upon this (reduced for readability) function. It does weird things that I have never encountered before. // a2 is always 60.0 void some_function(struct_123 *this, float a1, float a2) { ...
1
vote
0answers
125 views

IDA Pro Reset All Stack Pointers to Default

Is there a way letting IDA scan all the database and reset all stack pointers values to it's default state that were previously modified? i.e like it was when I first started the analyzing the binary? ...
2
votes
0answers
172 views

IDA Hex-Rays Decompiler Generates ASM Code Issue

For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted. Some of the decompiled generated plain C code, show as ASM code :/ i.e: ...
0
votes
1answer
631 views

How can I follow virtual function calls in IDA?

I'm trying to reverse a video game that was made with the CryEngine 5 game engine. CryEngine 5 source code is available on GitHub, so I can look at the CryEngine source code and cross reference with ...
0
votes
1answer
95 views

Why Ida pseudo-code translate test as AND?

In IDA when disassembling a x86 EXE file there is a line test byte ptr [ebp+XXX], cl Before this line cl has a value of 0x11 The Hex-Rays decompiler plugin translates it as if (v10 &0x11). Why ...
1
vote
2answers
695 views

IDA Hex-Rays: How to SAFELY fix incorrect function declarations?

Update: The problem turned out to be more complex and complex because Hex-Rays incorrectly restores the stack after calls of stdcall functions from cdecl functions: .text:00403F2F 074 ...
0
votes
1answer
733 views

IDA Hex-Rays: How to find all references to the certain field of all instances of the data type?

This question has already been asked here but for some reason it was deleted, as "dead". I will try to explain again. I have a specific data type. It is used in a large number of disassembled ...
0
votes
2answers
399 views

Understanding Hex-Rays pseudo code

What is the meaning of the following pseudo-code?: BYTE1(v2) or BYTE1(v2) HIBYTE(v2) Is there any explanation for those macros? How can I implement those macros in C code?
2
votes
2answers
368 views

Nested Structures in IDA

I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app; int main() { const int kBits = 1024; const int kExp = 3; RSA *rsa =...
0
votes
0answers
189 views

How to remove all goto statements in pseudocode?

IDA shows multiple goto statements in the decompiled pseudocode. I've read this manual page: https://www.hex-rays.com/products/decompiler/manual/config.shtml and tried to disable/enable these flags ...
1
vote
0answers
312 views

IDA 7 handling strings in debugger pseudocode

When running a remote debugger to a linux server, is there a way to get IDA (7.0) to properly handle strings? When I go to the pseudocode view, I get things like this; v7 = sub_804AD60((std::string *)...
1
vote
2answers
786 views

.NET assembly IDA PRO, using LDSTR IL op code, how to patch a string?

I'm trying to patch a string. So right now I'm trying to replace instruction LDSTR with LDSTR "mystring"; however, I have been unsuccessful. After assembling the LDSTR op code, I don't quite ...
4
votes
1answer
649 views

Resolving FLAGS bits with IDA

While disassembling a binary, IDA decompiler decompiles the call as mmap(0x80000000, 4096, 7, 50, -1, 0); While there is nothing wrong with the decompilation itself, it could be more useful to decode ...
0
votes
1answer
299 views

Translating ida macros and pseudocode into C++/C

What would be the translated C output of this hexrays decompiler pseudocode? The values of v6 and v5 are floats just as v8. The value of xmmword_108365D0 is 7FFFFFFF7FFFFFFF7FFFFFFF7FFFFFFFh v8 = (...
1
vote
2answers
2k views

How to add/find parameters to a function declaration in IDA/HexRays?

I've a binary opened in IDA. It uses a function pointer from a COM vtable. I found that the COM method has 13 parameters (including this). But IDA shows only 4 parameters as shown in this pseudocode: ...
2
votes
2answers
3k views

IDA Hex-Rays Decompiler : Show strings instead of offset

How can i settings IDA show me string instead of offset_xxx?
2
votes
1answer
736 views

How do I resolve IDA pro Hexrays aliased local variables?

It appears to me that in my function the compiler has reused a stack slot for two variables of types. However, Hex-Rays has not recognized it as such. How can I split the local variable into two?
-2
votes
2answers
173 views

Some question about IDA [closed]

This binary was from a CTF challenge. I found 2 way to solve this, one is run & debug the bin, set a break point and see result in flag after the bin running, another is trying to understand the ...
6
votes
2answers
828 views

Split variable in Hexrays decompiler?

With Microsoft Visual C++ executables, I often run into decompilations like this: void __cdecl Pbdf::ReadString(char *dst, Pbdf *pbdfOrLength) { Pbdf *pbdf; // esi pbdf = pbdfOrLength; ...
1
vote
1answer
271 views

Odd convention for accessing elements of an array?

While reverse engineering a game using the Hex Rays decompiler I was looking for how an array of NPC's was accessed. I found the array but I don't quite understand the unusual formula for getting the ...
2
votes
1answer
333 views

Hex-Rays function signature does not match demangled name

From the demangled name, I know that a function takes an std::string const& as a parameter but when generating psuedo-c code with Hex-Rays' decompiler it autodetects the parameters as (int a1, int ...
-2
votes
1answer
459 views

(Hex-Rays) How to define C macro?

Im want create reverse macro for constant integers, how i can do it? Example: #define MU_ITEM(x, y) (x * 512 + y) My goal is make result of number format like: before & after.
1
vote
0answers
192 views

IDA Pro 7.0 showing incorrect LOCALS in pseudocode view

Whenever I debug something and I switch to pseudocode and then rename some of the "variables" that IDA Pro creates, the values shown in the LOCALS window don't match what the actual values of those ...
0
votes
2answers
336 views

IDA Hex-Rays suggests an invalid offset

While running Hex-Rays decompiler against an application, Hex-Rays gave the following output: __int64 v29; // r10 ... v29 = 0i64; if( !v28) v19 = 0; do { v30 = *(_BYTE *)(v29 + ...
4
votes
2answers
1k views

HexRays: Variadic methods like printf

I have identified a routine that behaves exactly like printf in an ARM64 binary. Arguments are passed in the standard fashion (e.g. X0, X1, X2 ...) and I have given the function the signature (Y) of: ...
2
votes
4answers
3k views

How to decompile with Hex Rays via a Python API?

If i have a large set of files and I'd like to run Hex-rays over them to produce output as C - can I do so in python? I see there is IDA Python And I see Hex-rays has a C++ SDK Is there a python Hex-...
3
votes
0answers
789 views

STL map and map entry structures for IDA/HexRays

I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long ...
0
votes
2answers
77 views

Tracing the last written value of a memory location without slowdown

I'm trying to debug the corruption of a linked list structure inside of a Win32 DLL with IDA Pro and Hexrays. The offending assembly traverses a doubly-linked list forwards checking a condition, and ...
2
votes
0answers
2k views

IDA Pro PowerPC Decompiler Plugin supporting Floating Point Instructions

So I far I have been using Snowman for PowerPC decompilation. It is bad though but better than nothing. However, right now it doesn't support floating point instructions. They are simply written down ...
0
votes
1answer
183 views

Why does IDA identify so many non-existent methods in this binary?

The decompilation and auto-analysis of this binary is grossly inaccurate. I am providing the binary as well as the IDB. IDA v6.95, 32 bit was used for the analysis. Can anyone take a look and suggest ...
2
votes
1answer
2k views

Doesn't IDA Pro 6.95 support decompiling MIPS executable?

I am working on a MIPS binary: ELF 32-bit MSB executable, MIPS, MIPS-II version 1 (SYSV), statically linked, for GNU/Linux 2.6.32, BuildID[sha1]=76438e9ed749bcfc6e191e548da153d0d3b3ee28, not stripped ....
1
vote
0answers
287 views

Is there a from…import * equivalent of idaapi.require()?

Loading your own modules from your IDAPython scripts with idaapi.require() suggests using idaapi.require() to load user modules in IDAPython scripts. However in my script, I have extensively used from ...
1
vote
1answer
263 views

Is it possible to redirect IDAPython stack trace to console?

I am facing a weird problem! When my IDAPython script crashes, it produces a stack trace in the IDA default warning box that pops up right in front. The size of the box is neither adequate enough to ...