Questions tagged [hexrays]

A decompiler plugin for IDA, producing (pseudo-)C/C++ code, developed by the company of the same name (Hex-Rays).

Filter by
Sorted by
Tagged with
0 votes
0 answers
59 views

Hexrays - Enhance decompilation of "pre-multiplied" array indices?

For this x86 (Watcom 1997) assembly that loops over an array, Hexrays yields the following pseudo code: lea eax, ds:0[ecx*4] add eax, ecx shl eax, 3 mov [esp+310h+iMulSize], eax mov ...
Ray's user avatar
  • 1,083
0 votes
0 answers
66 views

How to force IDA to understand that a given literal value is the bitwise combination of enum members?

I have an .so file which uses the dynamic linker with dlopen and friends. So the values for RTLD_* used in dlopen are of relevance to me. The standard imported enum in IDA looks like this: FFFFFFFF ; ...
0xC0000022L's user avatar
  • 10.9k
0 votes
0 answers
49 views

How to get the byte offset of a type casted pointer in IDA PRO

v6 = v5 + 0x3E; if ( v5 + 0x1F >= 0 ) v6 = v5 + 0x1F; v7 = abs32(*(_DWORD *)(buf_14 + 8)) * 4 * (v6 >> 5); I want to get the byte offset pointer pointing at. Is there any way to get ...
msh's user avatar
  • 1
1 vote
1 answer
83 views

How to make IDA stop showing a struct as an array

Sometimes when I am figuring out a struct in IDA, there will be a really big offset and IDA will decide the struct is an array. Consider this from ALPC: if ( (_Message[1].u1.Length & 0x200) != 0 ...
MrSynAckSter's user avatar
  • 1,256
4 votes
0 answers
226 views

idapython: variable instruction references (def-use) for data flow analysis

Let's consider a code snippet: I can get disassembler variables- def get_function_vars(function) -> list: frameId = idc.get_frame_id(function) if frameId: varStruct = ida_struct....
R4444's user avatar
  • 1,797
3 votes
1 answer
194 views

IDA Decompiler generates wrong output on array of structures!

There is a structure with size of 16-Bytes, and an array of it is defined. The disassembly code for navigation through the array is: MOV i, i,LSL#4 LDR R4, =arr_of_struct ADD i, i, R4 LDR ...
E.A's user avatar
  • 171
2 votes
0 answers
99 views

IDA Decompiler: How to configure Ida to correctly show "array elements left shifting proccess" when index is zero?

I have a buffer in disassembly that its elements are shifted to left (apparently with controlling the zero index), the original code is: flag = 0; for ( i = 0; i < 10; i++ ) { if ( flag ) ...
E.A's user avatar
  • 171
1 vote
0 answers
72 views

Making an exe file to recognize the Persian/Arabic characters

So I have an .exe file (FileSplitter.exe) and want to change the texts in its GUI to Persian/Arabic (It doesn't matter either is Arabic or Persian). Thus I changed it at first Hex Editing using HxD ...
Fariwar Farsian's user avatar
1 vote
1 answer
195 views

Reuse pseudocode tab when decompiling in IDA

When I press F5 in IDA to decompile, it always opens a new pseudocode tab, so over time many tabs open and I have to remember to close them. Can I make it so that F5 reuses an already open tab instead ...
toomanytabs's user avatar
2 votes
0 answers
408 views

incorrect Ghidra decompile functions parameters

I am checking a binary with Ghidra, and it adds to me a lot of parameters to many functions while in IDA it decompiles it well. (I used decompiler parameter ID) I saw someone wrote here about this ...
rom's user avatar
  • 41
1 vote
0 answers
243 views

How to find the the event handler function for a QtAbstractButton?

I am not very familiar with Qt to begin with but basic PyQt tutorial showed that a button object is linked with its handler using the connect method that takes in as its argument the function that ...
Ajaykrishnan R's user avatar
4 votes
1 answer
645 views

What is the meaning of this message in IDA?

What is the meaning of this mmessage in IDA: The decompiler assumes that the segment '.text' is read-only because of its NAME. All data references to the segment will be replaced by constant values. ...
M0nte.Carl0's user avatar
2 votes
1 answer
163 views

Decompilation output modification in IDA Pro

I am trying to modify cfunc AST from If (a1 && some_func_ptr) { some_func_ptr(); } To if (a1) { some_func_ptr(); } But I constantly get INTERR 50683 error. I tried new_item = idaapi....
mizari's user avatar
  • 81
2 votes
0 answers
110 views

How to solve bad pseudocode format of Hex-Rays Decompiler?

Look at the following pseudocode: void *__cdecl func(const char *a1, int a2, void *a3) { _DWORD *v3; // esi int v5; // ebp int v6; // eax void *v7; // esi _DWORD *v8; // eax int v9; // edx ...
cong's user avatar
  • 139
1 vote
1 answer
436 views

idapython: how to reset pointer type for variables

I am using IDA Pro 7.6 on win32 x86 binaries. I'm trying to use the ida_hexrays interface to decompile subroutines. I want all of the local variables and arguments of the subroutine to have integral ...
coolthingsforme's user avatar
2 votes
1 answer
429 views

how to get indirect callsite function return type and arguments

I am using idapython to get function return type and arguments @ an indirect call instruction. I was able to sync ida disassembler with hexrays decompiler as asked here and I can now get decompiled ...
R4444's user avatar
  • 1,797
1 vote
1 answer
125 views

Removing empty blocks ida api

i have a c++ module that removes empty block it used to work well but now I'm porting it to ida 7.7 I'm having issues. mba_t *mba; mba->remove_empty_blocks(); It throws following error "...
Ronny's user avatar
  • 73
1 vote
1 answer
203 views

Can a MSVC class have a deletion destructor without a vftable?

I'm reversing the following smart pointee-like MSVC class Buffer : public Referencable with IDA / Hexrays: struct Referencable { int m_refs; }; struct Buffer : Referencable { void* m_pData; }; ...
Ray's user avatar
  • 1,083
2 votes
1 answer
214 views

Disable optimization of for loops in Hex Rays Decompiler

Are there any good ways of splitting up a very long for loop or if statement in IDA into larger chunks to make it more readable? Disabling use fast structure analysis in the Hex Rays decompiler ...
Nicolai Prebensen's user avatar
0 votes
1 answer
328 views

Will "Reset decompiler information"+"All caches" invalidate functions marked as decompiled?

In his answer to a question, Rolf pointed me to the Edit -> Other -> Reset decompiler information functionality, suggesting that "All caches" will force the decompiler to pick up ...
0xC0000022L's user avatar
  • 10.9k
0 votes
1 answer
443 views

How to get IDA and Hex-Rays to forcibly sync their knowledge of the sample on-demand?

; PCWSTR __stdcall RtlGetNtSystemRoot() public RtlGetNtSystemRoot RtlGetNtSystemRoot proc near ; CODE XREF: LdrpBuildSystem32FileName+1A↑p ...
0xC0000022L's user avatar
  • 10.9k
3 votes
0 answers
99 views

In the Hex-Rays decompiler, is it possible to assign macros such as NT_SUCCESS

Suppose the decompiler came up with something like this: if (Status >= 0) { // ... some other pseudo code } Is it possible to prettify this code with the NT_SUCCESS() macro, like this: if (...
0xC0000022L's user avatar
  • 10.9k
1 vote
0 answers
909 views

How to get variable value during IDA (Hex-Rays Decompiler) debugging?

I'm debugging a iOS App by IDA, and I need to see the value of some var like v57 below. Through the Locals panel know the value is 0x1137D0E00LL, but I want to see the real value or class. How to get ...
Yiiff's user avatar
  • 11
0 votes
1 answer
112 views

Functions and methods for working with AST tree

I am implementing deep search with Python Hex Ray API. Can someone say classes and methods for implementing this feature with the IDA Python API?
M0nte.Carl0's user avatar
1 vote
1 answer
744 views

Re-analyse HexRays decompiled output

I have analysed a large library in an older version of IDA and want to upgrade. I have marked lots of functions as "decompiled" and changed their function signatures. How do I automatically ...
H Bellamy's user avatar
  • 113
1 vote
1 answer
425 views

Hex-rays decompiler incorrect logic

I'm practicing reverse engineering in IDA and I created an example application in Visual C++ to practice working with classes/structs and the decompiler output seems to be incorrect - I would like to ...
Naxin's user avatar
  • 180
1 vote
1 answer
912 views

IDA Pro shows an array where two varaibles should be

I'm working in a Delphi binary and found a little issue while generating pseudocode. This is the output (after some clean up) that IDA gives me: Integer __fastcall LBCommon::TLBMemStream::GetFromId(...
Ricardo's user avatar
  • 197
2 votes
2 answers
826 views

IDA PRO Hex-Rays try-catch

I've been working in IDA Pro with a project but there is an issue. Try-Catch statements don't look nice. I've been searching and it seems like IDA does not support them so I was wondering if there is ...
Ricardo's user avatar
  • 197
2 votes
0 answers
109 views

Understanding Hex-Rays syntax

I have a Ida decompiled function that invokes another function through a function pointer but I'm really confused how it calculates it's address. I'm new to hex-rays syntax. int __fastcall SUB_XXXX(...
Ronny's user avatar
  • 73
0 votes
1 answer
74 views

An incomprehensible line in the output from hex rays

v5 = (*(int (__cdecl **)(int))((char *)&etext + 1))(a1); Please explain me what does this line mean (if possible, please write from what it was compiled from (language - c))
Inc.ace's user avatar
  • 13
0 votes
0 answers
73 views

Is there a way to aid the IDA decompiling process?

I want to make all local variables contained in a structure with appropriate padding put in the gaps (unused parts of the frame). I want to do the same for the global data. And I want to rename ...
rec's user avatar
  • 475
5 votes
2 answers
958 views

Specifying the register value which is constant for all the functions

In the firmwares I met the situation when some register value is set at startup, and then it's implicitly used as a base address to access the variables. e.g. register r13 is set to 0x40000000 which ...
Anton Kukoba's user avatar
  • 1,840
1 vote
2 answers
490 views

How to stop Hex Rays optimizations?

I know it's not a bug, but a feature. Hex Rays found that there's a variable which is set to specific value, thus there's no need to display the branches where the code will never be run, so it warns ...
Anton Kukoba's user avatar
  • 1,840
1 vote
1 answer
264 views

IDA HexRays: signed/unsigned types and 32/64 bits dont match assembly

Here is assembly: mov rdi, [r13+rax*8+0] sub rdi, rcx cvtsi2sd xmm0, rdi movsd qword ptr [r11+rax*8], xmm0 cvtsi2sd xmm0, qword ptr [r14+rax*8] movsd qword ptr [rsi+rax*8], ...
pete71's user avatar
  • 11
1 vote
2 answers
3k views

Hex-Rays not properly showing strings

Here's the difference between Hex_Rays and the debugger: Note that I've synchronized the views, so they are showing the same operations in both the debugger and the decompiler. I've tried Edit -> ...
unc4nny's user avatar
  • 69
0 votes
1 answer
67 views

What does this custom piece of frame manipulation code from a router binary do?

I've decompiled a custom router ELF binary using Hex-Rays and have recently come across the following function in the binary: pkt_hdr_t *__cdecl pkt_hdr_from_frame(frame_t *frame, uint16_t *remaining) ...
Newbie's user avatar
  • 277
0 votes
1 answer
131 views

LPC2378FBD144 Arm7 hex file

I have binary file for the LPC2378FBD144 processor ineed to reverse engineer it using IDA V7.3 im little confused about memory organization values i should put in the memory organization thank you for ...
Kamil Amin's user avatar
0 votes
1 answer
1k views

Analyzing raw binary without ELF header in IDA Pro

I am trying to analyze and disassemble a raw binary that does not have an ELF header using IDA Pro. I have been trying to convert to code using MakeCode, but have not gotten anywhere as the binary is ...
Nicolai Prebensen's user avatar
4 votes
2 answers
1k views

How to show KUSER_SHARED_DATA members in decompiled C code?

Here is a sample C code which prints Windows version directly from address of KUSER_SHARED_DATA. Tested in Windows 10 only. The raw memory address differ in Windows version but that's not the point. #...
Biswapriyo's user avatar
  • 1,559
1 vote
0 answers
399 views

idapython: how to apply hexrays types to disassembly interface

I am using idapro 7.5 to get variable information from binaries. Consider following simple code: #include <stdio.h> #include <stdlib.h> int main(int argc, char *argv[]) { int i, N, ...
R4444's user avatar
  • 1,797
2 votes
1 answer
1k views

IDA/HexRays: how do I retrieve the memory address associated with a given line of decompiled code?

I'm trying to programmatically link decompiled code generated by HexRays with the disassembly code of a given binary by mapping memory addresses between the two. The mapping exists, as I can see view ...
TFD's user avatar
  • 21
1 vote
2 answers
2k views

STL Data Structures Hex-Rays

We all know that reversing STL code is no fun. To make it easier, I usually create some of the strucutres so I can reference the created STL structures in another custom structure. For example, msvc - ...
Martin Brooker's user avatar
-1 votes
1 answer
206 views

What does xchg means when accessing array element?

I have ASM code of some Windows *.exe in IDA: mov rax, [rbx+10h] mov ecx, edx xor edx, edx xchg rdx, [rax+rcx*8] Which is decompiled to pseudocode to _RAX = this->m_someMemoryPool; ...
yudjin's user avatar
  • 61
1 vote
2 answers
1k views

Batch decompile using IDA Pro 7.5

I am trying to batch disassemble and decompile 500 binaries using the IDA Pro 7.5 disassember and Hex rays decompiler. I can get the .i64 output from the disassembler, but I do not have a way to batch ...
cal_decom's user avatar
0 votes
2 answers
1k views

asm snippet to pseudo-code

I'm looking into a way to generate pseudo-code from snippet of assembly, let's assume I have this ASM push rbp mov rbp, rsp mov DWORD PTR [rbp-4], edi mov DWORD PTR [...
zerocool's user avatar
  • 163
0 votes
1 answer
716 views

How to reverse engineer Apple MacBook SMC update firmware image using IDA Pro 7.2?

Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware: Charlie Miller: https://www.youtube.com/watch?v=...
S To's user avatar
  • 1
1 vote
1 answer
166 views

Hex Rays Mapping To Wrong Variable

The assembly file has multiple variables which both use the rax register. The decompiler did recognize that at least somewhat, since it did create two variables which use the rax register. However, it ...
sasschary's user avatar
1 vote
1 answer
2k views

IDA/Hexrays: local variable allocation has failed; how to fix this?

I'm reverse engineering an old DOS game that's using the DOS/4GW extender. The game includes some libraries that I already successfully reversed in a different application, so I'm pretty sure that the ...
Mentulatus's user avatar
0 votes
2 answers
1k views

Re-analyzing pseudocode IDA Pro

While I was reversing a binary I noticed that IDA Pro had adjusted the pseudocode that initially was generated. This happened after I started reversing the binary and renamed functions and variables ...
Nicolai Prebensen's user avatar
4 votes
0 answers
823 views

IDA Hex-Rays structure inline functions recognition

I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve. I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I ...
Martin Brooker's user avatar