Questions tagged [hexrays]
A decompiler plugin for IDA, producing (pseudo-)C/C++ code, developed by the company of the same name (Hex-Rays).
125
questions
1
vote
1
answer
76
views
idapython: how to reset pointer type for variables
I am using IDA Pro 7.6 on win32 x86 binaries.
I'm trying to use the ida_hexrays interface to decompile subroutines. I want all of the local variables and arguments of the subroutine to have integral ...
1
vote
1
answer
55
views
how to get indirect callsite function return type and arguments
I am using idapython to get function return type and arguments @ an indirect call instruction.
I was able to sync ida disassembler with hexrays decompiler as asked here and I can now get decompiled ...
- 1,427
1
vote
1
answer
40
views
Removing empty blocks ida api
i have a c++ module that removes empty block it used to work well but now I'm porting it to ida 7.7 I'm having issues.
mba_t *mba;
mba->remove_empty_blocks();
It throws following error
"...
- 73
1
vote
1
answer
49
views
Can a MSVC class have a deletion destructor without a vftable?
I'm reversing the following smart pointee-like MSVC class Buffer : public Referencable with IDA / Hexrays:
struct Referencable
{
int m_refs;
};
struct Buffer : Referencable
{
void* m_pData;
};
...
- 983
2
votes
1
answer
73
views
Disable optimization of for loops in Hex Rays Decompiler
Are there any good ways of splitting up a very long for loop or if statement in IDA into larger chunks to make it more readable? Disabling use fast structure analysis in the Hex Rays decompiler ...
0
votes
1
answer
69
views
Will "Reset decompiler information"+"All caches" invalidate functions marked as decompiled?
In his answer to a question, Rolf pointed me to the Edit -> Other -> Reset decompiler information functionality, suggesting that "All caches" will force the decompiler to pick up ...
- 10.5k
0
votes
1
answer
79
views
How to get IDA and Hex-Rays to forcibly sync their knowledge of the sample on-demand?
; PCWSTR __stdcall RtlGetNtSystemRoot()
public RtlGetNtSystemRoot
RtlGetNtSystemRoot proc near ; CODE XREF: LdrpBuildSystem32FileName+1A↑p
...
- 10.5k
2
votes
0
answers
46
views
In the Hex-Rays decompiler, is it possible to assign macros such as NT_SUCCESS
Suppose the decompiler came up with something like this:
if (Status >= 0)
{
// ... some other pseudo code
}
Is it possible to prettify this code with the NT_SUCCESS() macro, like this:
if (...
- 10.5k
1
vote
0
answers
93
views
How to get variable value during IDA (Hex-Rays Decompiler) debugging?
I'm debugging a iOS App by IDA, and I need to see the value of some var like v57 below.
Through the Locals panel know the value is 0x1137D0E00LL, but I want to see the real value or class.
How to get ...
- 11
0
votes
1
answer
43
views
Functions and methods for working with AST tree
I am implementing deep search with Python Hex Ray API.
Can someone say classes and methods for implementing this feature with the IDA Python API?
- 13
1
vote
1
answer
76
views
Re-analyse HexRays decompiled output
I have analysed a large library in an older version of IDA and want to upgrade. I have marked lots of functions as "decompiled" and changed their function signatures.
How do I automatically ...
- 113
1
vote
1
answer
167
views
Hex-rays decompiler incorrect logic
I'm practicing reverse engineering in IDA and I created an example application in Visual C++ to practice working with classes/structs and the decompiler output seems to be incorrect - I would like to ...
- 151
1
vote
1
answer
298
views
IDA Pro shows an array where two varaibles should be
I'm working in a Delphi binary and found a little issue while generating pseudocode.
This is the output (after some clean up) that IDA gives me:
Integer __fastcall LBCommon::TLBMemStream::GetFromId(...
- 97
2
votes
2
answers
290
views
IDA PRO Hex-Rays try-catch
I've been working in IDA Pro with a project but there is an issue. Try-Catch statements don't look nice.
I've been searching and it seems like IDA does not support them so I was wondering if there is ...
- 97
2
votes
0
answers
79
views
Understanding Hex-Rays syntax
I have a Ida decompiled function that invokes another function through a function pointer but I'm really confused how it calculates it's address. I'm new to hex-rays syntax.
int __fastcall SUB_XXXX(...
- 73
0
votes
1
answer
66
views
An incomprehensible line in the output from hex rays
v5 = (*(int (__cdecl **)(int))((char *)&etext + 1))(a1);
Please explain me what does this line mean (if possible, please write from what it was compiled from (language - c))
- 13
0
votes
0
answers
56
views
Is there a way to aid the IDA decompiling process?
I want to make all local variables contained in a structure with appropriate padding put in the gaps (unused parts of the frame). I want to do the same for the global data. And I want to rename ...
- 383
3
votes
1
answer
206
views
Specifying the register value which is constant for all the functions
In the firmwares I met the situation when some register value is set at startup, and then it's implicitly used as a base address to access the variables.
e.g. register r13 is set to 0x40000000 which ...
- 1,750
1
vote
2
answers
169
views
How to stop Hex Rays optimizations?
I know it's not a bug, but a feature. Hex Rays found that there's a variable which is set to specific value, thus there's no need to display the branches where the code will never be run, so it warns ...
- 1,750
1
vote
1
answer
79
views
IDA HexRays: signed/unsigned types and 32/64 bits dont match assembly
Here is assembly:
mov rdi, [r13+rax*8+0]
sub rdi, rcx
cvtsi2sd xmm0, rdi
movsd qword ptr [r11+rax*8], xmm0
cvtsi2sd xmm0, qword ptr [r14+rax*8]
movsd qword ptr [rsi+rax*8], ...
- 11
1
vote
2
answers
1k
views
Hex-Rays not properly showing strings
Here's the difference between Hex_Rays and the debugger:
Note that I've synchronized the views, so they are showing the same operations in both the debugger and the decompiler. I've tried Edit -> ...
- 69
0
votes
1
answer
61
views
What does this custom piece of frame manipulation code from a router binary do?
I've decompiled a custom router ELF binary using Hex-Rays and have recently come across the following function in the binary:
pkt_hdr_t *__cdecl pkt_hdr_from_frame(frame_t *frame, uint16_t *remaining)
...
- 257
0
votes
1
answer
50
views
LPC2378FBD144 Arm7 hex file
I have binary file for the LPC2378FBD144 processor ineed to reverse engineer it using IDA V7.3
im little confused about memory organization values i should put in the memory organization thank you for ...
0
votes
1
answer
541
views
Analyzing raw binary without ELF header in IDA Pro
I am trying to analyze and disassemble a raw binary that does not have an ELF header using IDA Pro.
I have been trying to convert to code using MakeCode, but have not gotten anywhere as the binary is ...
4
votes
2
answers
572
views
How to show KUSER_SHARED_DATA members in decompiled C code?
Here is a sample C code which prints Windows version directly from address
of KUSER_SHARED_DATA. Tested in Windows 10 only. The raw memory address
differ in Windows version but that's not the point.
#...
- 1,429
0
votes
0
answers
278
views
idapython: how to apply hexrays types to disassembly interface
I am using idapro 7.5 to get variable information from binaries.
Consider following simple code:
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char *argv[])
{
int i, N, ...
- 1,427
2
votes
1
answer
416
views
IDA/HexRays: how do I retrieve the memory address associated with a given line of decompiled code?
I'm trying to programmatically link decompiled code generated by HexRays with the disassembly code of a given binary by mapping memory addresses between the two. The mapping exists, as I can see view ...
- 21
1
vote
2
answers
337
views
STL Data Structures Hex-Rays
We all know that reversing STL code is no fun. To make it easier, I usually create some of the strucutres so I can reference the created STL structures in another custom structure.
For example, msvc - ...
-1
votes
1
answer
119
views
What does xchg means when accessing array element?
I have ASM code of some Windows *.exe in IDA:
mov rax, [rbx+10h]
mov ecx, edx
xor edx, edx
xchg rdx, [rax+rcx*8]
Which is decompiled to pseudocode to
_RAX = this->m_someMemoryPool;
...
- 61
1
vote
2
answers
789
views
Batch decompile using IDA Pro 7.5
I am trying to batch disassemble and decompile 500 binaries using the IDA Pro 7.5 disassember and Hex rays decompiler. I can get the .i64 output from the disassembler, but I do not have a way to batch ...
- 19
0
votes
2
answers
541
views
asm snippet to pseudo-code
I'm looking into a way to generate pseudo-code from snippet of assembly,
let's assume I have this ASM
push rbp
mov rbp, rsp
mov DWORD PTR [rbp-4], edi
mov DWORD PTR [...
- 163
0
votes
1
answer
412
views
How to reverse engineer Apple MacBook SMC update firmware image using IDA Pro 7.2?
Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware:
Charlie Miller:
https://www.youtube.com/watch?v=...
- 1
1
vote
1
answer
114
views
Hex Rays Mapping To Wrong Variable
The assembly file has multiple variables which both use the rax register. The decompiler did recognize that at least somewhat, since it did create two variables which use the rax register. However, it ...
- 53
1
vote
1
answer
771
views
IDA/Hexrays: local variable allocation has failed; how to fix this?
I'm reverse engineering an old DOS game that's using the DOS/4GW extender. The game includes some libraries that I already successfully reversed in a different application, so I'm pretty sure that the ...
- 57
0
votes
1
answer
334
views
Re-analyzing pseudocode IDA Pro
While I was reversing a binary I noticed that IDA Pro had adjusted the pseudocode that initially was generated. This happened after I started reversing the binary and renamed functions and variables ...
3
votes
0
answers
574
views
IDA Hex-Rays structure inline functions recognition
I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve.
I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I ...
1
vote
1
answer
197
views
Hex-Ray Decompiler: inline function not recognized
While trying to decompile an application with Hex-Ray 7.0, I stumbled upon the problem that in nearly all cases, what seems to be a certain inline function will not be recognised, which bloats the ...
- 57
1
vote
2
answers
657
views
Methods for preventing IDA decompiler
I want to write a C function, such that hex-rays decompiler will fail on it. I want to do it for study purposes, and not for an actual anti-reversing method. Do you have any recommendations/approaches ...
- 1,748
3
votes
1
answer
319
views
IDA pseudocode support
How can I know which processors IDA knows how to view pseudocode of?
If IDA does not know to view pseudocode for my processor, how can I fix that??
- 31
1
vote
2
answers
740
views
Hex-Rays skips code
I have using IDA Pro 6.8 (Hex-Rays 2.2), the default settings.
The problem starts to happen when I'm trying to analyze function (which actual size ~2886 bytes), pressing F5 (without errors or alerts) ...
- 11
2
votes
2
answers
1k
views
How to help IDA to auto complete libc functions?
I have a x86_64 ELF binary which is statically compiled. With some digging,
I have found the C library is musl. In IDA Pro 7.0, the decompiled pseudo code
shows sycalls as inline assembly code. But in ...
- 1,429
2
votes
1
answer
509
views
Is there a way to show exceptions handlers in Hex-Rays decompiler output?
Is there a way to show these exception handlers in the decompiled code?
I can't tell that a block is in a __try block without looking into the disassembly.
__int64 __fastcall ...
- 23
2
votes
1
answer
217
views
How to migrate IDA/HexRays database to the new version of the same application?
I have an .idb and PE file of an old version of an application. Now I want to transfer all knowledge to a new database for the new version of PE. How can I do this?
It seems that I need to compare ...
- 37
1
vote
0
answers
159
views
How Can I Clean Up After IDA Decompation with IDAPython or other resource
When I am working on a source code recovery project I am usually left with a lot of code that needs to be manually cleaned up by hand. This can take a lot of time and as projects get larger , I am ...
- 723
-1
votes
1
answer
169
views
Understanding (pseudo-)C function from a video game [closed]
I recently found a function using IDA within a game that creates a CRC from a string. I don't understand much of the code or how the game takes in the string as data.
__int64 __fastcall ITF::...
1
vote
1
answer
4k
views
Decompile large function in IDA
I'm working on a crack me, specifically: jaunsacco's DragonCrack and the first thing I've gotten stuck on is that the program is built mostly as a enormous main function. After attempting to decompile ...
- 151
1
vote
1
answer
252
views
Weird IDA/Decompiler floating point output
I stumbled upon this (reduced for readability) function. It does weird things that I have never encountered before.
// a2 is always 60.0
void some_function(struct_123 *this, float a1, float a2)
{
...
1
vote
0
answers
239
views
IDA Pro Reset All Stack Pointers to Default
Is there a way letting IDA scan all the database and reset all stack pointers values to it's default state that were previously modified? i.e like it was when I first started the analyzing the binary?
...
2
votes
0
answers
236
views
IDA Hex-Rays Decompiler Generates ASM Code Issue
For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted.
Some of the decompiled generated plain C code, show as ASM code :/
i.e:
...
0
votes
1
answer
2k
views
How can I follow virtual function calls in IDA?
I'm trying to reverse a video game that was made with the CryEngine 5 game engine. CryEngine 5 source code is available on GitHub, so I can look at the CryEngine source code and cross reference with ...
- 1