Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hexrays]

A C/C++ decompiler that has been developed by the same company than IDAPro in response to users needs. It works in close relationship with the IDAPro user interface.

9
votes
1answer
833 views

Information provided by Hex-Rays after @ symbol in variable declarations

Could you explain to me the information provided after the @ symbol in Hex-Rays decompilation ? For examples @1 and @5 in the following output: struct WSAData wsadata; // [sp+0h] [bp-1A0h]@1 int v6; /...
3
votes
2answers
2k views

Reverse Engineering MIPS Bootloader

I am trying to figure out how the bootloader of a TP-Link wr702n device (based on an AP121 MIPS board) starts the operation system (VxWorks 5.5.1). The bootloader is extracted from a firmware update ...
40
votes
1answer
73k views

Decompiling iPhone App

I've been searching this site and more, but I haven't had much luck. I want to decompile an app to see how part of it works, and I've tried multiple programs. I've tried Hopper, IDA, and some other ...
3
votes
1answer
6k views

IDA Pro/Hex-Rays FLIRT Signatures and Standard library function detection

I'm having some problems performing a standard decompilation of a Windows EXE file using IDA Pro/Hex-Rays and its built-in FLIRT signatures. A lot of standard C++ functions are not being recognized ...
2
votes
3answers
1k views

Reversing an MFC application: How to find class memory layouts?

I have an old computer game I want to reverse (Windows 95 "Hover!" to be exact), and I figured out that it uses the MFC. HexRays often decompiles pseudocode like this, which, for example, deals with ...
2
votes
0answers
384 views

STL map and map entry structures for IDA/HexRays

I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long ...
2
votes
1answer
3k views

What does __PAIR__ mean in Hex-Rays decompiler output? [duplicate]

what does this code on IDA? i've found with this a couple of times and i don't have idea what means. int a5; int dGainMax; COERCE_DOUBLE(__PAIR__(a5, dGainMax))
5
votes
1answer
2k views

IDA PRO Hex-Rays 1.5 pseudo code understanding -=0x3FFFFFFFu; += 0x3FFFFFFFu;

I'm trying to clean up the pseudo code to make it compile and function similar if not exactly the same as the original code. This bit which looks like this appears in various places I'm trying to ...
2
votes
3answers
1k views

IDA decompiler macro

What is the purpose of COERCE_FLOAT and COERCE_UNSIGNED_INT macros in the Hex Rays decompiled code below? double __cdecl sub_401580(float a1) { unsigned int v1; // eax@1 double v2; // st7@1 ...
1
vote
2answers
464 views

How to add/find parameters to a function declaration in IDA/HexRays?

I've a binary opened in IDA. It uses a function pointer from a COM vtable. I found that the COM method has 13 parameters (including this). But IDA shows only 4 parameters as shown in this pseudocode: ...
1
vote
1answer
299 views

IDA debugging SSE intrinsics

Whenever I hover over a SSE variable, e.g.: correct = tmp_corr; Which are both declared as __m128 IDA shows them as a string of bytes, e.g. "\x00\x00..." sometimes even weird characters... Is ...