Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hexrays]

A C/C++ decompiler that has been developed by the same company than IDAPro in response to users needs. It works in close relationship with the IDAPro user interface.

0
votes
3answers
296 views

Hex-Rays decompiles array to int

I decompiled one dll using Hex-Ray but it decompiled array type input argument of dll to int. Any idea how to handle this ?? double dzSell(int a1, double a2, int a3, int a4, int a5) int a1 is array ...
13
votes
1answer
3k views

How to organize vtables in IDA Pro?

I am using IDA Pro to disassemble a C++ behemoth with 1600+ classes, many of them having pure virtual methods. Some classes also are made up of multiple base classes, in hierarchies 5+ levels deep. ...
4
votes
1answer
343 views

Does hex-rays support VLA in any way?

I was testing some 'C' code with VLAs. It wasn't that surprising that Hex-Rays was not able to recognize VLA. As with structures there is some way to make it understand (simply making the variable ...
2
votes
3answers
1k views

IDA decompiler macro

What is the purpose of COERCE_FLOAT and COERCE_UNSIGNED_INT macros in the Hex Rays decompiled code below? double __cdecl sub_401580(float a1) { unsigned int v1; // eax@1 double v2; // st7@1 ...
1
vote
1answer
181 views

IDA/Hexrays SDK: how to preserve lvar names?

Last night I was extending functionality of HexRaysCodeXplorer - implemented feature to automatically rename duplicating variables. It needs some fixes to work well, but the problem I cannot cope with ...
4
votes
1answer
860 views

Condense pseudocode lines in IDA Pro

In IDA 6.6, is it possible to condense, or otherwise re-arrange, lines of pseudocode given by the Hex-Rays decompiler? For example if ( !iFile2Size || *pFile2BufferCopy == *pFile3BufferCopy &&...
3
votes
2answers
2k views

Reverse Engineering MIPS Bootloader

I am trying to figure out how the bootloader of a TP-Link wr702n device (based on an AP121 MIPS board) starts the operation system (VxWorks 5.5.1). The bootloader is extracted from a firmware update ...
1
vote
1answer
742 views

Wrapping usercall from Hex-Rays

I am trying to call a function generated by Hex-Rays by injecting a DLL, but have so far only managed to crash the process. This is the code generated by Hex-Rays int __usercall sub_54C3A0@<eax&...
5
votes
2answers
4k views

Hex-Rays: JUMPOUT statements inserted due to incorrect autodetected function boundaries

I'm trying to RE a Windows executable compiled with VS 2008. After the initial autoanalysis most functions are detected correctly; however, some have wrong end address — for some reason IDA places the ...
1
vote
1answer
1k views

Hex-Rays decompiler stuck on function

I'm working on a Linux x86_64 ELF binary using IDA 6.6. When I run the Hex-Rays Decompiler on a function (by pressing F5) it always shows me the pseudocode for the _init_proc function, no matter what ...
5
votes
1answer
2k views

IdaPro/HexRays type libraries

I'm trying to improve my use of ida/hexrays... I have a x86 linux elf binary, non-stripped, statically linked w/ openssl. So you can see all of the OpenSSL function names in the binary. I used the ...
4
votes
0answers
516 views

How to create HexRays variables in IDAPython correctly?

Let's assume we have a function which has a following variables in it: Local variables on stack of different types, including types defined in local types window Local variables of different types ...
7
votes
1answer
645 views

How to map a variable to multiple names in Hex-Rays decompiler

Compilers often optimize variables usage, so multiple variables in the source code can be mapped to the same register (or stack variable) in the resulting assembly. I know that registers can be ...
0
votes
1answer
580 views

How to map a function argument to local variable?

Well, I've got an function that the pseudo code looks like: void d4l_auxadc_cali_unlocked_ioctl() { unsigned int v0; // r1@1 unsigned int v1; // r7@1 ... However, I am aware that the ...
1
vote
1answer
729 views

Large number of IDA .ASM files, need list of potential mnemonics

I have ~20,000 .asm files from IDA pro output via hex-rays. These were all created from known malware, and all from 32bit Windows Portable Executables. I do not have the original executables, just ...
2
votes
1answer
3k views

What does __PAIR__ mean in Hex-Rays decompiler output? [duplicate]

what does this code on IDA? i've found with this a couple of times and i don't have idea what means. int a5; int dGainMax; COERCE_DOUBLE(__PAIR__(a5, dGainMax))
1
vote
0answers
75 views

What are these blue indexes in the disasm output? [closed]

I'm working on a binary that has a lot of FPU operations, and even though IDA (Hex rays) decompiles properly most of them, there's cases like this: Which "decompile" to: Is there any way I can fix ...
2
votes
2answers
1k views

IDA Pro: Where does newly created structure go to from Pseudocode window?

Where does newly created structure go to from Pseudocode window? I'm referring to structure that you create via right-click on variable and choosing "Create new struct type". I don't see new ...
3
votes
1answer
6k views

IDA Pro/Hex-Rays FLIRT Signatures and Standard library function detection

I'm having some problems performing a standard decompilation of a Windows EXE file using IDA Pro/Hex-Rays and its built-in FLIRT signatures. A lot of standard C++ functions are not being recognized ...
5
votes
1answer
2k views

IDA PRO Hex-Rays 1.5 pseudo code understanding -=0x3FFFFFFFu; += 0x3FFFFFFFu;

I'm trying to clean up the pseudo code to make it compile and function similar if not exactly the same as the original code. This bit which looks like this appears in various places I'm trying to ...
1
vote
0answers
420 views

IDA Pro not showing structures, even when they're defined

I have this kind of code: I have reversed the struct entirely, and when I try to cast to ClientGame*, instead of: if(mainStruct->something & 2) I see: The offsets 0x364, 0x370, and 0x374 ...
1
vote
1answer
705 views

Reverse pseudo code

I am reversing a binary which seems to have all the symbols exported which helps. What I have seen is a pile of variables and functions which all start with the letter 'v', for example v101. I have ...
9
votes
1answer
833 views

Information provided by Hex-Rays after @ symbol in variable declarations

Could you explain to me the information provided after the @ symbol in Hex-Rays decompilation ? For examples @1 and @5 in the following output: struct WSAData wsadata; // [sp+0h] [bp-1A0h]@1 int v6; /...
40
votes
1answer
73k views

Decompiling iPhone App

I've been searching this site and more, but I haven't had much luck. I want to decompile an app to see how part of it works, and I've tried multiple programs. I've tried Hopper, IDA, and some other ...
10
votes
1answer
703 views

Hex-Rays Decompiler: Buffer on the stack

I am currently reversing a windows driver in order to write a Linux compatible driver for a DVB card, but I have come up against a small issue that I can work around, but if it is possible I would ...