Skip to main content

Questions tagged [hexrays]

A decompiler plugin for IDA, producing (pseudo-)C/C++ code, developed by the company of the same name (Hex-Rays).

26 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6 votes
0 answers
722 views

How to create HexRays variables in IDAPython correctly?

Let's assume we have a function which has a following variables in it: Local variables on stack of different types, including types defined in local types window Local variables of different types ...
w s's user avatar
  • 8,508
4 votes
0 answers
277 views

idapython: variable instruction references (def-use) for data flow analysis

Let's consider a code snippet: I can get disassembler variables- def get_function_vars(function) -> list: frameId = idc.get_frame_id(function) if frameId: varStruct = ida_struct....
R4444's user avatar
  • 1,807
4 votes
0 answers
856 views

IDA Hex-Rays structure inline functions recognition

I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve. I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I ...
Martin Brooker's user avatar
3 votes
0 answers
104 views

In the Hex-Rays decompiler, is it possible to assign macros such as NT_SUCCESS

Suppose the decompiler came up with something like this: if (Status >= 0) { // ... some other pseudo code } Is it possible to prettify this code with the NT_SUCCESS() macro, like this: if (...
0xC0000022L's user avatar
  • 10.9k
3 votes
0 answers
2k views

STL map and map entry structures for IDA/HexRays

I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long ...
Tadas S's user avatar
  • 131
2 votes
0 answers
108 views

IDA Decompiler: How to configure Ida to correctly show "array elements left shifting proccess" when index is zero?

I have a buffer in disassembly that its elements are shifted to left (apparently with controlling the zero index), the original code is: flag = 0; for ( i = 0; i < 10; i++ ) { if ( flag ) ...
E.A's user avatar
  • 171
2 votes
0 answers
459 views

incorrect Ghidra decompile functions parameters

I am checking a binary with Ghidra, and it adds to me a lot of parameters to many functions while in IDA it decompiles it well. (I used decompiler parameter ID) I saw someone wrote here about this ...
rom's user avatar
  • 41
2 votes
0 answers
113 views

How to solve bad pseudocode format of Hex-Rays Decompiler?

Look at the following pseudocode: void *__cdecl func(const char *a1, int a2, void *a3) { _DWORD *v3; // esi int v5; // ebp int v6; // eax void *v7; // esi _DWORD *v8; // eax int v9; // edx ...
cong's user avatar
  • 139
2 votes
0 answers
114 views

Understanding Hex-Rays syntax

I have a Ida decompiled function that invokes another function through a function pointer but I'm really confused how it calculates it's address. I'm new to hex-rays syntax. int __fastcall SUB_XXXX(...
Ronny's user avatar
  • 73
2 votes
0 answers
323 views

IDA Hex-Rays Decompiler Generates ASM Code Issue

For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted. Some of the decompiled generated plain C code, show as ASM code :/ i.e: ...
Martin Brooker's user avatar
1 vote
0 answers
76 views

Making an exe file to recognize the Persian/Arabic characters

So I have an .exe file (FileSplitter.exe) and want to change the texts in its GUI to Persian/Arabic (It doesn't matter either is Arabic or Persian). Thus I changed it at first Hex Editing using HxD ...
Fariwar Farsian's user avatar
1 vote
0 answers
291 views

How to find the the event handler function for a QtAbstractButton?

I am not very familiar with Qt to begin with but basic PyQt tutorial showed that a button object is linked with its handler using the connect method that takes in as its argument the function that ...
Ajaykrishnan R's user avatar
1 vote
0 answers
1k views

How to get variable value during IDA (Hex-Rays Decompiler) debugging?

I'm debugging a iOS App by IDA, and I need to see the value of some var like v57 below. Through the Locals panel know the value is 0x1137D0E00LL, but I want to see the real value or class. How to get ...
Yiiff's user avatar
  • 11
1 vote
0 answers
416 views

idapython: how to apply hexrays types to disassembly interface

I am using idapro 7.5 to get variable information from binaries. Consider following simple code: #include <stdio.h> #include <stdlib.h> int main(int argc, char *argv[]) { int i, N, ...
R4444's user avatar
  • 1,807
1 vote
0 answers
377 views

How Can I Clean Up After IDA Decompation with IDAPython or other resource

When I am working on a source code recovery project I am usually left with a lot of code that needs to be manually cleaned up by hand. This can take a lot of time and as projects get larger , I am ...
LUser's user avatar
  • 793
1 vote
0 answers
316 views

IDA Pro Reset All Stack Pointers to Default

Is there a way letting IDA scan all the database and reset all stack pointers values to it's default state that were previously modified? i.e like it was when I first started the analyzing the binary? ...
Martin Brooker's user avatar
1 vote
0 answers
923 views

IDA 7 handling strings in debugger pseudocode

When running a remote debugger to a linux server, is there a way to get IDA (7.0) to properly handle strings? When I go to the pseudocode view, I get things like this; v7 = sub_804AD60((std::string *)...
XeroxDucati's user avatar
1 vote
0 answers
280 views

IDA Pro 7.0 showing incorrect LOCALS in pseudocode view

Whenever I debug something and I switch to pseudocode and then rename some of the "variables" that IDA Pro creates, the values shown in the LOCALS window don't match what the actual values of those ...
alexandernst's user avatar
1 vote
0 answers
406 views

Is there a from...import * equivalent of idaapi.require()?

Loading your own modules from your IDAPython scripts with idaapi.require() suggests using idaapi.require() to load user modules in IDAPython scripts. However in my script, I have extensively used from ...
sherlock's user avatar
  • 1,381
1 vote
0 answers
1k views

IDA Pro not showing structures, even when they're defined

I have this kind of code: I have reversed the struct entirely, and when I try to cast to ClientGame*, instead of: if(mainStruct->something & 2) I see: The offsets 0x364, 0x370, and 0x374 ...
rev's user avatar
  • 1,293
0 votes
1 answer
45 views

IDA show decimal values instead of hex and vertical alignment for ELF file

New to de-compiling, want to set up Ida to give best reading experience with ELF files from android phone. I run in following issues: Even though i set Edit > PlugIns > Hex-Rays Decompiler > ...
FunComesFirst's user avatar
0 votes
0 answers
19 views

How can I use ptr to ptr in idapython?

in hey-rays api there's a method: def find_def(self, *args) -> "minsn_t *": r""" find_def(self, op, p_i1, i2, fdflags) -> minsn_t @param op: mop_t const &...
Ethan Xie's user avatar
0 votes
0 answers
62 views

Hexrays - Enhance decompilation of "pre-multiplied" array indices?

For this x86 (Watcom 1997) assembly that loops over an array, Hexrays yields the following pseudo code: lea eax, ds:0[ecx*4] add eax, ecx shl eax, 3 mov [esp+310h+iMulSize], eax mov ...
Ray's user avatar
  • 1,103
0 votes
0 answers
123 views

How to force IDA to understand that a given literal value is the bitwise combination of enum members?

I have an .so file which uses the dynamic linker with dlopen and friends. So the values for RTLD_* used in dlopen are of relevance to me. The standard imported enum in IDA looks like this: FFFFFFFF ; ...
0xC0000022L's user avatar
  • 10.9k
0 votes
0 answers
53 views

How to get the byte offset of a type casted pointer in IDA PRO

v6 = v5 + 0x3E; if ( v5 + 0x1F >= 0 ) v6 = v5 + 0x1F; v7 = abs32(*(_DWORD *)(buf_14 + 8)) * 4 * (v6 >> 5); I want to get the byte offset pointer pointing at. Is there any way to get ...
msh's user avatar
  • 1
0 votes
0 answers
80 views

Is there a way to aid the IDA decompiling process?

I want to make all local variables contained in a structure with appropriate padding put in the gaps (unused parts of the frame). I want to do the same for the global data. And I want to rename ...
rec's user avatar
  • 475