Questions tagged [hexrays]

A decompiler plugin for IDA, producing (pseudo-)C/C++ code, developed by the company of the same name (Hex-Rays).

14 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
534 views

How to create HexRays variables in IDAPython correctly?

Let's assume we have a function which has a following variables in it: Local variables on stack of different types, including types defined in local types window Local variables of different types ...
3
votes
0answers
525 views

STL map and map entry structures for IDA/HexRays

I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long ...
2
votes
0answers
104 views

IDA Hex-Rays Decompiler Generates ASM Code Issue

For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted. Some of the decompiled generated plain C code, show as ASM code :/ i.e: ...
2
votes
0answers
1k views

IDA Pro PowerPC Decompiler Plugin supporting Floating Point Instructions

So I far I have been using Snowman for PowerPC decompilation. It is bad though but better than nothing. However, right now it doesn't support floating point instructions. They are simply written down ...
1
vote
0answers
52 views

Decompile large function in IDA

I'm working on a crack me, specifically: jaunsacco's DragonCrack and the first thing I've gotten stuck on is that the program is built mostly as a enormous main function. After attempting to decompile ...
1
vote
0answers
44 views

IDA Pro Reset All Stack Pointers to Default

Is there a way letting IDA scan all the database and reset all stack pointers values to it's default state that were previously modified? i.e like it was when I first started the analyzing the binary? ...
1
vote
2answers
202 views

Nested Structures in IDA

I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app; int main() { const int kBits = 1024; const int kExp = 3; RSA *rsa =...
1
vote
0answers
148 views

IDA 7 handling strings in debugger pseudocode

When running a remote debugger to a linux server, is there a way to get IDA (7.0) to properly handle strings? When I go to the pseudocode view, I get things like this; v7 = sub_804AD60((std::string *)...
1
vote
0answers
158 views

IDA Pro 7.0 showing incorrect LOCALS in pseudocode view

Whenever I debug something and I switch to pseudocode and then rename some of the "variables" that IDA Pro creates, the values shown in the LOCALS window don't match what the actual values of those ...
1
vote
0answers
237 views

Is there a from…import * equivalent of idaapi.require()?

Loading your own modules from your IDAPython scripts with idaapi.require() suggests using idaapi.require() to load user modules in IDAPython scripts. However in my script, I have extensively used from ...
1
vote
0answers
501 views

IDA Pro not showing structures, even when they're defined

I have this kind of code: I have reversed the struct entirely, and when I try to cast to ClientGame*, instead of: if(mainStruct->something & 2) I see: The offsets 0x364, 0x370, and 0x374 ...
0
votes
1answer
108 views

Weird IDA/Decompiler floating point output

I stumbled upon this (reduced for readability) function. It does weird things that I have never encountered before. // a2 is always 60.0 void some_function(struct_123 *this, float a1, float a2) { ...
0
votes
1answer
152 views

How can I follow virtual function calls in IDA?

I'm trying to reverse a video game that was made with the CryEngine 5 game engine. CryEngine 5 source code is available on GitHub, so I can look at the CryEngine source code and cross reference with ...
0
votes
0answers
107 views

How to remove all goto statements in pseudocode?

IDA shows multiple goto statements in the decompiled pseudocode. I've read this manual page: https://www.hex-rays.com/products/decompiler/manual/config.shtml and tried to disable/enable these flags ...