Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hexrays]

A C/C++ decompiler that has been developed by the same company than IDAPro in response to users needs. It works in close relationship with the IDAPro user interface.

1
vote
2answers
188 views

Nested Structures in IDA

I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app; int main() { const int kBits = 1024; const int kExp = 3; RSA *rsa =...
0
votes
1answer
109 views

How can I follow virtual function calls in IDA?

I'm trying to reverse a video game that was made with the CryEngine 5 game engine. CryEngine 5 source code is available on GitHub, so I can look at the CryEngine source code and cross reference with ...
4
votes
0answers
529 views

How to create HexRays variables in IDAPython correctly?

Let's assume we have a function which has a following variables in it: Local variables on stack of different types, including types defined in local types window Local variables of different types ...
3
votes
0answers
490 views

STL map and map entry structures for IDA/HexRays

I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long ...
2
votes
0answers
86 views

IDA Hex-Rays Decompiler Generates ASM Code Issue

For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted. Some of the decompiled generated plain C code, show as ASM code :/ i.e: ...
2
votes
0answers
1k views

IDA Pro PowerPC Decompiler Plugin supporting Floating Point Instructions

So I far I have been using Snowman for PowerPC decompilation. It is bad though but better than nothing. However, right now it doesn't support floating point instructions. They are simply written down ...
1
vote
0answers
23 views

IDA Pro Reset All Stack Pointers to Default

Is there a way letting IDA scan all the database and reset all stack pointers values to it's default state that were previously modified? i.e like it was when I first started the analyzing the binary? ...
1
vote
0answers
128 views

IDA 7 handling strings in debugger pseudocode

When running a remote debugger to a linux server, is there a way to get IDA (7.0) to properly handle strings? When I go to the pseudocode view, I get things like this; v7 = sub_804AD60((std::string *)...
1
vote
0answers
156 views

IDA Pro 7.0 showing incorrect LOCALS in pseudocode view

Whenever I debug something and I switch to pseudocode and then rename some of the "variables" that IDA Pro creates, the values shown in the LOCALS window don't match what the actual values of those ...
1
vote
0answers
228 views

Is there a from…import * equivalent of idaapi.require()?

Loading your own modules from your IDAPython scripts with idaapi.require() suggests using idaapi.require() to load user modules in IDAPython scripts. However in my script, I have extensively used from ...
1
vote
0answers
472 views

IDA Pro not showing structures, even when they're defined

I have this kind of code: I have reversed the struct entirely, and when I try to cast to ClientGame*, instead of: if(mainStruct->something & 2) I see: The offsets 0x364, 0x370, and 0x374 ...
0
votes
0answers
4 views

What to do when the IDA pointer returning incorrect value

I'm having a problem developing my program. I have an IDA pointer, this pointer is a struct that returns me values such as size, hp, energy,... but trying to pull this value is not returning the ...
0
votes
0answers
94 views

How to remove all goto statements in pseudocode?

IDA shows multiple goto statements in the decompiled pseudocode. I've read this manual page: https://www.hex-rays.com/products/decompiler/manual/config.shtml and tried to disable/enable these flags ...