Skip to main content

Questions tagged [hexrays]

A decompiler plugin for IDA, producing (pseudo-)C/C++ code, developed by the company of the same name (Hex-Rays).

Filter by
Sorted by
Tagged with
42 votes
1 answer
94k views

Decompiling iPhone App

I've been searching this site and more, but I haven't had much luck. I want to decompile an app to see how part of it works, and I've tried multiple programs. I've tried Hopper, IDA, and some other ...
user94584392's user avatar
23 votes
1 answer
20k views

How to organize vtables in IDA Pro?

I am using IDA Pro to disassemble a C++ behemoth with 1600+ classes, many of them having pure virtual methods. Some classes also are made up of multiple base classes, in hierarchies 5+ levels deep. ...
speeder's user avatar
  • 387
11 votes
1 answer
821 views

Hex-Rays Decompiler: Buffer on the stack

I am currently reversing a windows driver in order to write a Linux compatible driver for a DVB card, but I have come up against a small issue that I can work around, but if it is possible I would ...
Geoffrey's user avatar
  • 383
10 votes
1 answer
1k views

Information provided by Hex-Rays after @ symbol in variable declarations

Could you explain to me the information provided after the @ symbol in Hex-Rays decompilation ? For examples @1 and @5 in the following output: struct WSAData wsadata; // [sp+0h] [bp-1A0h]@1 int v6; /...
Minh-Triet Pham Tran's user avatar
8 votes
2 answers
2k views

Split variable in Hexrays decompiler?

With Microsoft Visual C++ executables, I often run into decompilations like this: void __cdecl Pbdf::ReadString(char *dst, Pbdf *pbdfOrLength) { Pbdf *pbdf; // esi pbdf = pbdfOrLength; ...
Ray's user avatar
  • 1,103
8 votes
1 answer
1k views

How to map a variable to multiple names in Hex-Rays decompiler

Compilers often optimize variables usage, so multiple variables in the source code can be mapped to the same register (or stack variable) in the resulting assembly. I know that registers can be ...
mbrt's user avatar
  • 183
6 votes
3 answers
12k views

Hex-Rays: JUMPOUT statements inserted due to incorrect autodetected function boundaries

I'm trying to RE a Windows executable compiled with VS 2008. After the initial autoanalysis most functions are detected correctly; however, some have wrong end address — for some reason IDA places the ...
Vladislav Ivanov's user avatar
6 votes
0 answers
722 views

How to create HexRays variables in IDAPython correctly?

Let's assume we have a function which has a following variables in it: Local variables on stack of different types, including types defined in local types window Local variables of different types ...
w s's user avatar
  • 8,508
5 votes
1 answer
3k views

IdaPro/HexRays type libraries

I'm trying to improve my use of ida/hexrays... I have a x86 linux elf binary, non-stripped, statically linked w/ openssl. So you can see all of the OpenSSL function names in the binary. I used the ...
tecknicaltom's user avatar
5 votes
1 answer
2k views

IDA PRO Hex-Rays 1.5 pseudo code understanding -=0x3FFFFFFFu; += 0x3FFFFFFFu;

I'm trying to clean up the pseudo code to make it compile and function similar if not exactly the same as the original code. This bit which looks like this appears in various places I'm trying to ...
SSpoke's user avatar
  • 759
5 votes
2 answers
1k views

Specifying the register value which is constant for all the functions

In the firmwares I met the situation when some register value is set at startup, and then it's implicitly used as a base address to access the variables. e.g. register r13 is set to 0x40000000 which ...
Anton Kukoba's user avatar
  • 1,850
5 votes
2 answers
2k views

How to get IDA Pro to understand a virtual function table?

I'm reversing an old DirectDraw game that uses DirectX 7. I have a LPDIRECTDRAWSURFACE7 g_lpDDSBack and g_lpDDSBack->BltFast is being called but this is how it is decompiled in HexRays: (*(int (...
user16729's user avatar
5 votes
3 answers
1k views

Nested Structures in IDA

I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app; int main() { const int kBits = 1024; const int kExp = 3; RSA *rsa = ...
XeroxDucati's user avatar
5 votes
3 answers
5k views

IDApython and IDA-decompiler commenting

Looking at the functions exposed by idaapi I see that functions like the following are exposed. get_user_cmt set_user_cmt save_user_cmts As these functions are exposed I'm hoping that I have a way ...
user avatar
4 votes
2 answers
1k views

How to show KUSER_SHARED_DATA members in decompiled C code?

Here is a sample C code which prints Windows version directly from address of KUSER_SHARED_DATA. Tested in Windows 10 only. The raw memory address differ in Windows version but that's not the point. #...
Biswapriyo's user avatar
  • 1,569
4 votes
2 answers
9k views

Decompile large function in IDA

I'm working on a crack me, specifically: jaunsacco's DragonCrack and the first thing I've gotten stuck on is that the program is built mostly as a enormous main function. After attempting to decompile ...
Naxin's user avatar
  • 180
4 votes
2 answers
2k views

HexRays: Variadic methods like printf

I have identified a routine that behaves exactly like printf in an ARM64 binary. Arguments are passed in the standard fashion (e.g. X0, X1, X2 ...) and I have given the function the signature (Y) of: ...
Zach Riggle's user avatar
  • 2,357
4 votes
1 answer
2k views

Resolving FLAGS bits with IDA

While disassembling a binary, IDA decompiler decompiles the call as mmap(0x80000000, 4096, 7, 50, -1, 0); While there is nothing wrong with the decompilation itself, it could be more useful to decode ...
sherlock's user avatar
  • 1,381
4 votes
3 answers
5k views

Reversing an MFC application: How to find class memory layouts?

I have an old computer game I want to reverse (Windows 95 "Hover!" to be exact), and I figured out that it uses the MFC. HexRays often decompiles pseudocode like this, which, for example, deals with ...
Ray's user avatar
  • 1,103
4 votes
1 answer
834 views

What is the meaning of this message in IDA?

What is the meaning of this mmessage in IDA: The decompiler assumes that the segment '.text' is read-only because of its NAME. All data references to the segment will be replaced by constant values. ...
M0nte.Carl0's user avatar
4 votes
1 answer
2k views

How do I resolve IDA pro Hexrays aliased local variables?

It appears to me that in my function the compiler has reused a stack slot for two variables of types. However, Hex-Rays has not recognized it as such. How can I split the local variable into two?
Zhentar's user avatar
  • 193
4 votes
1 answer
2k views

Condense pseudocode lines in IDA Pro

In IDA 6.6, is it possible to condense, or otherwise re-arrange, lines of pseudocode given by the Hex-Rays decompiler? For example if ( !iFile2Size || *pFile2BufferCopy == *pFile3BufferCopy &&...
Benjamin Tillman's user avatar
4 votes
0 answers
279 views

idapython: variable instruction references (def-use) for data flow analysis

Let's consider a code snippet: I can get disassembler variables- def get_function_vars(function) -> list: frameId = idc.get_frame_id(function) if frameId: varStruct = ida_struct....
R4444's user avatar
  • 1,807
4 votes
0 answers
857 views

IDA Hex-Rays structure inline functions recognition

I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve. I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I ...
Martin Brooker's user avatar
3 votes
2 answers
4k views

How do I evaluate Hex-Rays Decompiler without purchasing IDA Disassembler?

Hex-Rays, providers of IDA Disassembler, offers a companion product called Hex-Rays Decompiler (not to be confused with HexRaysCodeXplorer, a plugin for the Decompiler plugin rather than for IDA ...
CODE-REaD's user avatar
  • 131
3 votes
2 answers
6k views

IDA Hex-Rays Decompiler : Show strings instead of offset

How can i settings IDA show me string instead of offset_xxx?
beo sen's user avatar
  • 79
3 votes
3 answers
928 views

Cleaning HexRays Output

My HexRays decompiler output often looks like: v0 = LoadLibraryW(L"wininet.dll"); v1 = v0; if ( !v0 ) goto LABEL_1; v2 = GetProcAddress(v0, "InternetOpenW"); v3 = GetProcAddress(v1, "...
omghai2u's user avatar
  • 768
3 votes
2 answers
5k views

Reverse Engineering MIPS Bootloader

I am trying to figure out how the bootloader of a TP-Link wr702n device (based on an AP121 MIPS board) starts the operation system (VxWorks 5.5.1). The bootloader is extracted from a firmware update ...
user3422070's user avatar
3 votes
1 answer
4k views

Doesn't IDA Pro 6.95 support decompiling MIPS executable?

I am working on a MIPS binary: ELF 32-bit MSB executable, MIPS, MIPS-II version 1 (SYSV), statically linked, for GNU/Linux 2.6.32, BuildID[sha1]=76438e9ed749bcfc6e191e548da153d0d3b3ee28, not stripped ....
sherlock's user avatar
  • 1,381
3 votes
2 answers
3k views

Hex-Rays and IDA Python plugin loading order

I have made a plugin (using IDA Python) that requires the Hex-Rays plugin. As per the instructions in the hexrays_sdk folder, I've named my plugin starting with hexrays_ to make sure it loads after ...
Jay Bosamiya's user avatar
3 votes
1 answer
1k views

IDA pseudocode support

How can I know which processors IDA knows how to view pseudocode of? If IDA does not know to view pseudocode for my processor, how can I fix that??
user30486's user avatar
3 votes
1 answer
1k views

How to find matching braces in IDA's decompiled code?

For the source generated by Hex Ray's decompiler in IDA, is it possible to highlight matching braces once I place the pointer at the beginning of a block? As an example, in the screenshot below, the ...
sherlock's user avatar
  • 1,381
3 votes
1 answer
11k views

IDA Pro/Hex-Rays FLIRT Signatures and Standard library function detection

I'm having some problems performing a standard decompilation of a Windows EXE file using IDA Pro/Hex-Rays and its built-in FLIRT signatures. A lot of standard C++ functions are not being recognized ...
Roberto Andrade's user avatar
3 votes
1 answer
241 views

IDA Decompiler generates wrong output on array of structures!

There is a structure with size of 16-Bytes, and an array of it is defined. The disassembly code for navigation through the array is: MOV i, i,LSL#4 LDR R4, =arr_of_struct ADD i, i, R4 LDR ...
E.A's user avatar
  • 171
3 votes
1 answer
529 views

Does hex-rays support VLA in any way?

I was testing some 'C' code with VLAs. It wasn't that surprising that Hex-Rays was not able to recognize VLA. As with structures there is some way to make it understand (simply making the variable ...
rec's user avatar
  • 475
3 votes
0 answers
104 views

In the Hex-Rays decompiler, is it possible to assign macros such as NT_SUCCESS

Suppose the decompiler came up with something like this: if (Status >= 0) { // ... some other pseudo code } Is it possible to prettify this code with the NT_SUCCESS() macro, like this: if (...
0xC0000022L's user avatar
  • 10.9k
3 votes
0 answers
2k views

STL map and map entry structures for IDA/HexRays

I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long ...
Tadas S's user avatar
  • 131
2 votes
4 answers
7k views

How to decompile with Hex Rays via a Python API?

If i have a large set of files and I'd like to run Hex-rays over them to produce output as C - can I do so in python? I see there is IDA Python And I see Hex-rays has a C++ SDK Is there a python Hex-...
chris's user avatar
  • 125
2 votes
3 answers
3k views

IDA decompiler macro

What is the purpose of COERCE_FLOAT and COERCE_UNSIGNED_INT macros in the Hex Rays decompiled code below? double __cdecl sub_401580(float a1) { unsigned int v1; // eax@1 double v2; // st7@1 ...
Arun's user avatar
  • 59
2 votes
2 answers
4k views

How to edit (insert new fields into) IDA structures?

I'm trying to reverse a bigger structure used in an old game. Obviously I didn't know all fields when I created the structure type, and now I want to edit in some new fields / change pure byte gaps ...
Ray's user avatar
  • 1,103
2 votes
2 answers
2k views

How to help IDA to auto complete libc functions?

I have a x86_64 ELF binary which is statically compiled. With some digging, I have found the C library is musl. In IDA Pro 7.0, the decompiled pseudo code shows sycalls as inline assembly code. But in ...
Biswapriyo's user avatar
  • 1,569
2 votes
2 answers
2k views

Saving .so file in IDA

I have edited .so file in IDA. I don't know how to save it. Any idea for saving them?
Sanjith Bravo Dastan's user avatar
2 votes
2 answers
3k views

Hex-Rays not properly showing strings

Here's the difference between Hex_Rays and the debugger: Note that I've synchronized the views, so they are showing the same operations in both the debugger and the decompiler. I've tried Edit -> ...
unc4nny's user avatar
  • 89
2 votes
2 answers
9k views

What is *(_BYTE *), __usercall, eax and edi [closed]

I am trying to understand some algorithm of how the thing works. Here is the function I got from decompiling my executable with Hey Rays. I want to run this function to see the result and then ...
alexey polusov's user avatar
2 votes
1 answer
8k views

What does __PAIR__ mean in Hex-Rays decompiler output? [duplicate]

what does this code on IDA? i've found with this a couple of times and i don't have idea what means. int a5; int dGainMax; COERCE_DOUBLE(__PAIR__(a5, dGainMax))
Criss Moreyra's user avatar
2 votes
2 answers
958 views

IDA PRO Hex-Rays try-catch

I've been working in IDA Pro with a project but there is an issue. Try-Catch statements don't look nice. I've been searching and it seems like IDA does not support them so I was wondering if there is ...
Ricardo's user avatar
  • 197
2 votes
1 answer
2k views

IDA/HexRays: how do I retrieve the memory address associated with a given line of decompiled code?

I'm trying to programmatically link decompiled code generated by HexRays with the disassembly code of a given binary by mapping memory addresses between the two. The mapping exists, as I can see view ...
TFD's user avatar
  • 21
2 votes
2 answers
4k views

IDA Pro: Where does newly created structure go to from Pseudocode window?

Where does newly created structure go to from Pseudocode window? I'm referring to structure that you create via right-click on variable and choosing "Create new struct type". I don't see new ...
expert's user avatar
  • 157
2 votes
1 answer
526 views

how to get indirect callsite function return type and arguments

I am using idapython to get function return type and arguments @ an indirect call instruction. I was able to sync ida disassembler with hexrays decompiler as asked here and I can now get decompiled ...
R4444's user avatar
  • 1,807
2 votes
1 answer
225 views

Disable optimization of for loops in Hex Rays Decompiler

Are there any good ways of splitting up a very long for loop or if statement in IDA into larger chunks to make it more readable? Disabling use fast structure analysis in the Hex Rays decompiler ...
Nicolai Prebensen's user avatar