Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hexrays]

A C/C++ decompiler that has been developed by the same company than IDAPro in response to users needs. It works in close relationship with the IDAPro user interface.

41
votes
1answer
75k views

Decompiling iPhone App

I've been searching this site and more, but I haven't had much luck. I want to decompile an app to see how part of it works, and I've tried multiple programs. I've tried Hopper, IDA, and some other ...
14
votes
1answer
4k views

How to organize vtables in IDA Pro?

I am using IDA Pro to disassemble a C++ behemoth with 1600+ classes, many of them having pure virtual methods. Some classes also are made up of multiple base classes, in hierarchies 5+ levels deep. ...
10
votes
1answer
720 views

Hex-Rays Decompiler: Buffer on the stack

I am currently reversing a windows driver in order to write a Linux compatible driver for a DVB card, but I have come up against a small issue that I can work around, but if it is possible I would ...
9
votes
1answer
857 views

Information provided by Hex-Rays after @ symbol in variable declarations

Could you explain to me the information provided after the @ symbol in Hex-Rays decompilation ? For examples @1 and @5 in the following output: struct WSAData wsadata; // [sp+0h] [bp-1A0h]@1 int v6; /...
7
votes
1answer
686 views

How to map a variable to multiple names in Hex-Rays decompiler

Compilers often optimize variables usage, so multiple variables in the source code can be mapped to the same register (or stack variable) in the resulting assembly. I know that registers can be ...
6
votes
2answers
446 views

Split variable in Hexrays decompiler?

With Microsoft Visual C++ executables, I often run into decompilations like this: void __cdecl Pbdf::ReadString(char *dst, Pbdf *pbdfOrLength) { Pbdf *pbdf; // esi pbdf = pbdfOrLength; ...
5
votes
1answer
2k views

IdaPro/HexRays type libraries

I'm trying to improve my use of ida/hexrays... I have a x86 linux elf binary, non-stripped, statically linked w/ openssl. So you can see all of the OpenSSL function names in the binary. I used the ...
5
votes
1answer
2k views

IDA PRO Hex-Rays 1.5 pseudo code understanding -=0x3FFFFFFFu; += 0x3FFFFFFFu;

I'm trying to clean up the pseudo code to make it compile and function similar if not exactly the same as the original code. This bit which looks like this appears in various places I'm trying to ...
5
votes
2answers
4k views

Hex-Rays: JUMPOUT statements inserted due to incorrect autodetected function boundaries

I'm trying to RE a Windows executable compiled with VS 2008. After the initial autoanalysis most functions are detected correctly; however, some have wrong end address — for some reason IDA places the ...
5
votes
2answers
933 views

How to get IDA Pro to understand a virtual function table?

I'm reversing an old DirectDraw game that uses DirectX 7. I have a LPDIRECTDRAWSURFACE7 g_lpDDSBack and g_lpDDSBack->BltFast is being called but this is how it is decompiled in HexRays: (*(int (...
4
votes
2answers
579 views

HexRays: Variadic methods like printf

I have identified a routine that behaves exactly like printf in an ARM64 binary. Arguments are passed in the standard fashion (e.g. X0, X1, X2 ...) and I have given the function the signature (Y) of: ...
4
votes
1answer
302 views

Resolving FLAGS bits with IDA

While disassembling a binary, IDA decompiler decompiles the call as mmap(0x80000000, 4096, 7, 50, -1, 0); While there is nothing wrong with the decompilation itself, it could be more useful to decode ...
4
votes
1answer
946 views

Condense pseudocode lines in IDA Pro

In IDA 6.6, is it possible to condense, or otherwise re-arrange, lines of pseudocode given by the Hex-Rays decompiler? For example if ( !iFile2Size || *pFile2BufferCopy == *pFile3BufferCopy &&...
4
votes
3answers
2k views

IDApython and IDA-decompiler commenting

Looking at the functions exposed by idaapi I see that functions like the following are exposed. get_user_cmt set_user_cmt save_user_cmts As these functions are exposed I'm hoping that I have a way ...
4
votes
0answers
529 views

How to create HexRays variables in IDAPython correctly?

Let's assume we have a function which has a following variables in it: Local variables on stack of different types, including types defined in local types window Local variables of different types ...
3
votes
2answers
199 views

Cleaning HexRays Output

My HexRays decompiler output often looks like: v0 = LoadLibraryW(L"wininet.dll"); v1 = v0; if ( !v0 ) goto LABEL_1; v2 = GetProcAddress(v0, "InternetOpenW"); v3 = GetProcAddress(v1, "...
3
votes
2answers
3k views

Reverse Engineering MIPS Bootloader

I am trying to figure out how the bootloader of a TP-Link wr702n device (based on an AP121 MIPS board) starts the operation system (VxWorks 5.5.1). The bootloader is extracted from a firmware update ...
3
votes
1answer
461 views

How to find matching braces in IDA's decompiled code?

For the source generated by Hex Ray's decompiler in IDA, is it possible to highlight matching braces once I place the pointer at the beginning of a block? As an example, in the screenshot below, the ...
3
votes
1answer
6k views

IDA Pro/Hex-Rays FLIRT Signatures and Standard library function detection

I'm having some problems performing a standard decompilation of a Windows EXE file using IDA Pro/Hex-Rays and its built-in FLIRT signatures. A lot of standard C++ functions are not being recognized ...
3
votes
1answer
361 views

Does hex-rays support VLA in any way?

I was testing some 'C' code with VLAs. It wasn't that surprising that Hex-Rays was not able to recognize VLA. As with structures there is some way to make it understand (simply making the variable ...
3
votes
0answers
478 views

STL map and map entry structures for IDA/HexRays

I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long ...
2
votes
2answers
2k views

How do I evaluate Hex-Rays Decompiler without purchasing IDA Disassembler?

Hex-Rays, providers of IDA Disassembler, offers a companion product called Hex-Rays Decompiler (not to be confused with HexRaysCodeXplorer, a plugin for the Decompiler plugin rather than for IDA ...
2
votes
3answers
2k views

IDA decompiler macro

What is the purpose of COERCE_FLOAT and COERCE_UNSIGNED_INT macros in the Hex Rays decompiled code below? double __cdecl sub_401580(float a1) { unsigned int v1; // eax@1 double v2; // st7@1 ...
2
votes
4answers
2k views

How to decompile with Hex Rays via a Python API?

If i have a large set of files and I'd like to run Hex-rays over them to produce output as C - can I do so in python? I see there is IDA Python And I see Hex-rays has a C++ SDK Is there a python Hex-...
2
votes
2answers
4k views

What is *(_BYTE *), __usercall, eax and edi [closed]

I am trying to understand some algorithm of how the thing works. Here is the function I got from decompiling my executable with Hey Rays. I want to run this function to see the result and then ...
2
votes
1answer
1k views

Hex-Rays and IDA Python plugin loading order

I have made a plugin (using IDA Python) that requires the Hex-Rays plugin. As per the instructions in the hexrays_sdk folder, I've named my plugin starting with hexrays_ to make sure it loads after ...
2
votes
3answers
2k views

Reversing an MFC application: How to find class memory layouts?

I have an old computer game I want to reverse (Windows 95 "Hover!" to be exact), and I figured out that it uses the MFC. HexRays often decompiles pseudocode like this, which, for example, deals with ...
2
votes
1answer
4k views

What does __PAIR__ mean in Hex-Rays decompiler output? [duplicate]

what does this code on IDA? i've found with this a couple of times and i don't have idea what means. int a5; int dGainMax; COERCE_DOUBLE(__PAIR__(a5, dGainMax))
2
votes
2answers
2k views

IDA Pro: Where does newly created structure go to from Pseudocode window?

Where does newly created structure go to from Pseudocode window? I'm referring to structure that you create via right-click on variable and choosing "Create new struct type". I don't see new ...
2
votes
1answer
263 views

Hex-Rays function signature does not match demangled name

From the demangled name, I know that a function takes an std::string const& as a parameter but when generating psuedo-c code with Hex-Rays' decompiler it autodetects the parameters as (int a1, int ...
2
votes
1answer
486 views

Compile Hex-Rays code

I'm aware, that Hex-Rays provides pseudocode, which is not supposed to be compiled, but I'm trying to do it. So far I stopped on instructions like that: char (__usercall *__fastcall sub_947770(...
2
votes
1answer
35 views

Reversing assembler DCD directive list into a c++ variable

For example we have assembler variable "foo" defined as: .text:00001078 foo DCD 0xffffffff, 0xffffeeee How it(variable foo) would look like in c++(or whatever higher lang)???
2
votes
0answers
58 views

IDA Hex-Rays Decompiler Generates ASM Code Issue

For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted. Some of the decompiled generated plain C code, show as ASM code :/ i.e: ...
2
votes
0answers
1k views

IDA Pro PowerPC Decompiler Plugin supporting Floating Point Instructions

So I far I have been using Snowman for PowerPC decompilation. It is bad though but better than nothing. However, right now it doesn't support floating point instructions. They are simply written down ...
1
vote
2answers
1k views

IDA Hex-Rays Decompiler : Show strings instead of offset

How can i settings IDA show me string instead of offset_xxx?
1
vote
1answer
798 views

Wrapping usercall from Hex-Rays

I am trying to call a function generated by Hex-Rays by injecting a DLL, but have so far only managed to crash the process. This is the code generated by Hex-Rays int __usercall sub_54C3A0@<eax&...
1
vote
1answer
1k views

Doesn't IDA Pro 6.95 support decompiling MIPS executable?

I am working on a MIPS binary: ELF 32-bit MSB executable, MIPS, MIPS-II version 1 (SYSV), statically linked, for GNU/Linux 2.6.32, BuildID[sha1]=76438e9ed749bcfc6e191e548da153d0d3b3ee28, not stripped ....
1
vote
2answers
1k views

Saving .so file in IDA

I have edited .so file in IDA. I don't know how to save it. Any idea for saving them?
1
vote
1answer
2k views

How to edit (insert new fields into) IDA structures?

I'm trying to reverse a bigger structure used in an old game. Obviously I didn't know all fields when I created the structure type, and now I want to edit in some new fields / change pure byte gaps ...
1
vote
1answer
751 views

Large number of IDA .ASM files, need list of potential mnemonics

I have ~20,000 .asm files from IDA pro output via hex-rays. These were all created from known malware, and all from 32bit Windows Portable Executables. I do not have the original executables, just ...
1
vote
2answers
333 views

.NET assembly IDA PRO, using LDSTR IL op code, how to patch a string?

I'm trying to patch a string. So right now I'm trying to replace instruction LDSTR with LDSTR "mystring"; however, I have been unsuccessful. After assembling the LDSTR op code, I don't quite ...
1
vote
1answer
209 views

Odd convention for accessing elements of an array?

While reverse engineering a game using the Hex Rays decompiler I was looking for how an array of NPC's was accessed. I found the array but I don't quite understand the unusual formula for getting the ...
1
vote
1answer
146 views

Is it possible to redirect IDAPython stack trace to console?

I am facing a weird problem! When my IDAPython script crashes, it produces a stack trace in the IDA default warning box that pops up right in front. The size of the box is neither adequate enough to ...
1
vote
2answers
762 views

How to add/find parameters to a function declaration in IDA/HexRays?

I've a binary opened in IDA. It uses a function pointer from a COM vtable. I found that the COM method has 13 parameters (including this). But IDA shows only 4 parameters as shown in this pseudocode: ...
1
vote
1answer
308 views

How do I resolve IDA pro Hexrays aliased local variables?

It appears to me that in my function the compiler has reused a stack slot for two variables of types. However, Hex-Rays has not recognized it as such. How can I split the local variable into two?
1
vote
1answer
266 views

How can I walk up along the AST using IDAPython decompiler API?

I am using IDAPython for my analysis. In IDA v6.95, the header file plugins/hexrays_sdk/include/hexrays.hpp defines the following: typedef ctree_items_t parents_t; parents_t parents; ///< ...
1
vote
1answer
334 views

IDA debugging SSE intrinsics

Whenever I hover over a SSE variable, e.g.: correct = tmp_corr; Which are both declared as __m128 IDA shows them as a string of bytes, e.g. "\x00\x00..." sometimes even weird characters... Is ...
1
vote
1answer
646 views

Any easy way to decompile virtual function instances?

What I mean is when the Hex-Rays compiler gives me something like this: int v1; CreateSomeInterface(&v1); (*(int (__thiscall **)(int))(*(_DWORD *)v1 + 4))(0); And I have a C++ header with the ...
1
vote
1answer
187 views

IDA/Hexrays SDK: how to preserve lvar names?

Last night I was extending functionality of HexRaysCodeXplorer - implemented feature to automatically rename duplicating variables. It needs some fixes to work well, but the problem I cannot cope with ...
1
vote
1answer
1k views

Hex-Rays decompiler stuck on function

I'm working on a Linux x86_64 ELF binary using IDA 6.6. When I run the Hex-Rays Decompiler on a function (by pressing F5) it always shows me the pseudocode for the _init_proc function, no matter what ...