Skip to main content

Questions tagged [hexrays]

A decompiler plugin for IDA, producing (pseudo-)C/C++ code, developed by the company of the same name (Hex-Rays).

Filter by
Sorted by
Tagged with
0 votes
1 answer
57 views

IDA show decimal values instead of hex and vertical alignment for ELF file

New to de-compiling, want to set up Ida to give best reading experience with ELF files from android phone. I run in following issues: Even though i set Edit > PlugIns > Hex-Rays Decompiler > ...
0 votes
0 answers
19 views

How can I use ptr to ptr in idapython?

in hey-rays api there's a method: def find_def(self, *args) -> "minsn_t *": r""" find_def(self, op, p_i1, i2, fdflags) -> minsn_t @param op: mop_t const &...
0 votes
2 answers
2k views

Re-analyzing pseudocode IDA Pro

While I was reversing a binary I noticed that IDA Pro had adjusted the pseudocode that initially was generated. This happened after I started reversing the binary and renamed functions and variables ...
0 votes
0 answers
62 views

Hexrays - Enhance decompilation of "pre-multiplied" array indices?

For this x86 (Watcom 1997) assembly that loops over an array, Hexrays yields the following pseudo code: lea eax, ds:0[ecx*4] add eax, ecx shl eax, 3 mov [esp+310h+iMulSize], eax mov ...
0 votes
1 answer
746 views

How to reverse engineer Apple MacBook SMC update firmware image using IDA Pro 7.2?

Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware: Charlie Miller: https://www.youtube.com/watch?v=...
0 votes
1 answer
482 views

How to get IDA and Hex-Rays to forcibly sync their knowledge of the sample on-demand?

; PCWSTR __stdcall RtlGetNtSystemRoot() public RtlGetNtSystemRoot RtlGetNtSystemRoot proc near ; CODE XREF: LdrpBuildSystem32FileName+1A↑p ...
0 votes
0 answers
125 views

How to force IDA to understand that a given literal value is the bitwise combination of enum members?

I have an .so file which uses the dynamic linker with dlopen and friends. So the values for RTLD_* used in dlopen are of relevance to me. The standard imported enum in IDA looks like this: FFFFFFFF ; ...
0 votes
0 answers
53 views

How to get the byte offset of a type casted pointer in IDA PRO

v6 = v5 + 0x3E; if ( v5 + 0x1F >= 0 ) v6 = v5 + 0x1F; v7 = abs32(*(_DWORD *)(buf_14 + 8)) * 4 * (v6 >> 5); I want to get the byte offset pointer pointing at. Is there any way to get ...
1 vote
1 answer
105 views

How to make IDA stop showing a struct as an array

Sometimes when I am figuring out a struct in IDA, there will be a really big offset and IDA will decide the struct is an array. Consider this from ALPC: if ( (_Message[1].u1.Length & 0x200) != 0 ...
4 votes
1 answer
847 views

What is the meaning of this message in IDA?

What is the meaning of this mmessage in IDA: The decompiler assumes that the segment '.text' is read-only because of its NAME. All data references to the segment will be replaced by constant values. ...
0 votes
1 answer
378 views

Will "Reset decompiler information"+"All caches" invalidate functions marked as decompiled?

In his answer to a question, Rolf pointed me to the Edit -> Other -> Reset decompiler information functionality, suggesting that "All caches" will force the decompiler to pick up ...
4 votes
0 answers
287 views

idapython: variable instruction references (def-use) for data flow analysis

Let's consider a code snippet: I can get disassembler variables- def get_function_vars(function) -> list: frameId = idc.get_frame_id(function) if frameId: varStruct = ida_struct....
3 votes
1 answer
241 views

IDA Decompiler generates wrong output on array of structures!

There is a structure with size of 16-Bytes, and an array of it is defined. The disassembly code for navigation through the array is: MOV i, i,LSL#4 LDR R4, =arr_of_struct ADD i, i, R4 LDR ...
2 votes
0 answers
108 views

IDA Decompiler: How to configure Ida to correctly show "array elements left shifting proccess" when index is zero?

I have a buffer in disassembly that its elements are shifted to left (apparently with controlling the zero index), the original code is: flag = 0; for ( i = 0; i < 10; i++ ) { if ( flag ) ...
23 votes
1 answer
20k views

How to organize vtables in IDA Pro?

I am using IDA Pro to disassemble a C++ behemoth with 1600+ classes, many of them having pure virtual methods. Some classes also are made up of multiple base classes, in hierarchies 5+ levels deep. ...
5 votes
2 answers
1k views

Specifying the register value which is constant for all the functions

In the firmwares I met the situation when some register value is set at startup, and then it's implicitly used as a base address to access the variables. e.g. register r13 is set to 0x40000000 which ...
4 votes
2 answers
9k views

Decompile large function in IDA

I'm working on a crack me, specifically: jaunsacco's DragonCrack and the first thing I've gotten stuck on is that the program is built mostly as a enormous main function. After attempting to decompile ...
1 vote
0 answers
76 views

Making an exe file to recognize the Persian/Arabic characters

So I have an .exe file (FileSplitter.exe) and want to change the texts in its GUI to Persian/Arabic (It doesn't matter either is Arabic or Persian). Thus I changed it at first Hex Editing using HxD ...
5 votes
3 answers
1k views

Nested Structures in IDA

I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app; int main() { const int kBits = 1024; const int kExp = 3; RSA *rsa = ...
1 vote
1 answer
226 views

Reuse pseudocode tab when decompiling in IDA

When I press F5 in IDA to decompile, it always opens a new pseudocode tab, so over time many tabs open and I have to remember to close them. Can I make it so that F5 reuses an already open tab instead ...
2 votes
0 answers
460 views

incorrect Ghidra decompile functions parameters

I am checking a binary with Ghidra, and it adds to me a lot of parameters to many functions while in IDA it decompiles it well. (I used decompiler parameter ID) I saw someone wrote here about this ...
1 vote
0 answers
291 views

How to find the the event handler function for a QtAbstractButton?

I am not very familiar with Qt to begin with but basic PyQt tutorial showed that a button object is linked with its handler using the connect method that takes in as its argument the function that ...
2 votes
1 answer
2k views

IDA Pro PowerPC Decompiler Plugin supporting Floating Point Instructions

So I far I have been using Snowman for PowerPC decompilation. It is bad though but better than nothing. However, right now it doesn't support floating point instructions. They are simply written down ...
2 votes
1 answer
178 views

Decompilation output modification in IDA Pro

I am trying to modify cfunc AST from If (a1 && some_func_ptr) { some_func_ptr(); } To if (a1) { some_func_ptr(); } But I constantly get INTERR 50683 error. I tried new_item = idaapi....
2 votes
0 answers
113 views

How to solve bad pseudocode format of Hex-Rays Decompiler?

Look at the following pseudocode: void *__cdecl func(const char *a1, int a2, void *a3) { _DWORD *v3; // esi int v5; // ebp int v6; // eax void *v7; // esi _DWORD *v8; // eax int v9; // edx ...
1 vote
1 answer
493 views

idapython: how to reset pointer type for variables

I am using IDA Pro 7.6 on win32 x86 binaries. I'm trying to use the ida_hexrays interface to decompile subroutines. I want all of the local variables and arguments of the subroutine to have integral ...
2 votes
1 answer
531 views

how to get indirect callsite function return type and arguments

I am using idapython to get function return type and arguments @ an indirect call instruction. I was able to sync ida disassembler with hexrays decompiler as asked here and I can now get decompiled ...
1 vote
1 answer
140 views

Removing empty blocks ida api

i have a c++ module that removes empty block it used to work well but now I'm porting it to ida 7.7 I'm having issues. mba_t *mba; mba->remove_empty_blocks(); It throws following error "...
1 vote
1 answer
226 views

Can a MSVC class have a deletion destructor without a vftable?

I'm reversing the following smart pointee-like MSVC class Buffer : public Referencable with IDA / Hexrays: struct Referencable { int m_refs; }; struct Buffer : Referencable { void* m_pData; }; ...
2 votes
1 answer
225 views

Disable optimization of for loops in Hex Rays Decompiler

Are there any good ways of splitting up a very long for loop or if statement in IDA into larger chunks to make it more readable? Disabling use fast structure analysis in the Hex Rays decompiler ...
3 votes
0 answers
106 views

In the Hex-Rays decompiler, is it possible to assign macros such as NT_SUCCESS

Suppose the decompiler came up with something like this: if (Status >= 0) { // ... some other pseudo code } Is it possible to prettify this code with the NT_SUCCESS() macro, like this: if (...
1 vote
2 answers
1k views

Hex-Rays skips code

I have using IDA Pro 6.8 (Hex-Rays 2.2), the default settings. The problem starts to happen when I'm trying to analyze function (which actual size ~2886 bytes), pressing F5 (without errors or alerts) ...
1 vote
0 answers
1k views

How to get variable value during IDA (Hex-Rays Decompiler) debugging?

I'm debugging a iOS App by IDA, and I need to see the value of some var like v57 below. Through the Locals panel know the value is 0x1137D0E00LL, but I want to see the real value or class. How to get ...
0 votes
1 answer
120 views

Functions and methods for working with AST tree

I am implementing deep search with Python Hex Ray API. Can someone say classes and methods for implementing this feature with the IDA Python API?
1 vote
1 answer
998 views

Re-analyse HexRays decompiled output

I have analysed a large library in an older version of IDA and want to upgrade. I have marked lots of functions as "decompiled" and changed their function signatures. How do I automatically ...
1 vote
1 answer
478 views

Hex-rays decompiler incorrect logic

I'm practicing reverse engineering in IDA and I created an example application in Visual C++ to practice working with classes/structs and the decompiler output seems to be incorrect - I would like to ...
2 votes
2 answers
4k views

How to edit (insert new fields into) IDA structures?

I'm trying to reverse a bigger structure used in an old game. Obviously I didn't know all fields when I created the structure type, and now I want to edit in some new fields / change pure byte gaps ...
1 vote
2 answers
544 views

How to stop Hex Rays optimizations?

I know it's not a bug, but a feature. Hex Rays found that there's a variable which is set to specific value, thus there's no need to display the branches where the code will never be run, so it warns ...
1 vote
1 answer
994 views

IDA Pro shows an array where two varaibles should be

I'm working in a Delphi binary and found a little issue while generating pseudocode. This is the output (after some clean up) that IDA gives me: Integer __fastcall LBCommon::TLBMemStream::GetFromId(...
2 votes
2 answers
965 views

IDA PRO Hex-Rays try-catch

I've been working in IDA Pro with a project but there is an issue. Try-Catch statements don't look nice. I've been searching and it seems like IDA does not support them so I was wondering if there is ...
1 vote
1 answer
2k views

IDA/Hexrays: local variable allocation has failed; how to fix this?

I'm reverse engineering an old DOS game that's using the DOS/4GW extender. The game includes some libraries that I already successfully reversed in a different application, so I'm pretty sure that the ...
1 vote
1 answer
172 views

Hex Rays Mapping To Wrong Variable

The assembly file has multiple variables which both use the rax register. The decompiler did recognize that at least somewhat, since it did create two variables which use the rax register. However, it ...
2 votes
0 answers
114 views

Understanding Hex-Rays syntax

I have a Ida decompiled function that invokes another function through a function pointer but I'm really confused how it calculates it's address. I'm new to hex-rays syntax. int __fastcall SUB_XXXX(...
0 votes
1 answer
75 views

An incomprehensible line in the output from hex rays

v5 = (*(int (__cdecl **)(int))((char *)&etext + 1))(a1); Please explain me what does this line mean (if possible, please write from what it was compiled from (language - c))
1 vote
2 answers
983 views

How to remove all goto statements in pseudocode?

IDA shows multiple goto statements in the decompiled pseudocode. I've read this manual page: https://www.hex-rays.com/products/decompiler/manual/config.shtml and tried to disable/enable these flags ...
3 votes
3 answers
928 views

Cleaning HexRays Output

My HexRays decompiler output often looks like: v0 = LoadLibraryW(L"wininet.dll"); v1 = v0; if ( !v0 ) goto LABEL_1; v2 = GetProcAddress(v0, "InternetOpenW"); v3 = GetProcAddress(v1, "...
0 votes
0 answers
80 views

Is there a way to aid the IDA decompiling process?

I want to make all local variables contained in a structure with appropriate padding put in the gaps (unused parts of the frame). I want to do the same for the global data. And I want to rename ...
2 votes
1 answer
2k views

IDA/HexRays: how do I retrieve the memory address associated with a given line of decompiled code?

I'm trying to programmatically link decompiled code generated by HexRays with the disassembly code of a given binary by mapping memory addresses between the two. The mapping exists, as I can see view ...
1 vote
1 answer
284 views

IDA HexRays: signed/unsigned types and 32/64 bits dont match assembly

Here is assembly: mov rdi, [r13+rax*8+0] sub rdi, rcx cvtsi2sd xmm0, rdi movsd qword ptr [r11+rax*8], xmm0 cvtsi2sd xmm0, qword ptr [r14+rax*8] movsd qword ptr [rsi+rax*8], ...
0 votes
2 answers
4k views

IDA Hex-Rays: How to find all references to the certain field of all instances of the data type?

This question has already been asked here but for some reason it was deleted, as "dead". I will try to explain again. I have a specific data type. It is used in a large number of disassembled ...