Questions tagged [hexrays]
A decompiler plugin for IDA, producing (pseudo-)C/C++ code, developed by the company of the same name (Hex-Rays).
139
questions
0
votes
0
answers
49
views
Hexrays - Enhance decompilation of "pre-multiplied" array indices?
For this x86 (Watcom 1997) assembly that loops over an array, Hexrays yields the following pseudo code:
lea eax, ds:0[ecx*4]
add eax, ecx
shl eax, 3
mov [esp+310h+iMulSize], eax
mov ...
- 1,083
0
votes
1
answer
686
views
How to reverse engineer Apple MacBook SMC update firmware image using IDA Pro 7.2?
Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware:
Charlie Miller:
https://www.youtube.com/watch?v=...
0
votes
1
answer
411
views
How to get IDA and Hex-Rays to forcibly sync their knowledge of the sample on-demand?
; PCWSTR __stdcall RtlGetNtSystemRoot()
public RtlGetNtSystemRoot
RtlGetNtSystemRoot proc near ; CODE XREF: LdrpBuildSystem32FileName+1A↑p
...
- 10.9k
0
votes
0
answers
38
views
How to force IDA to understand that a given literal value is the bitwise combination of enum members?
I have an .so file which uses the dynamic linker with dlopen and friends. So the values for RTLD_* used in dlopen are of relevance to me. The standard imported enum in IDA looks like this:
FFFFFFFF ; ...
- 10.9k
0
votes
0
answers
39
views
How to get the byte offset of a type casted pointer in IDA PRO
v6 = v5 + 0x3E;
if ( v5 + 0x1F >= 0 )
v6 = v5 + 0x1F;
v7 = abs32(*(_DWORD *)(buf_14 + 8)) * 4 * (v6 >> 5);
I want to get the byte offset pointer pointing at.
Is there any way to get ...
- 1
1
vote
1
answer
78
views
How to make IDA stop showing a struct as an array
Sometimes when I am figuring out a struct in IDA, there will be a really big offset and IDA will decide the struct is an array.
Consider this from ALPC:
if ( (_Message[1].u1.Length & 0x200) != 0 ...
- 579
4
votes
1
answer
504
views
What is the meaning of this message in IDA?
What is the meaning of this mmessage in IDA:
The decompiler assumes that the segment '.text' is read-only because of its NAME. All data references to the segment will be replaced by constant values. ...
- 171
0
votes
1
answer
273
views
Will "Reset decompiler information"+"All caches" invalidate functions marked as decompiled?
In his answer to a question, Rolf pointed me to the Edit -> Other -> Reset decompiler information functionality, suggesting that "All caches" will force the decompiler to pick up ...
- 10.9k
4
votes
0
answers
174
views
idapython: variable instruction references (def-use) for data flow analysis
Let's consider a code snippet:
I can get disassembler variables-
def get_function_vars(function) -> list:
frameId = idc.get_frame_id(function)
if frameId:
varStruct = ida_struct....
- 1,797
3
votes
1
answer
166
views
IDA Decompiler generates wrong output on array of structures!
There is a structure with size of 16-Bytes, and an array of it is defined.
The disassembly code for navigation through the array is:
MOV i, i,LSL#4
LDR R4, =arr_of_struct
ADD i, i, R4
LDR ...
- 171
2
votes
0
answers
92
views
IDA Decompiler: How to configure Ida to correctly show "array elements left shifting proccess" when index is zero?
I have a buffer in disassembly that its elements are shifted to left (apparently with controlling the zero index), the original code is:
flag = 0;
for ( i = 0; i < 10; i++ )
{
if ( flag )
...
- 10.9k
22
votes
1
answer
19k
views
How to organize vtables in IDA Pro?
I am using IDA Pro to disassemble a C++ behemoth with 1600+ classes, many of them having pure virtual methods.
Some classes also are made up of multiple base classes, in hierarchies 5+ levels deep.
...
- 1,083
5
votes
2
answers
833
views
Specifying the register value which is constant for all the functions
In the firmwares I met the situation when some register value is set at startup, and then it's implicitly used as a base address to access the variables.
e.g. register r13 is set to 0x40000000 which ...
- 111
3
votes
2
answers
7k
views
Decompile large function in IDA
I'm working on a crack me, specifically: jaunsacco's DragonCrack and the first thing I've gotten stuck on is that the program is built mostly as a enormous main function. After attempting to decompile ...
- 29
1
vote
0
answers
59
views
Making an exe file to recognize the Persian/Arabic characters
So I have an .exe file (FileSplitter.exe) and want to change the texts in its GUI to Persian/Arabic (It doesn't matter either is Arabic or Persian).
Thus I changed it at first Hex Editing using HxD ...
5
votes
3
answers
976
views
Nested Structures in IDA
I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app;
int main() {
const int kBits = 1024;
const int kExp = 3;
RSA *rsa = ...
- 10.9k
1
vote
1
answer
157
views
Reuse pseudocode tab when decompiling in IDA
When I press F5 in IDA to decompile, it always opens a new pseudocode tab, so over time many tabs open and I have to remember to close them. Can I make it so that F5 reuses an already open tab instead ...
- 9,178
2
votes
0
answers
369
views
incorrect Ghidra decompile functions parameters
I am checking a binary with Ghidra, and it adds to me a lot of parameters to many functions while in IDA it decompiles it well. (I used decompiler parameter ID)
I saw someone wrote here about this ...
- 10.9k
1
vote
0
answers
193
views
How to find the the event handler function for a QtAbstractButton?
I am not very familiar with Qt to begin with but basic PyQt tutorial showed that a button object is linked with its handler using the connect method that takes in as its argument the function that ...
- 10.9k
2
votes
1
answer
2k
views
IDA Pro PowerPC Decompiler Plugin supporting Floating Point Instructions
So I far I have been using Snowman for PowerPC decompilation. It is bad though but better than nothing. However, right now it doesn't support floating point instructions. They are simply written down ...
- 151
2
votes
1
answer
143
views
Decompilation output modification in IDA Pro
I am trying to modify cfunc AST from
If (a1 && some_func_ptr) {
some_func_ptr();
}
To
if (a1) {
some_func_ptr();
}
But I constantly get INTERR 50683 error. I tried
new_item = idaapi....
- 81
2
votes
0
answers
109
views
How to solve bad pseudocode format of Hex-Rays Decompiler?
Look at the following pseudocode:
void *__cdecl func(const char *a1, int a2, void *a3)
{
_DWORD *v3; // esi
int v5; // ebp
int v6; // eax
void *v7; // esi
_DWORD *v8; // eax
int v9; // edx
...
- 10.9k
1
vote
1
answer
386
views
idapython: how to reset pointer type for variables
I am using IDA Pro 7.6 on win32 x86 binaries.
I'm trying to use the ida_hexrays interface to decompile subroutines. I want all of the local variables and arguments of the subroutine to have integral ...
- 9,178
2
votes
1
answer
366
views
how to get indirect callsite function return type and arguments
I am using idapython to get function return type and arguments @ an indirect call instruction.
I was able to sync ida disassembler with hexrays decompiler as asked here and I can now get decompiled ...
- 9,178
1
vote
1
answer
116
views
Removing empty blocks ida api
i have a c++ module that removes empty block it used to work well but now I'm porting it to ida 7.7 I'm having issues.
mba_t *mba;
mba->remove_empty_blocks();
It throws following error
"...
- 9,178
1
vote
1
answer
178
views
Can a MSVC class have a deletion destructor without a vftable?
I'm reversing the following smart pointee-like MSVC class Buffer : public Referencable with IDA / Hexrays:
struct Referencable
{
int m_refs;
};
struct Buffer : Referencable
{
void* m_pData;
};
...
- 1,083
2
votes
1
answer
202
views
Disable optimization of for loops in Hex Rays Decompiler
Are there any good ways of splitting up a very long for loop or if statement in IDA into larger chunks to make it more readable? Disabling use fast structure analysis in the Hex Rays decompiler ...
- 9,178
3
votes
0
answers
91
views
In the Hex-Rays decompiler, is it possible to assign macros such as NT_SUCCESS
Suppose the decompiler came up with something like this:
if (Status >= 0)
{
// ... some other pseudo code
}
Is it possible to prettify this code with the NT_SUCCESS() macro, like this:
if (...
- 10.9k
1
vote
2
answers
1k
views
Hex-Rays skips code
I have using IDA Pro 6.8 (Hex-Rays 2.2), the default settings.
The problem starts to happen when I'm trying to analyze function (which actual size ~2886 bytes), pressing F5 (without errors or alerts) ...
CommunityBot
- 1
1
vote
0
answers
763
views
How to get variable value during IDA (Hex-Rays Decompiler) debugging?
I'm debugging a iOS App by IDA, and I need to see the value of some var like v57 below.
Through the Locals panel know the value is 0x1137D0E00LL, but I want to see the real value or class.
How to get ...
- 11
0
votes
1
answer
109
views
Functions and methods for working with AST tree
I am implementing deep search with Python Hex Ray API.
Can someone say classes and methods for implementing this feature with the IDA Python API?
- 10.9k
1
vote
1
answer
615
views
Re-analyse HexRays decompiled output
I have analysed a large library in an older version of IDA and want to upgrade. I have marked lots of functions as "decompiled" and changed their function signatures.
How do I automatically ...
- 9,178
1
vote
1
answer
390
views
Hex-rays decompiler incorrect logic
I'm practicing reverse engineering in IDA and I created an example application in Visual C++ to practice working with classes/structs and the decompiler output seems to be incorrect - I would like to ...
- 921
2
votes
2
answers
4k
views
How to edit (insert new fields into) IDA structures?
I'm trying to reverse a bigger structure used in an old game. Obviously I didn't know all fields when I created the structure type, and now I want to edit in some new fields / change pure byte gaps ...
- 1,120
1
vote
2
answers
442
views
How to stop Hex Rays optimizations?
I know it's not a bug, but a feature. Hex Rays found that there's a variable which is set to specific value, thus there's no need to display the branches where the code will never be run, so it warns ...
1
vote
1
answer
846
views
IDA Pro shows an array where two varaibles should be
I'm working in a Delphi binary and found a little issue while generating pseudocode.
This is the output (after some clean up) that IDA gives me:
Integer __fastcall LBCommon::TLBMemStream::GetFromId(...
- 36.4k
2
votes
2
answers
745
views
IDA PRO Hex-Rays try-catch
I've been working in IDA Pro with a project but there is an issue. Try-Catch statements don't look nice.
I've been searching and it seems like IDA does not support them so I was wondering if there is ...
- 9,178
1
vote
1
answer
1k
views
IDA/Hexrays: local variable allocation has failed; how to fix this?
I'm reverse engineering an old DOS game that's using the DOS/4GW extender. The game includes some libraries that I already successfully reversed in a different application, so I'm pretty sure that the ...
CommunityBot
- 1
1
vote
1
answer
162
views
Hex Rays Mapping To Wrong Variable
The assembly file has multiple variables which both use the rax register. The decompiler did recognize that at least somewhat, since it did create two variables which use the rax register. However, it ...
CommunityBot
- 1
2
votes
0
answers
104
views
Understanding Hex-Rays syntax
I have a Ida decompiled function that invokes another function through a function pointer but I'm really confused how it calculates it's address. I'm new to hex-rays syntax.
int __fastcall SUB_XXXX(...
- 9,178
0
votes
1
answer
72
views
An incomprehensible line in the output from hex rays
v5 = (*(int (__cdecl **)(int))((char *)&etext + 1))(a1);
Please explain me what does this line mean (if possible, please write from what it was compiled from (language - c))
- 1,391
1
vote
2
answers
853
views
How to remove all goto statements in pseudocode?
IDA shows multiple goto statements in the decompiled pseudocode. I've read this manual page: https://www.hex-rays.com/products/decompiler/manual/config.shtml and tried to disable/enable these flags ...
- 9,178
3
votes
3
answers
872
views
Cleaning HexRays Output
My HexRays decompiler output often looks like:
v0 = LoadLibraryW(L"wininet.dll");
v1 = v0;
if ( !v0 )
goto LABEL_1;
v2 = GetProcAddress(v0, "InternetOpenW");
v3 = GetProcAddress(v1, "...
- 320
0
votes
0
answers
68
views
Is there a way to aid the IDA decompiling process?
I want to make all local variables contained in a structure with appropriate padding put in the gaps (unused parts of the frame). I want to do the same for the global data. And I want to rename ...
- 455
2
votes
1
answer
1k
views
IDA/HexRays: how do I retrieve the memory address associated with a given line of decompiled code?
I'm trying to programmatically link decompiled code generated by HexRays with the disassembly code of a given binary by mapping memory addresses between the two. The mapping exists, as I can see view ...
CommunityBot
- 1
1
vote
1
answer
229
views
IDA HexRays: signed/unsigned types and 32/64 bits dont match assembly
Here is assembly:
mov rdi, [r13+rax*8+0]
sub rdi, rcx
cvtsi2sd xmm0, rdi
movsd qword ptr [r11+rax*8], xmm0
cvtsi2sd xmm0, qword ptr [r14+rax*8]
movsd qword ptr [rsi+rax*8], ...
CommunityBot
- 1
0
votes
2
answers
4k
views
IDA Hex-Rays: How to find all references to the certain field of all instances of the data type?
This question has already been asked here but for some reason it was deleted, as "dead".
I will try to explain again. I have a specific data type. It is used in a large number of disassembled ...
- 141
3
votes
2
answers
2k
views
Hex-Rays and IDA Python plugin loading order
I have made a plugin (using IDA Python) that requires the Hex-Rays plugin.
As per the instructions in the hexrays_sdk folder, I've named my plugin starting with hexrays_ to make sure it loads after ...
- 320
1
vote
2
answers
2k
views
Hex-Rays not properly showing strings
Here's the difference between Hex_Rays and the debugger:
Note that I've synchronized the views, so they are showing the same operations in both the debugger and the decompiler. I've tried Edit -> ...
- 9,178
2
votes
1
answer
365
views
Hex-Ray Decompiler: inline function not recognized
While trying to decompile an application with Hex-Ray 7.0, I stumbled upon the problem that in nearly all cases, what seems to be a certain inline function will not be recognised, which bloats the ...
- 9,178