Questions tagged [hexrays]
A decompiler plugin for IDA, producing (pseudo-)C/C++ code, developed by the company of the same name (Hex-Rays).
15
questions
10
votes
1
answer
1k
views
Information provided by Hex-Rays after @ symbol in variable declarations
Could you explain to me the information provided after the @ symbol in Hex-Rays decompilation ? For examples @1 and @5 in the following output:
struct WSAData wsadata; // [sp+0h] [bp-1A0h]@1
int v6; /...
3
votes
2
answers
5k
views
Reverse Engineering MIPS Bootloader
I am trying to figure out how the bootloader of a TP-Link wr702n device (based on an AP121 MIPS board) starts the operation system (VxWorks 5.5.1). The bootloader is extracted from a firmware update ...
- 173
42
votes
1
answer
93k
views
Decompiling iPhone App
I've been searching this site and more, but I haven't had much luck. I want to decompile an app to see how part of it works, and I've tried multiple programs. I've tried Hopper, IDA, and some other ...
- 429
5
votes
1
answer
2k
views
IDA PRO Hex-Rays 1.5 pseudo code understanding -=0x3FFFFFFFu; += 0x3FFFFFFFu;
I'm trying to clean up the pseudo code to make it compile and function similar if not exactly the same as the original code.
This bit which looks like this appears in various places I'm trying to ...
- 759
4
votes
1
answer
2k
views
How do I resolve IDA pro Hexrays aliased local variables?
It appears to me that in my function the compiler has reused a stack slot for two variables of types. However, Hex-Rays has not recognized it as such. How can I split the local variable into two?
- 193
4
votes
3
answers
5k
views
Reversing an MFC application: How to find class memory layouts?
I have an old computer game I want to reverse (Windows 95 "Hover!" to be exact), and I figured out that it uses the MFC.
HexRays often decompiles pseudocode like this, which, for example, deals with ...
- 1,083
3
votes
0
answers
2k
views
STL map and map entry structures for IDA/HexRays
I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long ...
- 131
3
votes
1
answer
11k
views
IDA Pro/Hex-Rays FLIRT Signatures and Standard library function detection
I'm having some problems performing a standard decompilation of a Windows EXE file using IDA Pro/Hex-Rays and its built-in FLIRT signatures.
A lot of standard C++ functions are not being recognized ...
- 346
3
votes
3
answers
872
views
Cleaning HexRays Output
My HexRays decompiler output often looks like:
v0 = LoadLibraryW(L"wininet.dll");
v1 = v0;
if ( !v0 )
goto LABEL_1;
v2 = GetProcAddress(v0, "InternetOpenW");
v3 = GetProcAddress(v1, "...
- 758
2
votes
3
answers
3k
views
IDA decompiler macro
What is the purpose of COERCE_FLOAT and COERCE_UNSIGNED_INT macros in the Hex Rays decompiled code below?
double __cdecl sub_401580(float a1)
{
unsigned int v1; // eax@1
double v2; // st7@1
...
- 59
2
votes
1
answer
8k
views
What does __PAIR__ mean in Hex-Rays decompiler output? [duplicate]
what does this code on IDA? i've found with this a couple of times and i don't have idea what means.
int a5;
int dGainMax;
COERCE_DOUBLE(__PAIR__(a5, dGainMax))
1
vote
2
answers
2k
views
Hex-Rays not properly showing strings
Here's the difference between Hex_Rays and the debugger:
Note that I've synchronized the views, so they are showing the same operations in both the debugger and the decompiler. I've tried Edit -> ...
- 69
1
vote
1
answer
742
views
IDA debugging SSE intrinsics
Whenever I hover over a SSE variable, e.g.:
correct = tmp_corr;
Which are both declared as __m128 IDA shows them as a string of bytes, e.g. "\x00\x00..." sometimes even weird characters...
Is ...
- 123
1
vote
2
answers
4k
views
How to add/find parameters to a function declaration in IDA/HexRays?
I've a binary opened in IDA. It uses a function pointer from a COM vtable. I found that the COM method has 13 parameters (including this). But IDA shows only 4 parameters as shown in this pseudocode:
...
- 1,559
0
votes
1
answer
273
views
Will "Reset decompiler information"+"All caches" invalidate functions marked as decompiled?
In his answer to a question, Rolf pointed me to the Edit -> Other -> Reset decompiler information functionality, suggesting that "All caches" will force the decompiler to pick up ...
- 10.9k