Questions tagged [hexrays]
A decompiler plugin for IDA, producing (pseudo-)C/C++ code, developed by the company of the same name (Hex-Rays).
139
questions
0
votes
0
answers
49
views
Hexrays - Enhance decompilation of "pre-multiplied" array indices?
For this x86 (Watcom 1997) assembly that loops over an array, Hexrays yields the following pseudo code:
lea eax, ds:0[ecx*4]
add eax, ecx
shl eax, 3
mov [esp+310h+iMulSize], eax
mov ...
- 1,083
0
votes
0
answers
38
views
How to force IDA to understand that a given literal value is the bitwise combination of enum members?
I have an .so file which uses the dynamic linker with dlopen and friends. So the values for RTLD_* used in dlopen are of relevance to me. The standard imported enum in IDA looks like this:
FFFFFFFF ; ...
- 10.9k
0
votes
0
answers
39
views
How to get the byte offset of a type casted pointer in IDA PRO
v6 = v5 + 0x3E;
if ( v5 + 0x1F >= 0 )
v6 = v5 + 0x1F;
v7 = abs32(*(_DWORD *)(buf_14 + 8)) * 4 * (v6 >> 5);
I want to get the byte offset pointer pointing at.
Is there any way to get ...
- 1
1
vote
1
answer
78
views
How to make IDA stop showing a struct as an array
Sometimes when I am figuring out a struct in IDA, there will be a really big offset and IDA will decide the struct is an array.
Consider this from ALPC:
if ( (_Message[1].u1.Length & 0x200) != 0 ...
- 1,236
4
votes
0
answers
174
views
idapython: variable instruction references (def-use) for data flow analysis
Let's consider a code snippet:
I can get disassembler variables-
def get_function_vars(function) -> list:
frameId = idc.get_frame_id(function)
if frameId:
varStruct = ida_struct....
- 1,797
3
votes
1
answer
166
views
IDA Decompiler generates wrong output on array of structures!
There is a structure with size of 16-Bytes, and an array of it is defined.
The disassembly code for navigation through the array is:
MOV i, i,LSL#4
LDR R4, =arr_of_struct
ADD i, i, R4
LDR ...
- 171
2
votes
0
answers
92
views
IDA Decompiler: How to configure Ida to correctly show "array elements left shifting proccess" when index is zero?
I have a buffer in disassembly that its elements are shifted to left (apparently with controlling the zero index), the original code is:
flag = 0;
for ( i = 0; i < 10; i++ )
{
if ( flag )
...
- 171
1
vote
0
answers
59
views
Making an exe file to recognize the Persian/Arabic characters
So I have an .exe file (FileSplitter.exe) and want to change the texts in its GUI to Persian/Arabic (It doesn't matter either is Arabic or Persian).
Thus I changed it at first Hex Editing using HxD ...
1
vote
1
answer
157
views
Reuse pseudocode tab when decompiling in IDA
When I press F5 in IDA to decompile, it always opens a new pseudocode tab, so over time many tabs open and I have to remember to close them. Can I make it so that F5 reuses an already open tab instead ...
- 13
2
votes
0
answers
369
views
incorrect Ghidra decompile functions parameters
I am checking a binary with Ghidra, and it adds to me a lot of parameters to many functions while in IDA it decompiles it well. (I used decompiler parameter ID)
I saw someone wrote here about this ...
- 41
1
vote
0
answers
193
views
How to find the the event handler function for a QtAbstractButton?
I am not very familiar with Qt to begin with but basic PyQt tutorial showed that a button object is linked with its handler using the connect method that takes in as its argument the function that ...
- 119
4
votes
1
answer
504
views
What is the meaning of this message in IDA?
What is the meaning of this mmessage in IDA:
The decompiler assumes that the segment '.text' is read-only because of its NAME. All data references to the segment will be replaced by constant values. ...
- 53
2
votes
1
answer
143
views
Decompilation output modification in IDA Pro
I am trying to modify cfunc AST from
If (a1 && some_func_ptr) {
some_func_ptr();
}
To
if (a1) {
some_func_ptr();
}
But I constantly get INTERR 50683 error. I tried
new_item = idaapi....
- 81
2
votes
0
answers
109
views
How to solve bad pseudocode format of Hex-Rays Decompiler?
Look at the following pseudocode:
void *__cdecl func(const char *a1, int a2, void *a3)
{
_DWORD *v3; // esi
int v5; // ebp
int v6; // eax
void *v7; // esi
_DWORD *v8; // eax
int v9; // edx
...
- 139
1
vote
1
answer
386
views
idapython: how to reset pointer type for variables
I am using IDA Pro 7.6 on win32 x86 binaries.
I'm trying to use the ida_hexrays interface to decompile subroutines. I want all of the local variables and arguments of the subroutine to have integral ...
2
votes
1
answer
366
views
how to get indirect callsite function return type and arguments
I am using idapython to get function return type and arguments @ an indirect call instruction.
I was able to sync ida disassembler with hexrays decompiler as asked here and I can now get decompiled ...
- 1,797
1
vote
1
answer
116
views
Removing empty blocks ida api
i have a c++ module that removes empty block it used to work well but now I'm porting it to ida 7.7 I'm having issues.
mba_t *mba;
mba->remove_empty_blocks();
It throws following error
"...
- 73
1
vote
1
answer
178
views
Can a MSVC class have a deletion destructor without a vftable?
I'm reversing the following smart pointee-like MSVC class Buffer : public Referencable with IDA / Hexrays:
struct Referencable
{
int m_refs;
};
struct Buffer : Referencable
{
void* m_pData;
};
...
- 1,083
2
votes
1
answer
202
views
Disable optimization of for loops in Hex Rays Decompiler
Are there any good ways of splitting up a very long for loop or if statement in IDA into larger chunks to make it more readable? Disabling use fast structure analysis in the Hex Rays decompiler ...
0
votes
1
answer
273
views
Will "Reset decompiler information"+"All caches" invalidate functions marked as decompiled?
In his answer to a question, Rolf pointed me to the Edit -> Other -> Reset decompiler information functionality, suggesting that "All caches" will force the decompiler to pick up ...
- 10.9k
0
votes
1
answer
411
views
How to get IDA and Hex-Rays to forcibly sync their knowledge of the sample on-demand?
; PCWSTR __stdcall RtlGetNtSystemRoot()
public RtlGetNtSystemRoot
RtlGetNtSystemRoot proc near ; CODE XREF: LdrpBuildSystem32FileName+1A↑p
...
- 10.9k
3
votes
0
answers
91
views
In the Hex-Rays decompiler, is it possible to assign macros such as NT_SUCCESS
Suppose the decompiler came up with something like this:
if (Status >= 0)
{
// ... some other pseudo code
}
Is it possible to prettify this code with the NT_SUCCESS() macro, like this:
if (...
- 10.9k
1
vote
0
answers
763
views
How to get variable value during IDA (Hex-Rays Decompiler) debugging?
I'm debugging a iOS App by IDA, and I need to see the value of some var like v57 below.
Through the Locals panel know the value is 0x1137D0E00LL, but I want to see the real value or class.
How to get ...
- 11
0
votes
1
answer
109
views
Functions and methods for working with AST tree
I am implementing deep search with Python Hex Ray API.
Can someone say classes and methods for implementing this feature with the IDA Python API?
- 53
1
vote
1
answer
615
views
Re-analyse HexRays decompiled output
I have analysed a large library in an older version of IDA and want to upgrade. I have marked lots of functions as "decompiled" and changed their function signatures.
How do I automatically ...
- 113
1
vote
1
answer
390
views
Hex-rays decompiler incorrect logic
I'm practicing reverse engineering in IDA and I created an example application in Visual C++ to practice working with classes/structs and the decompiler output seems to be incorrect - I would like to ...
- 170
1
vote
1
answer
846
views
IDA Pro shows an array where two varaibles should be
I'm working in a Delphi binary and found a little issue while generating pseudocode.
This is the output (after some clean up) that IDA gives me:
Integer __fastcall LBCommon::TLBMemStream::GetFromId(...
- 197
2
votes
2
answers
745
views
IDA PRO Hex-Rays try-catch
I've been working in IDA Pro with a project but there is an issue. Try-Catch statements don't look nice.
I've been searching and it seems like IDA does not support them so I was wondering if there is ...
- 197
2
votes
0
answers
104
views
Understanding Hex-Rays syntax
I have a Ida decompiled function that invokes another function through a function pointer but I'm really confused how it calculates it's address. I'm new to hex-rays syntax.
int __fastcall SUB_XXXX(...
- 73
0
votes
1
answer
72
views
An incomprehensible line in the output from hex rays
v5 = (*(int (__cdecl **)(int))((char *)&etext + 1))(a1);
Please explain me what does this line mean (if possible, please write from what it was compiled from (language - c))
- 13
0
votes
0
answers
68
views
Is there a way to aid the IDA decompiling process?
I want to make all local variables contained in a structure with appropriate padding put in the gaps (unused parts of the frame). I want to do the same for the global data. And I want to rename ...
- 455
5
votes
2
answers
833
views
Specifying the register value which is constant for all the functions
In the firmwares I met the situation when some register value is set at startup, and then it's implicitly used as a base address to access the variables.
e.g. register r13 is set to 0x40000000 which ...
- 1,840
1
vote
2
answers
442
views
How to stop Hex Rays optimizations?
I know it's not a bug, but a feature. Hex Rays found that there's a variable which is set to specific value, thus there's no need to display the branches where the code will never be run, so it warns ...
- 1,840
1
vote
1
answer
229
views
IDA HexRays: signed/unsigned types and 32/64 bits dont match assembly
Here is assembly:
mov rdi, [r13+rax*8+0]
sub rdi, rcx
cvtsi2sd xmm0, rdi
movsd qword ptr [r11+rax*8], xmm0
cvtsi2sd xmm0, qword ptr [r14+rax*8]
movsd qword ptr [rsi+rax*8], ...
- 11
1
vote
2
answers
2k
views
Hex-Rays not properly showing strings
Here's the difference between Hex_Rays and the debugger:
Note that I've synchronized the views, so they are showing the same operations in both the debugger and the decompiler. I've tried Edit -> ...
- 69
0
votes
1
answer
67
views
What does this custom piece of frame manipulation code from a router binary do?
I've decompiled a custom router ELF binary using Hex-Rays and have recently come across the following function in the binary:
pkt_hdr_t *__cdecl pkt_hdr_from_frame(frame_t *frame, uint16_t *remaining)
...
- 277
0
votes
1
answer
117
views
LPC2378FBD144 Arm7 hex file
I have binary file for the LPC2378FBD144 processor ineed to reverse engineer it using IDA V7.3
im little confused about memory organization values i should put in the memory organization thank you for ...
0
votes
1
answer
1k
views
Analyzing raw binary without ELF header in IDA Pro
I am trying to analyze and disassemble a raw binary that does not have an ELF header using IDA Pro.
I have been trying to convert to code using MakeCode, but have not gotten anywhere as the binary is ...
4
votes
2
answers
1k
views
How to show KUSER_SHARED_DATA members in decompiled C code?
Here is a sample C code which prints Windows version directly from address
of KUSER_SHARED_DATA. Tested in Windows 10 only. The raw memory address
differ in Windows version but that's not the point.
#...
- 1,559
1
vote
0
answers
380
views
idapython: how to apply hexrays types to disassembly interface
I am using idapro 7.5 to get variable information from binaries.
Consider following simple code:
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char *argv[])
{
int i, N, ...
- 1,797
2
votes
1
answer
1k
views
IDA/HexRays: how do I retrieve the memory address associated with a given line of decompiled code?
I'm trying to programmatically link decompiled code generated by HexRays with the disassembly code of a given binary by mapping memory addresses between the two. The mapping exists, as I can see view ...
- 21
1
vote
2
answers
1k
views
STL Data Structures Hex-Rays
We all know that reversing STL code is no fun. To make it easier, I usually create some of the strucutres so I can reference the created STL structures in another custom structure.
For example, msvc - ...
-1
votes
1
answer
201
views
What does xchg means when accessing array element?
I have ASM code of some Windows *.exe in IDA:
mov rax, [rbx+10h]
mov ecx, edx
xor edx, edx
xchg rdx, [rax+rcx*8]
Which is decompiled to pseudocode to
_RAX = this->m_someMemoryPool;
...
- 61
1
vote
2
answers
1k
views
Batch decompile using IDA Pro 7.5
I am trying to batch disassemble and decompile 500 binaries using the IDA Pro 7.5 disassember and Hex rays decompiler. I can get the .i64 output from the disassembler, but I do not have a way to batch ...
- 19
0
votes
2
answers
1k
views
asm snippet to pseudo-code
I'm looking into a way to generate pseudo-code from snippet of assembly,
let's assume I have this ASM
push rbp
mov rbp, rsp
mov DWORD PTR [rbp-4], edi
mov DWORD PTR [...
- 163
0
votes
1
answer
686
views
How to reverse engineer Apple MacBook SMC update firmware image using IDA Pro 7.2?
Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware:
Charlie Miller:
https://www.youtube.com/watch?v=...
- 1
1
vote
1
answer
162
views
Hex Rays Mapping To Wrong Variable
The assembly file has multiple variables which both use the rax register. The decompiler did recognize that at least somewhat, since it did create two variables which use the rax register. However, it ...
- 53
1
vote
1
answer
1k
views
IDA/Hexrays: local variable allocation has failed; how to fix this?
I'm reverse engineering an old DOS game that's using the DOS/4GW extender. The game includes some libraries that I already successfully reversed in a different application, so I'm pretty sure that the ...
- 67
0
votes
1
answer
977
views
Re-analyzing pseudocode IDA Pro
While I was reversing a binary I noticed that IDA Pro had adjusted the pseudocode that initially was generated. This happened after I started reversing the binary and renamed functions and variables ...
4
votes
0
answers
799
views
IDA Hex-Rays structure inline functions recognition
I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve.
I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I ...