Questions tagged [hexrays]
A decompiler plugin for IDA, producing (pseudo-)C/C++ code, developed by the company of the same name (Hex-Rays).
24
questions with no upvoted or accepted answers
6
votes
0
answers
702
views
How to create HexRays variables in IDAPython correctly?
Let's assume we have a function which has a following variables in it:
Local variables on stack of different types, including types defined in local types window
Local variables of different types ...
- 8,418
4
votes
0
answers
174
views
idapython: variable instruction references (def-use) for data flow analysis
Let's consider a code snippet:
I can get disassembler variables-
def get_function_vars(function) -> list:
frameId = idc.get_frame_id(function)
if frameId:
varStruct = ida_struct....
- 1,797
4
votes
0
answers
799
views
IDA Hex-Rays structure inline functions recognition
I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve.
I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I ...
3
votes
0
answers
91
views
In the Hex-Rays decompiler, is it possible to assign macros such as NT_SUCCESS
Suppose the decompiler came up with something like this:
if (Status >= 0)
{
// ... some other pseudo code
}
Is it possible to prettify this code with the NT_SUCCESS() macro, like this:
if (...
- 10.9k
3
votes
0
answers
2k
views
STL map and map entry structures for IDA/HexRays
I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long ...
- 131
2
votes
0
answers
92
views
IDA Decompiler: How to configure Ida to correctly show "array elements left shifting proccess" when index is zero?
I have a buffer in disassembly that its elements are shifted to left (apparently with controlling the zero index), the original code is:
flag = 0;
for ( i = 0; i < 10; i++ )
{
if ( flag )
...
- 171
2
votes
0
answers
369
views
incorrect Ghidra decompile functions parameters
I am checking a binary with Ghidra, and it adds to me a lot of parameters to many functions while in IDA it decompiles it well. (I used decompiler parameter ID)
I saw someone wrote here about this ...
- 41
2
votes
0
answers
109
views
How to solve bad pseudocode format of Hex-Rays Decompiler?
Look at the following pseudocode:
void *__cdecl func(const char *a1, int a2, void *a3)
{
_DWORD *v3; // esi
int v5; // ebp
int v6; // eax
void *v7; // esi
_DWORD *v8; // eax
int v9; // edx
...
- 139
2
votes
0
answers
104
views
Understanding Hex-Rays syntax
I have a Ida decompiled function that invokes another function through a function pointer but I'm really confused how it calculates it's address. I'm new to hex-rays syntax.
int __fastcall SUB_XXXX(...
- 73
2
votes
0
answers
301
views
IDA Hex-Rays Decompiler Generates ASM Code Issue
For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted.
Some of the decompiled generated plain C code, show as ASM code :/
i.e:
...
1
vote
0
answers
59
views
Making an exe file to recognize the Persian/Arabic characters
So I have an .exe file (FileSplitter.exe) and want to change the texts in its GUI to Persian/Arabic (It doesn't matter either is Arabic or Persian).
Thus I changed it at first Hex Editing using HxD ...
1
vote
0
answers
193
views
How to find the the event handler function for a QtAbstractButton?
I am not very familiar with Qt to begin with but basic PyQt tutorial showed that a button object is linked with its handler using the connect method that takes in as its argument the function that ...
- 119
1
vote
0
answers
763
views
How to get variable value during IDA (Hex-Rays Decompiler) debugging?
I'm debugging a iOS App by IDA, and I need to see the value of some var like v57 below.
Through the Locals panel know the value is 0x1137D0E00LL, but I want to see the real value or class.
How to get ...
- 11
1
vote
0
answers
380
views
idapython: how to apply hexrays types to disassembly interface
I am using idapro 7.5 to get variable information from binaries.
Consider following simple code:
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char *argv[])
{
int i, N, ...
- 1,797
1
vote
0
answers
332
views
How Can I Clean Up After IDA Decompation with IDAPython or other resource
When I am working on a source code recovery project I am usually left with a lot of code that needs to be manually cleaned up by hand. This can take a lot of time and as projects get larger , I am ...
- 773
1
vote
0
answers
306
views
IDA Pro Reset All Stack Pointers to Default
Is there a way letting IDA scan all the database and reset all stack pointers values to it's default state that were previously modified? i.e like it was when I first started the analyzing the binary?
...
1
vote
0
answers
861
views
IDA 7 handling strings in debugger pseudocode
When running a remote debugger to a linux server, is there a way to get IDA (7.0) to properly handle strings? When I go to the pseudocode view, I get things like this;
v7 = sub_804AD60((std::string *)...
- 215
1
vote
0
answers
271
views
IDA Pro 7.0 showing incorrect LOCALS in pseudocode view
Whenever I debug something and I switch to pseudocode and then rename some of the "variables" that IDA Pro creates, the values shown in the LOCALS window don't match what the actual values of those ...
- 287
1
vote
0
answers
390
views
Is there a from...import * equivalent of idaapi.require()?
Loading your own modules from your IDAPython scripts with idaapi.require() suggests using idaapi.require() to load user modules in IDAPython scripts. However in my script, I have extensively used from ...
- 1,371
1
vote
0
answers
1k
views
IDA Pro not showing structures, even when they're defined
I have this kind of code:
I have reversed the struct entirely, and when I try to cast to ClientGame*, instead of:
if(mainStruct->something & 2)
I see:
The offsets 0x364, 0x370, and 0x374 ...
- 1,293
0
votes
0
answers
49
views
Hexrays - Enhance decompilation of "pre-multiplied" array indices?
For this x86 (Watcom 1997) assembly that loops over an array, Hexrays yields the following pseudo code:
lea eax, ds:0[ecx*4]
add eax, ecx
shl eax, 3
mov [esp+310h+iMulSize], eax
mov ...
- 1,083
0
votes
0
answers
38
views
How to force IDA to understand that a given literal value is the bitwise combination of enum members?
I have an .so file which uses the dynamic linker with dlopen and friends. So the values for RTLD_* used in dlopen are of relevance to me. The standard imported enum in IDA looks like this:
FFFFFFFF ; ...
- 10.9k
0
votes
0
answers
39
views
How to get the byte offset of a type casted pointer in IDA PRO
v6 = v5 + 0x3E;
if ( v5 + 0x1F >= 0 )
v6 = v5 + 0x1F;
v7 = abs32(*(_DWORD *)(buf_14 + 8)) * 4 * (v6 >> 5);
I want to get the byte offset pointer pointing at.
Is there any way to get ...
- 1
0
votes
0
answers
68
views
Is there a way to aid the IDA decompiling process?
I want to make all local variables contained in a structure with appropriate padding put in the gaps (unused parts of the frame). I want to do the same for the global data. And I want to rename ...
- 455