Questions tagged [hexrays]

A decompiler plugin for IDA, producing (pseudo-)C/C++ code, developed by the company of the same name (Hex-Rays).

Filter by
Sorted by
Tagged with
1
vote
0answers
295 views

Is there a from…import * equivalent of idaapi.require()?

Loading your own modules from your IDAPython scripts with idaapi.require() suggests using idaapi.require() to load user modules in IDAPython scripts. However in my script, I have extensively used from ...
1
vote
1answer
266 views

Is it possible to redirect IDAPython stack trace to console?

I am facing a weird problem! When my IDAPython script crashes, it produces a stack trace in the IDA default warning box that pops up right in front. The size of the box is neither adequate enough to ...
0
votes
1answer
576 views

Is there any IDA plugin to display AST?

Hex Ray has introduced a decompiler API as part of IDA v6.6. Is there any plugin which displays the detail Abstract Syntax Tree (AST) produced by the decompiler graphically? I want something like ...
1
vote
1answer
381 views

How can I walk up along the AST using IDAPython decompiler API?

I am using IDAPython for my analysis. In IDA v6.95, the header file plugins/hexrays_sdk/include/hexrays.hpp defines the following: typedef ctree_items_t parents_t; parents_t parents; ///< ...
0
votes
1answer
224 views

How can I see the IDAPython implementation of HexRay's decompiler API?

I am trying to use HexRay's decompiler API, however having trouble due to its lack of documentation. Is there any means so That I can get to see the Python implementation of decompiler API?
3
votes
2answers
373 views

Cleaning HexRays Output

My HexRays decompiler output often looks like: v0 = LoadLibraryW(L"wininet.dll"); v1 = v0; if ( !v0 ) goto LABEL_1; v2 = GetProcAddress(v0, "InternetOpenW"); v3 = GetProcAddress(v1, "...
3
votes
1answer
728 views

How to find matching braces in IDA's decompiled code?

For the source generated by Hex Ray's decompiler in IDA, is it possible to highlight matching braces once I place the pointer at the beginning of a block? As an example, in the screenshot below, the ...
0
votes
1answer
2k views

What all are the built-in data types available in IDA?

Hex Rays decompiler assigns weird looking data types to variables, e.g. __int64. How do I get to know what all are the built-in data types available in IDA?
0
votes
1answer
216 views

DNameNode class from MSVC binaries

I'm reversing some old game (for fun, to restore its priceless rules). It's been most probably linked statically to MSVCRT, some very old version. Also it uses heavily WinAPI (like ODCBC drivers, ...
2
votes
1answer
562 views

Compile Hex-Rays code

I'm aware, that Hex-Rays provides pseudocode, which is not supposed to be compiled, but I'm trying to do it. So far I stopped on instructions like that: char (__usercall *__fastcall sub_947770(...
2
votes
2answers
6k views

What is *(_BYTE *), __usercall, eax and edi [closed]

I am trying to understand some algorithm of how the thing works. Here is the function I got from decompiling my executable with Hey Rays. I want to run this function to see the result and then ...
2
votes
2answers
3k views

How do I evaluate Hex-Rays Decompiler without purchasing IDA Disassembler?

Hex-Rays, providers of IDA Disassembler, offers a companion product called Hex-Rays Decompiler (not to be confused with HexRaysCodeXplorer, a plugin for the Decompiler plugin rather than for IDA ...
0
votes
1answer
316 views

Change number to sizeof operator [closed]

So i have an structure, let's say it's name is Foo and it's size is 0xAC size and it's initializated in a function like this: Foo foo; qmemcpy(&foo, &g_Foo, 0xAC); How i can change the last ...
2
votes
1answer
43 views

Reversing assembler DCD directive list into a c++ variable

For example we have assembler variable "foo" defined as: .text:00001078 foo DCD 0xffffffff, 0xffffeeee How it(variable foo) would look like in c++(or whatever higher lang)???
1
vote
2answers
2k views

Saving .so file in IDA

I have edited .so file in IDA. I don't know how to save it. Any idea for saving them?
5
votes
2answers
1k views

How to get IDA Pro to understand a virtual function table?

I'm reversing an old DirectDraw game that uses DirectX 7. I have a LPDIRECTDRAWSURFACE7 g_lpDDSBack and g_lpDDSBack->BltFast is being called but this is how it is decompiled in HexRays: (*(int (...
2
votes
1answer
2k views

Hex-Rays and IDA Python plugin loading order

I have made a plugin (using IDA Python) that requires the Hex-Rays plugin. As per the instructions in the hexrays_sdk folder, I've named my plugin starting with hexrays_ to make sure it loads after ...
1
vote
1answer
458 views

IDA debugging SSE intrinsics

Whenever I hover over a SSE variable, e.g.: correct = tmp_corr; Which are both declared as __m128 IDA shows them as a string of bytes, e.g. "\x00\x00..." sometimes even weird characters... Is ...
0
votes
2answers
332 views

What to do when IDA does not recognize return value?

I have a function which fetches the Glide screen width and height and passes it to some set-up function (sub_457048). However, IDA does not recognize that the Glide API function to retrieve the width ...
1
vote
1answer
2k views

How to edit (insert new fields into) IDA structures?

I'm trying to reverse a bigger structure used in an old game. Obviously I didn't know all fields when I created the structure type, and now I want to edit in some new fields / change pure byte gaps ...
4
votes
3answers
3k views

IDApython and IDA-decompiler commenting

Looking at the functions exposed by idaapi I see that functions like the following are exposed. get_user_cmt set_user_cmt save_user_cmts As these functions are exposed I'm hoping that I have a way ...
1
vote
1answer
796 views

Any easy way to decompile virtual function instances?

What I mean is when the Hex-Rays compiler gives me something like this: int v1; CreateSomeInterface(&v1); (*(int (__thiscall **)(int))(*(_DWORD *)v1 + 4))(0); And I have a C++ header with the ...
2
votes
3answers
3k views

Reversing an MFC application: How to find class memory layouts?

I have an old computer game I want to reverse (Windows 95 "Hover!" to be exact), and I figured out that it uses the MFC. HexRays often decompiles pseudocode like this, which, for example, deals with ...
0
votes
3answers
353 views

Hex-Rays decompiles array to int

I decompiled one dll using Hex-Ray but it decompiled array type input argument of dll to int. Any idea how to handle this ?? double dzSell(int a1, double a2, int a3, int a4, int a5) int a1 is array ...
14
votes
1answer
8k views

How to organize vtables in IDA Pro?

I am using IDA Pro to disassemble a C++ behemoth with 1600+ classes, many of them having pure virtual methods. Some classes also are made up of multiple base classes, in hierarchies 5+ levels deep. ...
3
votes
1answer
452 views

Does hex-rays support VLA in any way?

I was testing some 'C' code with VLAs. It wasn't that surprising that Hex-Rays was not able to recognize VLA. As with structures there is some way to make it understand (simply making the variable ...
2
votes
3answers
2k views

IDA decompiler macro

What is the purpose of COERCE_FLOAT and COERCE_UNSIGNED_INT macros in the Hex Rays decompiled code below? double __cdecl sub_401580(float a1) { unsigned int v1; // eax@1 double v2; // st7@1 ...
1
vote
1answer
226 views

IDA/Hexrays SDK: how to preserve lvar names?

Last night I was extending functionality of HexRaysCodeXplorer - implemented feature to automatically rename duplicating variables. It needs some fixes to work well, but the problem I cannot cope with ...
4
votes
1answer
1k views

Condense pseudocode lines in IDA Pro

In IDA 6.6, is it possible to condense, or otherwise re-arrange, lines of pseudocode given by the Hex-Rays decompiler? For example if ( !iFile2Size || *pFile2BufferCopy == *pFile3BufferCopy &&...
3
votes
2answers
4k views

Reverse Engineering MIPS Bootloader

I am trying to figure out how the bootloader of a TP-Link wr702n device (based on an AP121 MIPS board) starts the operation system (VxWorks 5.5.1). The bootloader is extracted from a firmware update ...
1
vote
1answer
1k views

Wrapping usercall from Hex-Rays

I am trying to call a function generated by Hex-Rays by injecting a DLL, but have so far only managed to crash the process. This is the code generated by Hex-Rays int __usercall sub_54C3A0@<eax&...
6
votes
3answers
6k views

Hex-Rays: JUMPOUT statements inserted due to incorrect autodetected function boundaries

I'm trying to RE a Windows executable compiled with VS 2008. After the initial autoanalysis most functions are detected correctly; however, some have wrong end address — for some reason IDA places the ...
1
vote
1answer
1k views

Hex-Rays decompiler stuck on function

I'm working on a Linux x86_64 ELF binary using IDA 6.6. When I run the Hex-Rays Decompiler on a function (by pressing F5) it always shows me the pseudocode for the _init_proc function, no matter what ...
5
votes
1answer
2k views

IdaPro/HexRays type libraries

I'm trying to improve my use of ida/hexrays... I have a x86 linux elf binary, non-stripped, statically linked w/ openssl. So you can see all of the OpenSSL function names in the binary. I used the ...
5
votes
0answers
573 views

How to create HexRays variables in IDAPython correctly?

Let's assume we have a function which has a following variables in it: Local variables on stack of different types, including types defined in local types window Local variables of different types ...
7
votes
1answer
804 views

How to map a variable to multiple names in Hex-Rays decompiler

Compilers often optimize variables usage, so multiple variables in the source code can be mapped to the same register (or stack variable) in the resulting assembly. I know that registers can be ...
0
votes
1answer
695 views

How to map a function argument to local variable?

Well, I've got an function that the pseudo code looks like: void d4l_auxadc_cali_unlocked_ioctl() { unsigned int v0; // r1@1 unsigned int v1; // r7@1 ... However, I am aware that the ...
1
vote
1answer
921 views

Large number of IDA .ASM files, need list of potential mnemonics

I have ~20,000 .asm files from IDA pro output via hex-rays. These were all created from known malware, and all from 32bit Windows Portable Executables. I do not have the original executables, just ...
2
votes
1answer
5k views

What does __PAIR__ mean in Hex-Rays decompiler output? [duplicate]

what does this code on IDA? i've found with this a couple of times and i don't have idea what means. int a5; int dGainMax; COERCE_DOUBLE(__PAIR__(a5, dGainMax))
1
vote
0answers
81 views

What are these blue indexes in the disasm output? [closed]

I'm working on a binary that has a lot of FPU operations, and even though IDA (Hex rays) decompiles properly most of them, there's cases like this: Which "decompile" to: Is there any way I can fix ...
2
votes
2answers
2k views

IDA Pro: Where does newly created structure go to from Pseudocode window?

Where does newly created structure go to from Pseudocode window? I'm referring to structure that you create via right-click on variable and choosing "Create new struct type". I don't see new ...
3
votes
1answer
8k views

IDA Pro/Hex-Rays FLIRT Signatures and Standard library function detection

I'm having some problems performing a standard decompilation of a Windows EXE file using IDA Pro/Hex-Rays and its built-in FLIRT signatures. A lot of standard C++ functions are not being recognized ...
5
votes
1answer
2k views

IDA PRO Hex-Rays 1.5 pseudo code understanding -=0x3FFFFFFFu; += 0x3FFFFFFFu;

I'm trying to clean up the pseudo code to make it compile and function similar if not exactly the same as the original code. This bit which looks like this appears in various places I'm trying to ...
1
vote
0answers
586 views

IDA Pro not showing structures, even when they're defined

I have this kind of code: I have reversed the struct entirely, and when I try to cast to ClientGame*, instead of: if(mainStruct->something & 2) I see: The offsets 0x364, 0x370, and 0x374 ...
1
vote
1answer
912 views

Reverse pseudo code

I am reversing a binary which seems to have all the symbols exported which helps. What I have seen is a pile of variables and functions which all start with the letter 'v', for example v101. I have ...
9
votes
1answer
934 views

Information provided by Hex-Rays after @ symbol in variable declarations

Could you explain to me the information provided after the @ symbol in Hex-Rays decompilation ? For examples @1 and @5 in the following output: struct WSAData wsadata; // [sp+0h] [bp-1A0h]@1 int v6; /...
41
votes
1answer
86k views

Decompiling iPhone App

I've been searching this site and more, but I haven't had much luck. I want to decompile an app to see how part of it works, and I've tried multiple programs. I've tried Hopper, IDA, and some other ...
10
votes
1answer
763 views

Hex-Rays Decompiler: Buffer on the stack

I am currently reversing a windows driver in order to write a Linux compatible driver for a DVB card, but I have come up against a small issue that I can work around, but if it is possible I would ...

1
2