Questions tagged [hexrays]
A decompiler plugin for IDA, producing (pseudo-)C/C++ code, developed by the company of the same name (Hex-Rays).
139
questions
2
votes
1
answer
634
views
Compile Hex-Rays code
I'm aware, that Hex-Rays provides pseudocode, which is not supposed to be compiled, but I'm trying to do it.
So far I stopped on instructions like that:
char (__usercall *__fastcall sub_947770(...
- 61
2
votes
2
answers
9k
views
What is *(_BYTE *), __usercall, eax and edi [closed]
I am trying to understand some algorithm of how the thing works. Here is the function I got from decompiling my executable with Hey Rays.
I want to run this function to see the result and then ...
- 121
3
votes
2
answers
4k
views
How do I evaluate Hex-Rays Decompiler without purchasing IDA Disassembler?
Hex-Rays, providers of IDA Disassembler, offers a companion product called Hex-Rays Decompiler (not to be confused with HexRaysCodeXplorer, a plugin for the Decompiler plugin rather than for IDA ...
- 131
0
votes
1
answer
404
views
Change number to sizeof operator [closed]
So i have an structure, let's say it's name is Foo and it's size is 0xAC size and it's initializated in a function like this:
Foo foo;
qmemcpy(&foo, &g_Foo, 0xAC);
How i can change the last ...
2
votes
1
answer
51
views
Reversing assembler DCD directive list into a c++ variable
For example we have assembler variable "foo" defined as:
.text:00001078 foo DCD 0xffffffff, 0xffffeeee
How it(variable foo) would look like in c++(or whatever higher lang)???
2
votes
2
answers
2k
views
Saving .so file in IDA
I have edited .so file in IDA. I don't know how to save it. Any idea for saving them?
5
votes
2
answers
2k
views
How to get IDA Pro to understand a virtual function table?
I'm reversing an old DirectDraw game that uses DirectX 7.
I have a LPDIRECTDRAWSURFACE7 g_lpDDSBack and g_lpDDSBack->BltFast is being called but this is how it is decompiled in HexRays:
(*(int (...
- 51
3
votes
2
answers
2k
views
Hex-Rays and IDA Python plugin loading order
I have made a plugin (using IDA Python) that requires the Hex-Rays plugin.
As per the instructions in the hexrays_sdk folder, I've named my plugin starting with hexrays_ to make sure it loads after ...
- 155
1
vote
1
answer
742
views
IDA debugging SSE intrinsics
Whenever I hover over a SSE variable, e.g.:
correct = tmp_corr;
Which are both declared as __m128 IDA shows them as a string of bytes, e.g. "\x00\x00..." sometimes even weird characters...
Is ...
- 123
0
votes
2
answers
1k
views
What to do when IDA does not recognize return value?
I have a function which fetches the Glide screen width and height and passes it to some set-up function (sub_457048).
However, IDA does not recognize that the Glide API function to retrieve the width ...
- 1,083
2
votes
2
answers
4k
views
How to edit (insert new fields into) IDA structures?
I'm trying to reverse a bigger structure used in an old game. Obviously I didn't know all fields when I created the structure type, and now I want to edit in some new fields / change pure byte gaps ...
- 1,083
5
votes
3
answers
5k
views
IDApython and IDA-decompiler commenting
Looking at the functions exposed by idaapi I see that functions like the following are exposed.
get_user_cmt
set_user_cmt
save_user_cmts
As these functions are exposed I'm hoping that I have a way ...
user1743
1
vote
1
answer
1k
views
Any easy way to decompile virtual function instances?
What I mean is when the Hex-Rays compiler gives me something like this:
int v1;
CreateSomeInterface(&v1);
(*(int (__thiscall **)(int))(*(_DWORD *)v1 + 4))(0);
And I have a C++ header with the ...
- 455
4
votes
3
answers
5k
views
Reversing an MFC application: How to find class memory layouts?
I have an old computer game I want to reverse (Windows 95 "Hover!" to be exact), and I figured out that it uses the MFC.
HexRays often decompiles pseudocode like this, which, for example, deals with ...
- 1,083
0
votes
3
answers
446
views
Hex-Rays decompiles array to int
I decompiled one dll using Hex-Ray but it decompiled array type input argument of dll to int. Any idea how to handle this ??
double dzSell(int a1, double a2, int a3, int a4, int a5)
int a1 is array ...
22
votes
1
answer
19k
views
How to organize vtables in IDA Pro?
I am using IDA Pro to disassemble a C++ behemoth with 1600+ classes, many of them having pure virtual methods.
Some classes also are made up of multiple base classes, in hierarchies 5+ levels deep.
...
- 377
3
votes
1
answer
526
views
Does hex-rays support VLA in any way?
I was testing some 'C' code with VLAs. It wasn't that surprising that Hex-Rays was not able to recognize VLA. As with structures there is some way to make it understand (simply making the variable ...
- 455
2
votes
3
answers
3k
views
IDA decompiler macro
What is the purpose of COERCE_FLOAT and COERCE_UNSIGNED_INT macros in the Hex Rays decompiled code below?
double __cdecl sub_401580(float a1)
{
unsigned int v1; // eax@1
double v2; // st7@1
...
- 59
1
vote
1
answer
309
views
IDA/Hexrays SDK: how to preserve lvar names?
Last night I was extending functionality of HexRaysCodeXplorer - implemented feature to automatically rename duplicating variables. It needs some fixes to work well, but the problem I cannot cope with ...
- 11
4
votes
1
answer
2k
views
Condense pseudocode lines in IDA Pro
In IDA 6.6, is it possible to condense, or otherwise re-arrange, lines of pseudocode given by the Hex-Rays decompiler? For example
if ( !iFile2Size
|| *pFile2BufferCopy == *pFile3BufferCopy
&&...
3
votes
2
answers
5k
views
Reverse Engineering MIPS Bootloader
I am trying to figure out how the bootloader of a TP-Link wr702n device (based on an AP121 MIPS board) starts the operation system (VxWorks 5.5.1). The bootloader is extracted from a firmware update ...
- 173
1
vote
1
answer
1k
views
Wrapping usercall from Hex-Rays
I am trying to call a function generated by Hex-Rays by injecting a DLL, but have so far only managed to crash the process.
This is the code generated by Hex-Rays
int __usercall sub_54C3A0@<eax&...
6
votes
3
answers
11k
views
Hex-Rays: JUMPOUT statements inserted due to incorrect autodetected function boundaries
I'm trying to RE a Windows executable compiled with VS 2008. After the initial autoanalysis most functions are detected correctly; however, some have wrong end address — for some reason IDA places the ...
- 619
2
votes
1
answer
2k
views
Hex-Rays decompiler stuck on function
I'm working on a Linux x86_64 ELF binary using IDA 6.6.
When I run the Hex-Rays Decompiler on a function (by pressing F5) it always shows me the pseudocode for the _init_proc function, no matter what ...
- 430
5
votes
1
answer
3k
views
IdaPro/HexRays type libraries
I'm trying to improve my use of ida/hexrays... I have a x86 linux elf binary, non-stripped, statically linked w/ openssl. So you can see all of the OpenSSL function names in the binary.
I used the ...
- 51
6
votes
0
answers
702
views
How to create HexRays variables in IDAPython correctly?
Let's assume we have a function which has a following variables in it:
Local variables on stack of different types, including types defined in local types window
Local variables of different types ...
- 8,418
8
votes
1
answer
1k
views
How to map a variable to multiple names in Hex-Rays decompiler
Compilers often optimize variables usage, so multiple variables in the source code can be mapped to the same register (or stack variable) in the resulting assembly.
I know that registers can be ...
- 183
0
votes
1
answer
756
views
How to map a function argument to local variable?
Well, I've got an function that the pseudo code looks like:
void d4l_auxadc_cali_unlocked_ioctl()
{
unsigned int v0; // r1@1
unsigned int v1; // r7@1
...
However, I am aware that the ...
- 3
1
vote
1
answer
1k
views
Large number of IDA .ASM files, need list of potential mnemonics
I have ~20,000 .asm files from IDA pro output via hex-rays.
These were all created from known malware, and all from 32bit Windows Portable Executables.
I do not have the original executables, just ...
- 121
2
votes
1
answer
8k
views
What does __PAIR__ mean in Hex-Rays decompiler output? [duplicate]
what does this code on IDA? i've found with this a couple of times and i don't have idea what means.
int a5;
int dGainMax;
COERCE_DOUBLE(__PAIR__(a5, dGainMax))
1
vote
0
answers
93
views
What are these blue indexes in the disasm output? [closed]
I'm working on a binary that has a lot of FPU operations, and even though IDA (Hex rays) decompiles properly most of them, there's cases like this:
Which "decompile" to:
Is there any way I can fix ...
- 1,293
2
votes
2
answers
4k
views
IDA Pro: Where does newly created structure go to from Pseudocode window?
Where does newly created structure go to from Pseudocode window? I'm referring to structure that you create via right-click on variable and choosing "Create new struct type".
I don't see new ...
- 157
3
votes
1
answer
11k
views
IDA Pro/Hex-Rays FLIRT Signatures and Standard library function detection
I'm having some problems performing a standard decompilation of a Windows EXE file using IDA Pro/Hex-Rays and its built-in FLIRT signatures.
A lot of standard C++ functions are not being recognized ...
- 346
5
votes
1
answer
2k
views
IDA PRO Hex-Rays 1.5 pseudo code understanding -=0x3FFFFFFFu; += 0x3FFFFFFFu;
I'm trying to clean up the pseudo code to make it compile and function similar if not exactly the same as the original code.
This bit which looks like this appears in various places I'm trying to ...
- 759
1
vote
0
answers
1k
views
IDA Pro not showing structures, even when they're defined
I have this kind of code:
I have reversed the struct entirely, and when I try to cast to ClientGame*, instead of:
if(mainStruct->something & 2)
I see:
The offsets 0x364, 0x370, and 0x374 ...
- 1,293
1
vote
1
answer
1k
views
Reverse pseudo code
I am reversing a binary which seems to have all the symbols exported which helps. What I have seen is a pile of variables and functions which all start with the letter 'v', for example v101. I have ...
- 179
10
votes
1
answer
1k
views
Information provided by Hex-Rays after @ symbol in variable declarations
Could you explain to me the information provided after the @ symbol in Hex-Rays decompilation ? For examples @1 and @5 in the following output:
struct WSAData wsadata; // [sp+0h] [bp-1A0h]@1
int v6; /...
42
votes
1
answer
93k
views
Decompiling iPhone App
I've been searching this site and more, but I haven't had much luck. I want to decompile an app to see how part of it works, and I've tried multiple programs. I've tried Hopper, IDA, and some other ...
- 429
11
votes
1
answer
815
views
Hex-Rays Decompiler: Buffer on the stack
I am currently reversing a windows driver in order to write a Linux compatible driver for a DVB card, but I have come up against a small issue that I can work around, but if it is possible I would ...
- 383