Questions tagged [hexrays]

A decompiler plugin for IDA, producing (pseudo-)C/C++ code, developed by the company of the same name (Hex-Rays).

Filter by
Sorted by
Tagged with
6
votes
3answers
8k views

Hex-Rays: JUMPOUT statements inserted due to incorrect autodetected function boundaries

I'm trying to RE a Windows executable compiled with VS 2008. After the initial autoanalysis most functions are detected correctly; however, some have wrong end address — for some reason IDA places the ...
1
vote
1answer
1k views

Hex-Rays decompiler stuck on function

I'm working on a Linux x86_64 ELF binary using IDA 6.6. When I run the Hex-Rays Decompiler on a function (by pressing F5) it always shows me the pseudocode for the _init_proc function, no matter what ...
5
votes
1answer
2k views

IdaPro/HexRays type libraries

I'm trying to improve my use of ida/hexrays... I have a x86 linux elf binary, non-stripped, statically linked w/ openssl. So you can see all of the OpenSSL function names in the binary. I used the ...
5
votes
0answers
625 views

How to create HexRays variables in IDAPython correctly?

Let's assume we have a function which has a following variables in it: Local variables on stack of different types, including types defined in local types window Local variables of different types ...
7
votes
1answer
961 views

How to map a variable to multiple names in Hex-Rays decompiler

Compilers often optimize variables usage, so multiple variables in the source code can be mapped to the same register (or stack variable) in the resulting assembly. I know that registers can be ...
0
votes
1answer
717 views

How to map a function argument to local variable?

Well, I've got an function that the pseudo code looks like: void d4l_auxadc_cali_unlocked_ioctl() { unsigned int v0; // r1@1 unsigned int v1; // r7@1 ... However, I am aware that the ...
1
vote
1answer
1k views

Large number of IDA .ASM files, need list of potential mnemonics

I have ~20,000 .asm files from IDA pro output via hex-rays. These were all created from known malware, and all from 32bit Windows Portable Executables. I do not have the original executables, just ...
2
votes
1answer
6k views

What does __PAIR__ mean in Hex-Rays decompiler output? [duplicate]

what does this code on IDA? i've found with this a couple of times and i don't have idea what means. int a5; int dGainMax; COERCE_DOUBLE(__PAIR__(a5, dGainMax))
1
vote
0answers
85 views

What are these blue indexes in the disasm output? [closed]

I'm working on a binary that has a lot of FPU operations, and even though IDA (Hex rays) decompiles properly most of them, there's cases like this: Which "decompile" to: Is there any way I can fix ...
2
votes
2answers
3k views

IDA Pro: Where does newly created structure go to from Pseudocode window?

Where does newly created structure go to from Pseudocode window? I'm referring to structure that you create via right-click on variable and choosing "Create new struct type". I don't see new ...
3
votes
1answer
9k views

IDA Pro/Hex-Rays FLIRT Signatures and Standard library function detection

I'm having some problems performing a standard decompilation of a Windows EXE file using IDA Pro/Hex-Rays and its built-in FLIRT signatures. A lot of standard C++ functions are not being recognized ...
5
votes
1answer
2k views

IDA PRO Hex-Rays 1.5 pseudo code understanding -=0x3FFFFFFFu; += 0x3FFFFFFFu;

I'm trying to clean up the pseudo code to make it compile and function similar if not exactly the same as the original code. This bit which looks like this appears in various places I'm trying to ...
1
vote
0answers
674 views

IDA Pro not showing structures, even when they're defined

I have this kind of code: I have reversed the struct entirely, and when I try to cast to ClientGame*, instead of: if(mainStruct->something & 2) I see: The offsets 0x364, 0x370, and 0x374 ...
1
vote
1answer
1k views

Reverse pseudo code

I am reversing a binary which seems to have all the symbols exported which helps. What I have seen is a pile of variables and functions which all start with the letter 'v', for example v101. I have ...
9
votes
1answer
1k views

Information provided by Hex-Rays after @ symbol in variable declarations

Could you explain to me the information provided after the @ symbol in Hex-Rays decompilation ? For examples @1 and @5 in the following output: struct WSAData wsadata; // [sp+0h] [bp-1A0h]@1 int v6; /...
42
votes
1answer
91k views

Decompiling iPhone App

I've been searching this site and more, but I haven't had much luck. I want to decompile an app to see how part of it works, and I've tried multiple programs. I've tried Hopper, IDA, and some other ...
10
votes
1answer
782 views

Hex-Rays Decompiler: Buffer on the stack

I am currently reversing a windows driver in order to write a Linux compatible driver for a DVB card, but I have come up against a small issue that I can work around, but if it is possible I would ...

1 2
3