Hot answers tagged

47 votes

Decompiling iPhone App

iOS applications are protected by a Apple's DRM system. That system encrypts certain segment(s) of the application. The keys to that encryption are, as far as I know, unique per device or per device ...
user avatar
33 votes

How to organize vtables in IDA Pro?

This depends on the compiler originally used as each creates slightly different layouts. You can find tutorials for most compilers on the net, I'm going to focus MSVC as that's the one I have ...
user avatar
  • 993
9 votes

How do I evaluate Hex-Rays Decompiler without purchasing IDA Disassembler?

Hex-Rays Decompiler is an addition\extension for IDA Pro and I doubt it can work as a separate standalone product. Please see "Prerequisites" part of Hex-Rays Decompiler Manual: "The decompiler ...
user avatar
  • 2,438
9 votes

IDA Hex-Rays Decompiler : Show strings instead of offset

Go to the menu Edit -> Plugins -> Hex-Rays Decompiler. A window will appear with information about the Hex-Rays plugin. Click Options and you should see a dialog like this: Click on Analysis ...
user avatar
  • 1,602
8 votes

Information provided by Hex-Rays after @ symbol in variable declarations

The numbers denote the basic block number in the microcode where the variable was first used. Microcode basic blocks do not necessarily match the basics block in the disassembly, because during ...
user avatar
  • 34.7k
6 votes

IdaPro/HexRays type libraries

IDA's til files are basically IDA's way of storing type information for particular functions. AFAIK, a .til file doesn't tell IDA how to actually recognize that function in order to apply function ...
user avatar
6 votes

IDA decompiler macro

COERCE_TYPE(x) is the same thing as *(TYPE *)&x. Hex-Rays uses COERCE_... macros when &x is illegal. For example: COERCE_DOUBLE(__PAIR__(i1,i2)) Is the same as *(double *)&__PAIR__(i1, ...
user avatar
6 votes

Why Ida pseudo-code translate test as AND?

test is basically an and instruction except it doesn't update the left operand. In the other hand, cmp is the equivalent of sub instruction except it doesn't update the left operand. To sum up: if (...
user avatar
  • 1,074
5 votes
Accepted

How to edit (insert new fields into) IDA structures?

You can undefine the field (select Undefine from the context menu or press U) and then press D to define a new field in the gap.
user avatar
5 votes

Cleaning HexRays Output

Locate cursor at v1 and press = . If I remember it correctly since IDA 6.6 it will allow you to define that some variable is actually same as other.
user avatar
  • 7,720
5 votes
Accepted

How to decompile with Hex Rays via a Python API?

Yes. The newer versions of IDA has official bindings for the Hex-Rays decompiler. Originally, the Python bindings were written by EiNSTeiN around the Hex-Rays Decompiler SDK API. Later it has been ...
user avatar
  • 8,629
5 votes

Hex-Rays not properly showing strings

The issue here is not strings, it's the fact that Hex-Rays didn't guess the right calling convention for sub_4022E0. Notice that the disassembly listing moves values into both ecx and edx before the ...
user avatar
  • 7,814
4 votes

Wrapping usercall from Hex-Rays

Your hook is wrong because retn 4 is for __stdcalls, not __usercalls, and because you must move arguments to registers, not push them. Do it like this: mov esi, a1 mov ecx, a2 call hook_address ret ...
user avatar
  • 1,253
4 votes
Accepted

Reverse Engineering MIPS Bootloader

As you guessed correctly, you have to find out the correct starting address of the bootloader image. Based on the bootloader in the latest firmware image (TL-WR702N_V1_141203) I recommend you to try ...
user avatar
  • 1,731
4 votes
Accepted

IDA PRO Hex-Rays 1.5 pseudo code understanding -=0x3FFFFFFFu; += 0x3FFFFFFFu;

I think it should look like this I am 99.9% feel it's a element shifter something tells me that 0x3FFFFFFF is max bounds of a array so it's some compiler thing that it appends to make sure it gets the ...
user avatar
  • 729
4 votes

What does __PAIR__ mean in Hex-Rays decompiler output?

__PAIR__() seems to be a macro that computes an unsigned long value from its two arguments, which it interprets as containing the high and low bits of that value. The topic linked by Guntram - ...
user avatar
  • 1,960
4 votes
Accepted

Hex-Rays and IDA Python plugin loading order

When loading plugins, IDA goes through them alphabetically, and tries to load all the plugins. When loading a plugin, the loader check the plugin flags (idaapi.PLUGIN_PROC, idaapi.PLUGIN_FIX, and so ...
user avatar
  • 1,479
4 votes

What is *(_BYTE *), __usercall, eax and edi

First, OP mentioned several times he'd like to execute the function. Which should be pretty easy using a debugger (IDA has decent debugging capabilities, or you could give ollydbg a try) I'll answer ...
user avatar
  • 11.4k
4 votes
Accepted

Doesn't IDA Pro 6.95 support decompiling MIPS executable?

No, IDA version 6.95 doesn't support it. See hex-rays.com/products/decompiler for more details. Regarding other news and features see decompiler news page. Update (12/3/2020): The original answer was ...
user avatar
  • 7,720
4 votes
Accepted

HexRays: Variadic methods like printf

If the decompiler detects wrong number of arguments for a variadic function call, you can adjust it using the context menu comands or Numpad +/- hotkeys.
user avatar
  • 34.7k
4 votes
Accepted

How to show KUSER_SHARED_DATA members in decompiled C code?

For IDA/Hex-Rays: In the Loaded Type Libraries window (View->Open subviews->Type libraries), load ntddk_win10 (or whatever Windows version you want, back to Windows XP and Windows Server 2003). ...
user avatar
  • 7,814
3 votes
Accepted

Large number of IDA .ASM files, need list of potential mnemonics

As I'm working with the malware samples provided by kaggle too, I faced the same problem. I found a solution by the processing in two steps, which extracts all the mnemonics used in the complete set. ...
user avatar
  • 1,227
3 votes

Saving .so file in IDA

Go to File and select Script file and choose a .idc name for your file, which makes the changes permanent. Then when you will run the .idc file, you will notice that bytes have been written to those ...
user avatar
  • 105
3 votes

How do I evaluate Hex-Rays Decompiler without purchasing IDA Disassembler?

I suggest you look for decompiled code samples posted on the internet. That should give you a good indication of the decompiler's capabilities. You can interactively decompile. Or also decompile in ...
user avatar
3 votes
Accepted

Split variable in Hexrays decompiler?

I don't think there's a way to add a new function variable, since the decompiler creates those based on registers and stack locations. However, in situations where it's really annoying, creating a ...
user avatar
3 votes

Resolving FLAGS bits with IDA

In IDA, you can define enums through the Enums view (shift+F10). Enums have the "bitfield" bit set (a checkbox by the same name can be found in the Enum edit and create dialogs). This bit cannot be ...
user avatar
  • 11.4k
3 votes

Understanding Hex-Rays pseudo code

BYTE1(v2) is the second byte of value v2. according to the reference it's Zero-Indexed. defined as: #define BYTEn(x, n) (*((_BYTE*)&(x)+n)) #define BYTE1(x) BYTEn(x, 1) // byte 1 (...
user avatar
  • 131
3 votes
Accepted

IDA Hex-Rays: How to find all references to the certain field of all instances of the data type?

IDA does support structure member cross-references: it will show you everywhere in the disassembly listing that an instruction operand has had that particular structure reference applied to it. See ...
user avatar
  • 7,814
3 votes

How to help IDA to auto complete libc functions?

Here are the required steps using Igor Skochinsky's answer: Clone musl git repository: git clone --depth=1 git://git.musl-libc.org/musl Compile the code: cd musl; ./configure; make -s -j2 Extract ...
user avatar
  • 1,439
3 votes

IDA pseudocode support

Decompilation is done by another product of Hex-Rays, which is called Hex-Rays Decompiler. You can find more about it here. The page includes the list of supported processors (correct for December ...
user avatar
  • 7,720

Only top scored, non community-wiki answers of a minimum length are eligible