39
votes
How to organize vtables in IDA Pro?
This depends on the compiler originally used as each creates slightly different layouts. You can find tutorials for most compilers on the net, I'm going to focus MSVC as that's the one I have ...
- 1,103
9
votes
IDA Hex-Rays Decompiler : Show strings instead of offset
Go to the menu Edit -> Plugins -> Hex-Rays Decompiler. A window will appear with information about the Hex-Rays plugin. Click Options and you should see a dialog like this:
Click on Analysis ...
- 1,707
6
votes
IDA decompiler macro
COERCE_TYPE(x) is the same thing as *(TYPE *)&x. Hex-Rays uses COERCE_... macros when &x is illegal. For example:
COERCE_DOUBLE(__PAIR__(i1,i2))
Is the same as *(double *)&__PAIR__(i1, ...
- 111
6
votes
Why Ida pseudo-code translate test as AND?
test is basically an and instruction except it doesn't update the left operand.
In the other hand, cmp is the equivalent of sub instruction except it doesn't update the left operand.
To sum up:
if (...
- 1,179
5
votes
Cleaning HexRays Output
Locate cursor at v1 and press = . If I remember it correctly since IDA 6.6 it will allow you to define that some variable is actually same as other.
- 8,538
5
votes
Accepted
How to decompile with Hex Rays via a Python API?
Yes. The newer versions of IDA has official bindings for the Hex-Rays decompiler.
Originally, the Python bindings were written by EiNSTeiN around the Hex-Rays Decompiler SDK API. Later it has been ...
- 9,019
4
votes
Accepted
HexRays: Variadic methods like printf
If the decompiler detects wrong number of arguments for a variadic function call, you can adjust it using the context menu comands or Numpad +/- hotkeys.
- 36.9k
4
votes
Accepted
Doesn't IDA Pro 6.95 support decompiling MIPS executable?
No, IDA version 6.95 doesn't support it. See hex-rays.com/products/decompiler for more details.
Regarding other news and features see decompiler news page.
Update (12/3/2020):
The original answer was ...
- 8,538
4
votes
What is *(_BYTE *), __usercall, eax and edi
First, OP mentioned several times he'd like to execute the function. Which should be pretty easy using a debugger (IDA has decent debugging capabilities, or you could give ollydbg a try)
I'll answer ...
- 11.8k
4
votes
Accepted
Split variable in Hexrays decompiler?
I don't think there's a way to add a new function variable, since the decompiler creates those based on registers and stack locations.
However, in situations where it's really annoying, creating a ...
- 436
4
votes
Understanding Hex-Rays pseudo code
BYTE1(v2) is the second byte of value v2. according to the reference it's Zero-Indexed. defined as:
#define BYTEn(x, n) (*((_BYTE*)&(x)+n))
#define BYTE1(x) BYTEn(x, 1) // byte 1 (...
- 141
4
votes
Decompile large function in IDA
You can give https://retdec.com/idaplugin/ a try. I've heard it can decompile larger functions without much error.
According to them it supports decompiling a whole binary file. So it possibly could ...
- 91
4
votes
Accepted
How to show KUSER_SHARED_DATA members in decompiled C code?
For IDA/Hex-Rays:
In the Loaded Type Libraries window (View->Open subviews->Type libraries), load ntddk_win10 (or whatever Windows version you want, back to Windows XP and Windows Server 2003).
...
- 9,218
4
votes
Hex-Rays not properly showing strings
The issue here is not strings, it's the fact that Hex-Rays didn't guess the right calling convention for sub_4022E0. Notice that the disassembly listing moves values into both ecx and edx before the ...
- 9,218
3
votes
How do I evaluate Hex-Rays Decompiler without purchasing IDA Disassembler?
I suggest you look for decompiled code samples posted on the internet. That should give you a good indication of the decompiler's capabilities.
You can interactively decompile. Or also decompile in ...
- 1,829
3
votes
Accepted
DNameNode class from MSVC binaries
Okay, now I'm pretty sure, that it was FLIRT signature missmatch. DNameNode from my code doesn't have anything common with undname tool (which looks like IDA missmatches it with).
Also, I found in ...
- 81
3
votes
Resolving FLAGS bits with IDA
In IDA, you can define enums through the Enums view (shift+F10). Enums have the "bitfield" bit set (a checkbox by the same name can be found in the Enum edit and create dialogs). This bit cannot be ...
- 11.8k
3
votes
Accepted
IDA Hex-Rays: How to find all references to the certain field of all instances of the data type?
IDA does support structure member cross-references: it will show you everywhere in the disassembly listing that an instruction operand has had that particular structure reference applied to it. See ...
- 9,218
3
votes
Decompile large function in IDA
The question is too old, but I'll answer it anyway, maybe it'll be useful for someone else.
You can change the MAX_FUNCSIZE variable in the \IDA\cfg\hexrays.cfg
The default is 64, put a bigger number. ...
- 39
3
votes
How to help IDA to auto complete libc functions?
Here are the required steps using Igor Skochinsky's answer:
Clone musl git repository:
git clone --depth=1 git://git.musl-libc.org/musl
Compile the code:
cd musl; ./configure; make -s -j2
Extract ...
- 1,589
3
votes
IDA pseudocode support
Decompilation is done by another product of Hex-Rays, which is called Hex-Rays Decompiler. You can find more about it here.
The page includes the list of supported processors (correct for December ...
- 8,538
3
votes
Re-analyzing pseudocode IDA Pro
While in the pseudocode view pressing F5 will re-decompile the current function.
- 1,268
3
votes
3
votes
IDA/HexRays: how do I retrieve the memory address associated with a given line of decompiled code?
In hexrays.hpp, citem_t is the base class for both cinsn_t ("instructions", such as for loops, if statements, etc.) and cexpr_t ("expressions", such as addition, memory dereference,...
- 9,218
3
votes
How to show KUSER_SHARED_DATA members in decompiled C code?
ghidra
addr = toAddr(0x7ffe0000)
currentProgram.memory.createUninitializedBlock("KUSER_SHARED_PAGE",addr,0x1000,0)
createData(addr,getDataTypes("KUSER_SHARED_DATA")[0])
result
...
- 16.7k
3
votes
Accepted
An incomprehensible line in the output from hex rays
It's just a convoluted function call via function pointers.
(*(int (__cdecl **)(int))
casts a given number to a pointer to a function pointer (note the ** so second degree function pointer) and ...
- 1,391
3
votes
Accepted
IDA Pro shows an array where two varaibles should be
On the machine level, there is no difference between an int[2] array, a structure with two ints, or two int variables that happen to be placed next to each other.
In addition, sometimes one variable ...
- 36.9k
3
votes
Accepted
Hex-rays decompiler incorrect logic
I was able to work this one out.
The decompiler was not detecting the correct call parameter counts for the >> and << operators of cin and cout.
For example:
int __thiscall ...
- 180
3
votes
Re-analyse HexRays decompiled output
It sounds like you know how to use Hex-Rays to a non-trivial extent. You have probably noticed that Hex-Rays might -- or might not -- pause noticeably when decompiling a large function that you have ...
- 9,218
3
votes
Accepted
Removing empty blocks ida api
That function was renamed from bool remove_empty_blocks(void) to bool remove_empty_and_unreachable_blocks(void) as of Hex-Rays 7.6. Just change the name of the function you're trying to call.
- 9,218
Only top scored, non community-wiki answers of a minimum length are eligible