Skip to main content
39 votes

How to organize vtables in IDA Pro?

This depends on the compiler originally used as each creates slightly different layouts. You can find tutorials for most compilers on the net, I'm going to focus MSVC as that's the one I have ...
Ray's user avatar
  • 1,103
9 votes

How do I evaluate Hex-Rays Decompiler without purchasing IDA Disassembler?

Hex-Rays Decompiler is an addition\extension for IDA Pro and I doubt it can work as a separate standalone product. Please see "Prerequisites" part of Hex-Rays Decompiler Manual: "The decompiler ...
Denis Laskov's user avatar
  • 2,438
9 votes

IDA Hex-Rays Decompiler : Show strings instead of offset

Go to the menu Edit -> Plugins -> Hex-Rays Decompiler. A window will appear with information about the Hex-Rays plugin. Click Options and you should see a dialog like this: Click on Analysis ...
mrexodia's user avatar
  • 1,672
6 votes

IDA decompiler macro

COERCE_TYPE(x) is the same thing as *(TYPE *)&x. Hex-Rays uses COERCE_... macros when &x is illegal. For example: COERCE_DOUBLE(__PAIR__(i1,i2)) Is the same as *(double *)&__PAIR__(i1, ...
Ilfak Guilfanov's user avatar
6 votes

Why Ida pseudo-code translate test as AND?

test is basically an and instruction except it doesn't update the left operand. In the other hand, cmp is the equivalent of sub instruction except it doesn't update the left operand. To sum up: if (...
wisk's user avatar
  • 1,154
5 votes

Cleaning HexRays Output

Locate cursor at v1 and press = . If I remember it correctly since IDA 6.6 it will allow you to define that some variable is actually same as other.
w s's user avatar
  • 8,508
5 votes
Accepted

How to edit (insert new fields into) IDA structures?

You can undefine the field (select Undefine from the context menu or press U) and then press D to define a new field in the gap.
Jason Geffner's user avatar
5 votes
Accepted

How to decompile with Hex Rays via a Python API?

Yes. The newer versions of IDA has official bindings for the Hex-Rays decompiler. Originally, the Python bindings were written by EiNSTeiN around the Hex-Rays Decompiler SDK API. Later it has been ...
Megabeets's user avatar
  • 8,999
4 votes
Accepted

Hex-Rays and IDA Python plugin loading order

When loading plugins, IDA goes through them alphabetically, and tries to load all the plugins. When loading a plugin, the loader check the plugin flags (idaapi.PLUGIN_PROC, idaapi.PLUGIN_FIX, and so ...
tmr232's user avatar
  • 1,577
4 votes

What is *(_BYTE *), __usercall, eax and edi

First, OP mentioned several times he'd like to execute the function. Which should be pretty easy using a debugger (IDA has decent debugging capabilities, or you could give ollydbg a try) I'll answer ...
NirIzr's user avatar
  • 11.8k
4 votes
Accepted

Doesn't IDA Pro 6.95 support decompiling MIPS executable?

No, IDA version 6.95 doesn't support it. See hex-rays.com/products/decompiler for more details. Regarding other news and features see decompiler news page. Update (12/3/2020): The original answer was ...
w s's user avatar
  • 8,508
4 votes
Accepted

HexRays: Variadic methods like printf

If the decompiler detects wrong number of arguments for a variadic function call, you can adjust it using the context menu comands or Numpad +/- hotkeys.
Igor Skochinsky's user avatar
  • 36.8k
4 votes
Accepted

Split variable in Hexrays decompiler?

I don't think there's a way to add a new function variable, since the decompiler creates those based on registers and stack locations. However, in situations where it's really annoying, creating a ...
mayahustle's user avatar
4 votes

Understanding Hex-Rays pseudo code

BYTE1(v2) is the second byte of value v2. according to the reference it's Zero-Indexed. defined as: #define BYTEn(x, n) (*((_BYTE*)&(x)+n)) #define BYTE1(x) BYTEn(x, 1) // byte 1 (...
arman's user avatar
  • 141
4 votes

Decompile large function in IDA

You can give https://retdec.com/idaplugin/ a try. I've heard it can decompile larger functions without much error. According to them it supports decompiling a whole binary file. So it possibly could ...
Graham's user avatar
  • 91
4 votes
Accepted

How to show KUSER_SHARED_DATA members in decompiled C code?

For IDA/Hex-Rays: In the Loaded Type Libraries window (View->Open subviews->Type libraries), load ntddk_win10 (or whatever Windows version you want, back to Windows XP and Windows Server 2003). ...
Rolf Rolles's user avatar
  • 9,198
4 votes

Hex-Rays not properly showing strings

The issue here is not strings, it's the fact that Hex-Rays didn't guess the right calling convention for sub_4022E0. Notice that the disassembly listing moves values into both ecx and edx before the ...
Rolf Rolles's user avatar
  • 9,198
3 votes
Accepted

DNameNode class from MSVC binaries

Okay, now I'm pretty sure, that it was FLIRT signature missmatch. DNameNode from my code doesn't have anything common with undname tool (which looks like IDA missmatches it with). Also, I found in ...
yudjin's user avatar
  • 81
3 votes

How do I evaluate Hex-Rays Decompiler without purchasing IDA Disassembler?

I suggest you look for decompiled code samples posted on the internet. That should give you a good indication of the decompiler's capabilities. You can interactively decompile. Or also decompile in ...
Willem Hengeveld's user avatar
3 votes

Saving .so file in IDA

Go to File and select Script file and choose a .idc name for your file, which makes the changes permanent. Then when you will run the .idc file, you will notice that bytes have been written to those ...
amgnet's user avatar
  • 105
3 votes
Accepted

Large number of IDA .ASM files, need list of potential mnemonics

As I'm working with the malware samples provided by kaggle too, I faced the same problem. I found a solution by the processing in two steps, which extracts all the mnemonics used in the complete set. ...
knx's user avatar
  • 1,257
3 votes

Resolving FLAGS bits with IDA

In IDA, you can define enums through the Enums view (shift+F10). Enums have the "bitfield" bit set (a checkbox by the same name can be found in the Enum edit and create dialogs). This bit cannot be ...
NirIzr's user avatar
  • 11.8k
3 votes
Accepted

IDA Hex-Rays: How to find all references to the certain field of all instances of the data type?

IDA does support structure member cross-references: it will show you everywhere in the disassembly listing that an instruction operand has had that particular structure reference applied to it. See ...
Rolf Rolles's user avatar
  • 9,198
3 votes

Decompile large function in IDA

The question is too old, but I'll answer it anyway, maybe it'll be useful for someone else. You can change the MAX_FUNCSIZE variable in the \IDA\cfg\hexrays.cfg The default is 64, put a bigger number. ...
NetCat's user avatar
  • 39
3 votes

How to help IDA to auto complete libc functions?

Here are the required steps using Igor Skochinsky's answer: Clone musl git repository: git clone --depth=1 git://git.musl-libc.org/musl Compile the code: cd musl; ./configure; make -s -j2 Extract ...
Biswapriyo's user avatar
  • 1,569
3 votes

IDA pseudocode support

Decompilation is done by another product of Hex-Rays, which is called Hex-Rays Decompiler. You can find more about it here. The page includes the list of supported processors (correct for December ...
w s's user avatar
  • 8,508
3 votes

Re-analyzing pseudocode IDA Pro

While in the pseudocode view pressing F5 will re-decompile the current function.
Avery3R's user avatar
  • 1,258
3 votes

Batch decompile using IDA Pro 7.5

Please see Batch Operation In the decompiler’s manual.
Igor Skochinsky's user avatar
  • 36.8k
3 votes

IDA/HexRays: how do I retrieve the memory address associated with a given line of decompiled code?

In hexrays.hpp, citem_t is the base class for both cinsn_t ("instructions", such as for loops, if statements, etc.) and cexpr_t ("expressions", such as addition, memory dereference,...
Rolf Rolles's user avatar
  • 9,198
3 votes

How to show KUSER_SHARED_DATA members in decompiled C code?

ghidra addr = toAddr(0x7ffe0000) currentProgram.memory.createUninitializedBlock("KUSER_SHARED_PAGE",addr,0x1000,0) createData(addr,getDataTypes("KUSER_SHARED_DATA")[0]) result ...
blabb's user avatar
  • 16.4k

Only top scored, non community-wiki answers of a minimum length are eligible