39
votes
How to organize vtables in IDA Pro?
This depends on the compiler originally used as each creates slightly different layouts. You can find tutorials for most compilers on the net, I'm going to focus MSVC as that's the one I have ...
- 1,083
9
votes
How do I evaluate Hex-Rays Decompiler without purchasing IDA Disassembler?
Hex-Rays Decompiler is an addition\extension for IDA Pro and I doubt it can work as a separate standalone product.
Please see "Prerequisites" part of Hex-Rays Decompiler Manual:
"The decompiler ...
- 2,438
9
votes
IDA Hex-Rays Decompiler : Show strings instead of offset
Go to the menu Edit -> Plugins -> Hex-Rays Decompiler. A window will appear with information about the Hex-Rays plugin. Click Options and you should see a dialog like this:
Click on Analysis ...
- 1,652
6
votes
IDA decompiler macro
COERCE_TYPE(x) is the same thing as *(TYPE *)&x. Hex-Rays uses COERCE_... macros when &x is illegal. For example:
COERCE_DOUBLE(__PAIR__(i1,i2))
Is the same as *(double *)&__PAIR__(i1, ...
- 111
6
votes
Why Ida pseudo-code translate test as AND?
test is basically an and instruction except it doesn't update the left operand.
In the other hand, cmp is the equivalent of sub instruction except it doesn't update the left operand.
To sum up:
if (...
- 1,124
5
votes
Accepted
How to edit (insert new fields into) IDA structures?
You can undefine the field (select Undefine from the context menu or press U) and then press D to define a new field in the gap.
- 20.6k
5
votes
Cleaning HexRays Output
Locate cursor at v1 and press = . If I remember it correctly since IDA 6.6 it will allow you to define that some variable is actually same as other.
- 8,353
5
votes
Accepted
How to decompile with Hex Rays via a Python API?
Yes. The newer versions of IDA has official bindings for the Hex-Rays decompiler.
Originally, the Python bindings were written by EiNSTeiN around the Hex-Rays Decompiler SDK API. Later it has been ...
- 8,909
4
votes
Wrapping usercall from Hex-Rays
Your hook is wrong because retn 4 is for __stdcalls, not __usercalls, and because you must move arguments to registers, not push them. Do it like this:
mov esi, a1
mov ecx, a2
call hook_address
ret
...
- 1,283
4
votes
Accepted
Reverse Engineering MIPS Bootloader
As you guessed correctly, you have to find out the correct starting address of the bootloader image. Based on the bootloader in the latest firmware image (TL-WR702N_V1_141203) I recommend you to try ...
- 1,759
4
votes
Accepted
Hex-Rays and IDA Python plugin loading order
When loading plugins, IDA goes through them alphabetically, and tries to load all the plugins.
When loading a plugin, the loader check the plugin flags (idaapi.PLUGIN_PROC, idaapi.PLUGIN_FIX, and so ...
- 1,557
4
votes
What is *(_BYTE *), __usercall, eax and edi
First, OP mentioned several times he'd like to execute the function. Which should be pretty easy using a debugger (IDA has decent debugging capabilities, or you could give ollydbg a try)
I'll answer ...
- 11.7k
4
votes
Accepted
Doesn't IDA Pro 6.95 support decompiling MIPS executable?
No, IDA version 6.95 doesn't support it. See hex-rays.com/products/decompiler for more details.
Regarding other news and features see decompiler news page.
Update (12/3/2020):
The original answer was ...
- 8,353
4
votes
Accepted
HexRays: Variadic methods like printf
If the decompiler detects wrong number of arguments for a variadic function call, you can adjust it using the context menu comands or Numpad +/- hotkeys.
- 36.2k
4
votes
Accepted
Split variable in Hexrays decompiler?
I don't think there's a way to add a new function variable, since the decompiler creates those based on registers and stack locations.
However, in situations where it's really annoying, creating a ...
- 426
4
votes
Accepted
How to show KUSER_SHARED_DATA members in decompiled C code?
For IDA/Hex-Rays:
In the Loaded Type Libraries window (View->Open subviews->Type libraries), load ntddk_win10 (or whatever Windows version you want, back to Windows XP and Windows Server 2003).
...
- 9,088
4
votes
Hex-Rays not properly showing strings
The issue here is not strings, it's the fact that Hex-Rays didn't guess the right calling convention for sub_4022E0. Notice that the disassembly listing moves values into both ecx and edx before the ...
- 9,088
3
votes
Saving .so file in IDA
Go to File and select Script file and choose a .idc name for your file, which makes the changes permanent.
Then when you will run the .idc file, you will notice that bytes have been written to those ...
- 105
3
votes
Hex-Rays: JUMPOUT statements inserted due to incorrect autodetected function boundaries
Yes there is. HexRays takes function boundaries from IDA disassembly, so as far as you can change the function boundaries in disassembly view, you can manage function boundaries as follows (the ...
- 8,353
3
votes
Accepted
Large number of IDA .ASM files, need list of potential mnemonics
As I'm working with the malware samples provided by kaggle too, I faced the same problem. I found a solution by the processing in two steps, which extracts all the mnemonics used in the complete set.
...
- 1,257
3
votes
How do I evaluate Hex-Rays Decompiler without purchasing IDA Disassembler?
I suggest you look for decompiled code samples posted on the internet. That should give you a good indication of the decompiler's capabilities.
You can interactively decompile. Or also decompile in ...
- 1,829
3
votes
Resolving FLAGS bits with IDA
In IDA, you can define enums through the Enums view (shift+F10). Enums have the "bitfield" bit set (a checkbox by the same name can be found in the Enum edit and create dialogs). This bit cannot be ...
- 11.7k
3
votes
Understanding Hex-Rays pseudo code
BYTE1(v2) is the second byte of value v2. according to the reference it's Zero-Indexed. defined as:
#define BYTEn(x, n) (*((_BYTE*)&(x)+n))
#define BYTE1(x) BYTEn(x, 1) // byte 1 (...
- 121
3
votes
Accepted
IDA Hex-Rays: How to find all references to the certain field of all instances of the data type?
IDA does support structure member cross-references: it will show you everywhere in the disassembly listing that an instruction operand has had that particular structure reference applied to it. See ...
- 9,088
3
votes
Decompile large function in IDA
You can give https://retdec.com/idaplugin/ a try. I've heard it can decompile larger functions without much error.
According to them it supports decompiling a whole binary file. So it possibly could ...
- 81
3
votes
How to help IDA to auto complete libc functions?
Here are the required steps using Igor Skochinsky's answer:
Clone musl git repository:
git clone --depth=1 git://git.musl-libc.org/musl
Compile the code:
cd musl; ./configure; make -s -j2
Extract ...
- 1,549
3
votes
IDA pseudocode support
Decompilation is done by another product of Hex-Rays, which is called Hex-Rays Decompiler. You can find more about it here.
The page includes the list of supported processors (correct for December ...
- 8,353
3
votes
3
votes
IDA/HexRays: how do I retrieve the memory address associated with a given line of decompiled code?
In hexrays.hpp, citem_t is the base class for both cinsn_t ("instructions", such as for loops, if statements, etc.) and cexpr_t ("expressions", such as addition, memory dereference,...
- 9,088
3
votes
How to show KUSER_SHARED_DATA members in decompiled C code?
ghidra
addr = toAddr(0x7ffe0000)
currentProgram.memory.createUninitializedBlock("KUSER_SHARED_PAGE",addr,0x1000,0)
createData(addr,getDataTypes("KUSER_SHARED_DATA")[0])
result
...
- 16.2k
Only top scored, non community-wiki answers of a minimum length are eligible