Hot answers tagged

5

Welcome to the Reverse engineering stack exchange Q&A site! Although you only asked about nullsub_, you described ___cxa_pure_virtual slightly incorrectly so I'll describe it as well nullsub_X IDA makes a minimal effort of providing meaningful, yet general, names for functions according to their implementation by adding a prefix or name for certain types ...


3

It sounds like you know how to use Hex-Rays to a non-trivial extent. You have probably noticed that Hex-Rays might -- or might not -- pause noticeably when decompiling a large function that you have already decompiled some time ago. That's because Hex-Rays often decompiles the same function more than once -- numerous times, actually -- throughout the course ...


3

I was able to work this one out. The decompiler was not detecting the correct call parameter counts for the >> and << operators of cin and cout. For example: int __thiscall std__basic_istream_char_std__char_traits_char____operator__(_DWORD, _DWORD, _DWORD) Is the detected signature of the >> operator. However, reviewing the C++ reference, ...


3

I expect that the compiler emitted two different symbol references in the two LEA instructions, and uses the compare instruction to detect at run time whether the two symbols were resolved to the same address at link time. Many modern compilers/linkers offer "link time code generation" aka "whole program optimization", where the compiler'...


2

Shift+F or right-click on the variable and then choose "Force new variable". IDA documentation: https://www.hex-rays.com/products/decompiler/manual/cmd_force_lvar.shtml


2

You should open your IDA's cfg\ida.cfg file and look for the StrlitChars definition inside it. That configuration variable controls which characters are considered legitimate string characters when converting an address/array to a string. Add your selected character in the format used and restart IDA. The comment above the configuration variable is pretty ...


1

If you expect something like full class definitions with field and method names, it’s simply not possible: all such information is not necessary for program execution and is discarded by the compiler. Sometimes runtime type information (RTTI) with class names may remain if the program uses classes with virtual functions and RTTI has not been disabled by the ...


1

It's a compiler optimization used to implement switch statements that have many cases leading to one location. Note that the weird output is not Hex-Rays' doing, but rather, a more-or-less direct translation of what's in the assembly language. You didn't show the assembly for your snippet, but here's similar disassembly from a database I have open: .text:...


1

Patching in IDA is pretty simple and well documented here and here. First, you need to make the change by selecting a portion of data in the main view and then use the Edit -> Patch program -> Change word submenu item. Note that at that point the change was only made to the IDB you're working on and not to the actual binary you loaded. Before applying ...


1

If you want to save the image of the graph as it is displayed in IDA, you can use https://github.com/tmr232/GraphGrabber For viewing and printing GDL graphs, you can use qwingraph program shipped with IDA. There is also a “print graph” button on IDA’s graph toolbar but it’s not shown by default. You can also generate graphs in a more common DOT format, see ...


1

This message shows that you, or a script you run, is trying to create a struct with a name that already exists. Common IDAPython analysis scripts try to define known struct types found in the disassembled code by, for example, known function signatures/symbols. This can be done by calling AddStrucEx function. Scripts don't always check whether the struct is ...


Only top voted, non community-wiki answers of a minimum length are eligible