How to decompile a function in Hex-Rays?
Let’s start with a very short and simple function: We decompile it with View, Open subviews, Pseudocode (hotkey F5 ): While the generated C code makes sense, it is not pretty. There are many cast operations cluttering the text.
What is an example of pointer arithmetic in C?
For Example: If an integer pointer that stores address 1000 is incremented, then it will increment by 2 (size of an int) and the new address it will points to 1002. While if a float type pointer is incremented then it will increment by 4 (size of a float) and the new address will be 1004.
Where does the pseudocode go in Hex Rays?
If the decompilation is successful, it opens a new window titled “Pseudocode” and places the generated C text in this window. The user can also select text and copy it to the clipboard with the Ctrl-C combination. If the current item is C statement keyword, an additional item may appear in the context menu:
Is there an interactive operation in the text version of Ida?
Note: interactive operation is not supported in the text version of IDA. This command decompiles the current function. If the decompilation is successful, it opens a new window titled “Pseudocode” and places the generated C text in this window. The user can also select text and copy it to the clipboard with the Ctrl-C combination.
Why are there jump out statements in Hex-Rays?
The problem is that Hex-Rays seems to use autodetected function boundaries and therefore the decompilation fails after a jump inside the function, which looks like a jump outside to Hex-Rays. As you can see, there is a JUMPOUT statement at the end of the function.
Why does the decompiler not perform the type recovery?
The reason is that the decompiler does not perform the type recovery yet. Apparently, the a1 argument points to a structure but the decompiler missed it. Let us add some type information to the database and see what happens. For that we will open the Structure window ( Shift-F9) and add a new structure type:
How to get rid of Hex Rays in Ida?
One of possible workarounds is to export the database as IDC file and then run the resulting script on a clean database. This way, function prototypes and type information are kept intact. Hex-Rays decompiled results will differ, though (variable mapping information is lost, and so are local variable names).
How to decompile and recompile C code?
What tools produce C code that does not produce errors when you try to recompile it again? Can Hex-Rays decompiler convert everything to project files in a single folder and just compile it? The primary purpose of decompilation is not to produce code that is compiled back with no errors, but rather recover logical flow of a binary.
How does the decompiler add commands to the menus?
The decompiler adds the following commands to the menus: Note: interactive operation is not supported in the text version of IDA. This command decompiles the current function. If the decompilation is successful, it opens a new window titled “Pseudocode” and places the generated C text in this window.