Contents
Why are there jump out statements in Hex-Rays?
The problem is that Hex-Rays seems to use autodetected function boundaries and therefore the decompilation fails after a jump inside the function, which looks like a jump outside to Hex-Rays. As you can see, there is a JUMPOUT statement at the end of the function.
Who is Hex Rays and what do they do?
Hex-Rays is a private hi-tech company independent of government agencies and stock market influence, and we are focused on binary software analysis. We strive to deliver fast, stable, and robust products and provide excellent customer service.
Is the Ida disassembler supported by Hex Rays?
Hex-Rays develops and supports the IDA disassembler. This famous software analysis tool, which is a de-facto standard in the software security industry, is an indispensable item in the toolbox of any serious software analyst. IDA’s open architecture can be used by third-parties to extend its capabilities.
Is the Hex-Rays Decompiler used in real world?
IDA is also the solid foundation on which our second product, the Hex-Rays decompiler , is built. The unique Hex-Rays decompiler delivers on the promise of high level representation of binary executables. It can handle real world code. It is real. Read more:
Why does the Hex-Rays Decompiler not perform type recovery?
There are many cast operations cluttering the text. The reason is that the decompiler does not perform the type recovery yet. Apparently, the a1 argument points to a structure but the decompiler missed it. Let us add some type information to the database and see what happens.
Can a hexray change the function boundaries of Ida?
Yes there is. HexRays takes function boundaries from IDA disassembly, so as far as you can change the function boundaries in disassembly view, you can manage function boundaries as follows (the solution is for you specific case, solving this problem in common may be more complicated):
Is there a jump out statement at the end of the function?
As you can see, there is a JUMPOUT statement at the end of the function. This was correct before the function boundaries were adjusted, but now locret_403CFD belongs to the function itself and is not a jump “out”. Is there a way to tell hex-rays the function doesn’t end here and pass a correct function start/end addresses to it?