dietjas.blogg.se - Ida hexrays

The visited functions are marked with a cross and color: A double click opens the list with all virtual functions, which helps to visit them. Types with the BOLD font are virtual tables.Structure builder stores collected information and enables interaction: If you have the singleton pattern or the constructor is called in many places, it is possible to scan all the places, where a pointer to an object was recieved or an object was created. Right Click on a function -> Deep Scan Returned Value.Then, it recursively applies the scanner to variables and functions, which get the structure pointer as their argument. First, recursively touches functions to make Ida recognize proper arguments (it happens only once for each function during a session).

Right Click on a variable -> Deep Scan Variable.

Recognizes fields usage within the current function.

Right Click on a variable -> Scan Variable.

The place where all the collected information about the scanned variables can be viewed and modified. Also, cross-references will be remembered and usable anytime. All the scanned variables will get a new type.

After applying steps 2 and 3 enough times, resolve conflicts in the structure builder and finalize structure creation.

As an option, you can apply "Deep Scan variable", which will do the same thing but will also recursively visit other functions that has the same variable as its argument.

It will collect the information about the fields that were accessed in the boundaries of one function.

Find a local variable that points to the structure you would like to reconstruct.

The reconstruction process usually comprises the following steps: and pointers to non-defined structure declarations. By default, it is possible to scan only basic types like DWORD, QWORD, void * e t.c. Set True if you want to apply scanning to any variable type. Specifies whether to store the cross-references collected during the decompilation phase inside the database. Set True if you want to rename not only the default variables for the Propagate Name feature. Set 10 if you have a bug and want to show the log along with the information about how it was encountered in the issue. ConfigurationĬan be found at IDADIR\cfg\HexRaysPyTools.cfg Just copy HexRaysPyTools.py file and HexRaysPyTools directory to Ida plugins directory. Note: The plugin supports IDA Pro 7.x with Python 2/3. It also facilitates transforming decompiler output faster and allows to do some stuff which is otherwise impossible. The plugin assists in the creation of classes/structures and detection of virtual tables.