Igor’s tip of the week #108: Raw memory accesses in pseudocode

Sometimes in pseudocode you may encounter strange-looking code: The code seems to dereference an array calledMEMORY and is highlighted in red. However, this variable is not defined anywhere. What is it? Such notation is used by the decompiler when the code accesses memory addresses not present in the database. In most cases it indicates an error in […]

Igor’s tip of the week #107: Multiple return values

The Hex-Rays decompiler was initially created to decompile C code, so its pseudocode output uses (mostly) C syntax. However, the input binaries may be compiled using other languages: C++, Pascal, Basic, ADA, and many others. While the code of most of them can be represented in C without real issues, some have peculiarities which require […]

Igor’s tip of the week #106: Outlined functions

The release notes for IDA 8.0 mention outlined functions. What are those and how to deal with them in IDA? Function outlining is an optimization that saves code size by identifying recurring sequences of machine code and replacing each instance of the sequence with a call to a new function that contains the identified sequence […]

Igor’s tip of the week #105: Offsets with custom base

We’ve already covered simple offsets, where an operand value or a data value matches an address in the program and so can be directly converted to an offset. However, programs may also employ more complex, or indirect ways of referring to a location. One common approach is using a small offset from some predefined […]

Igor’s tip of the week #104: Immediate search

Immediate search is one of three main search types available in IDA. While not that known, it can be very useful in some situations. Here are some examples. Unique (magic) constants If you know some unique constants used by the program, looking for them can let you narrow down the range of code you have to […]

Igor’s tip of the week #103: Sharing plugins between IDA installs

As of the time of writing, IDA does not have a built-in plugin manager, so third-party plugins have to be installed manually. Installing into IDA directory The standard location for IDA plugins is the plugins directory in IDA’s installation (for example, C:\Program Files\IDA Pro 8.0\plugins on Windows). So this is the most common way of installing them […]

Igor’s tip of the week #100: Collapsing pseudocode parts

When working with big functions in the decompiler, it may be useful to temporarily hide some parts of the pseudocode to analyze the rest. While currently it’s not possible to hide arbitrary lines like in disassembly, you can hide specific sections of it.   Collapsing local variable declarations While the local variable declarations are useful to see […]

Igor’s tip of the week #99: Enums

In IDA, an enum (from “enumeration”) is a set of symbolic constants with numerical values. They can be thought of as a superset of C/C++ enum types and preprocessor defines. These constants can be used in disassembly or pseudocode to replace specific numbers or their combinations with symbolic names, making the listing more readable and understandable.  Creating […]