Igor’s tip of the week #40: Decompiler basics – Hex Rays

The Hex-Rays decompiler is one of the most powerful add-ons available for IDA. While it’s quite intuitive once you get used to it, it may be non-obvious how to start using it.

Basic information

As of the time of writing (May 2021), the decompiler is not included with the standard IDA Pro license; some editions of IDA Home and IDA Free include a cloud decompiler, but the offline version requires IDA Pro and must be purchased separately.
The following decompilers are currently available:

• x86 (32-bit)
• x64 (64-bit)
• ARM (32-bit)
• ARM64 (64-bit)
• PPC (32-bit)
• PPC64 (64-bit)
• MIPS (32-bit)

Pick the matching IDA

The decompiler must be used with the matching IDA: 32-bit decompilers only work with 32-bit IDA (e.g. ida.exe) while 64-bit ones require ida64. If you open a 32-binary in IDA64 and press F5, you’ll get a warning:

If you try to decompile a file for which you do not have a decompiler, a different error is displayed:

Invoking the decompiler

The decompiler can be invoked in the following ways:

1. View > Open subviews > Generate pseudocode (or simply F5). This always opens a new pseudocode view (up to 26);
2. Tab switches to the last active pseudocode view and decompiles current function. If there are none, a new view  is opened just like with F5.
   Tab can also be used to switch from pseudocode back to the disassembly. Whenever possible, it tries to jump to the corresponding location in the other view.
3. Full decompilation of the whole database can be requested via File > Produce file > Create C file… (hotkey Ctrl+F5). This command decompiles selected or all functions in the database (besides those marked as library functions) and writes the result to a text file.

Changing options

Because of its origins as a standalone plugin, the decompiler’s options are not currently present in the Options menu but are accessed via Edit > Plugins  > Hex-Rays Decompiler.

This dialog changes options for the current database. To change them for all future files, edit cfg/hexrays.cfg. Instead of editing the file in IDA’s directory, you can create one with only changed options in the user directory. The available options are explained in the manual.