Hex-Rays has been acquired by a consortium of investors led by Smartfin, a leading European venture capital and private equity investor, and including co-investors SFPIM and SRIW. Ilfak Guilfanov, the founder of Hex-Rays, also reinvests a substantial amount in the new structure. Over the past 10 years, Hex-Rays’ revenues have […]
Read MoreWe’ve covered offsets with base previously. There is a variation of such offsets commonly used in position-independent code which can be handled easily with a little trick. Let’s consider this ARM function from an ARM32 firmware: ROM:00000058 ; int sub_58() ROM:00000058 sub_58 […]
Read MoreThe Hex view is used to display the contents of the database as a hex dump. It is also used during debugging to display memory contents. By default it has a part on the right with the textual representation of the data. Usually the text part shows Latin letters or dots for unprintable characters but you […]
Read MoreHex-Rays team is thrilled to announce the release of IDA version 8.1! As with every release, IDA Pro and IDA Home gained many new features and enhancements, including: Private Lumina server New icons Golang regabi support Sunsetting IDA for 32-bit binaries (IDA32) and more See full updates here: https://hex-rays.com/products/ida/news/8_1/ How to request the new versions As usual, the new versions of IDA Pro […]
Read MoreSometimes in pseudocode you may encounter strange-looking code: The code seems to dereference an array calledMEMORY and is highlighted in red. However, this variable is not defined anywhere. What is it? Such notation is used by the decompiler when the code accesses memory addresses not present in the database. In most cases it indicates an error in […]
Read MoreThe Hex-Rays decompiler was initially created to decompile C code, so its pseudocode output uses (mostly) C syntax. However, the input binaries may be compiled using other languages: C++, Pascal, Basic, ADA, and many others. While the code of most of them can be represented in C without real issues, some have peculiarities which require […]
Read MoreThe release notes for IDA 8.0 mention outlined functions. What are those and how to deal with them in IDA? Function outlining is an optimization that saves code size by identifying recurring sequences of machine code and replacing each instance of the sequence with a call to a new function that contains the identified sequence […]
Read MoreIn the past, we have worked with various beta testers that helped us shape our products by trying out our pre-release versions. Today, we are launching our Beta Program initiative with the idea of building a community of enthusiasts who would regularly take an active part in the evolution […]
Read MoreWe’ve already covered simple offsets, where an operand value or a data value matches an address in the program and so can be directly converted to an offset. However, programs may also employ more complex, or indirect ways of referring to a location. One common approach is using a small offset from some predefined […]
Read MoreIn August 2020, we started blog series called “Igor’s tip of the week.” These blog posts aim to help you better work with IDA & Decompilers. Over the years, his pieces of advice have become very popular, and our natural response was to make them even more accessible and easy to read. That’s […]
Read More