Igor’s Tip of the Week #117: Reset pointer type

While currently (as of version 8.1) the Hex-Rays decompiler does not try to perform full type recovery, it does try to deduce some types based on operations done on the variables, or using the type information for the API calls from type libraries. One simple type deduction performed by the decompiler is creation of typed […]

Igor’s Tip of the Week #115: Set callee address

Cross-references is one of the most useful features of IDA. For example, they allow you to see where a particular function is being called or referenced from, helping you to see how the function is used and understand its behavior better or discover potential bugs or vulnerabilities. For direct calls, IDA adds cross-references automatically, […]

Igor’s Tip of the Week #114: Split offsets

Previously, we have covered offset expressions which fit into a single instruction operand or data value. But this is not always the case, so let’s see how IDA can handle offsets which may be built out of multiple parts. 8-bit processors Although slowly dying out, the 8-bit processors — especially the venerable 8051 — […]

Igor’s Tip of the Week #113: Image-relative Offsets (RVA)

Image-relative offsets are values that represent an offset from the image base of the current module (image) in memory. This means that they can be used to refer to other locations in the same module regardless of its real, final load address, and thus can be used to make the code position-independent (PIC), similarly to […]

Igor’s tip of the week #109: Hex view text encoding

The Hex view is used to display the contents of the database as a hex dump. It is also used during debugging to display memory contents. By default it has a part on the right with the textual representation of the data. Usually the text part shows Latin letters or dots for unprintable characters but you […]

Igor’s tip of the week #108: Raw memory accesses in pseudocode

Sometimes in pseudocode you may encounter strange-looking code: The code seems to dereference an array calledMEMORY and is highlighted in red. However, this variable is not defined anywhere. What is it? Such notation is used by the decompiler when the code accesses memory addresses not present in the database. In most cases it indicates an error in […]

Igor’s tip of the week #107: Multiple return values

The Hex-Rays decompiler was initially created to decompile C code, so its pseudocode output uses (mostly) C syntax. However, the input binaries may be compiled using other languages: C++, Pascal, Basic, ADA, and many others. While the code of most of them can be represented in C without real issues, some have peculiarities which require […]