4 ms·

The hex-rays info is obsolete/wrong. Corrections... Platform: Windows/Linux/Mac Binary Format Support: ELF, PE-COFF exe, DOS exe, a.out, MachO, raw binary, et

by tropo 11y ago

The hex-rays info is obsolete/wrong. Corrections... Platform: Windows/Linux/Mac Binary Format Support: ELF, PE-COFF exe, DOS exe, a.out, MachO, raw binary, etc. Interactive Batch: both Recompilable Output: yes, of course Structuring: very good Variables: very good Types: very good (after you mark parameters/globals)

jcranmer 11y ago
My recollection of IDA is that it completely keels over if you give it structures or arrays (unless you take the time to manually teach it about every little thing), and a colleague of ours has confirmed that Hex-Rays does a horrible job here as well in a similar situation. The exact example was: typedef struct { int x, y; } Point; int main() { int i; Point p[5]; for (i = 0; i < 5; ++i) { p[i].x = 1; p[i].y = 2; } return p[0].y; } which Hex-Rays turned into: int __cdecl main(int argc, const char argv, const char envp) { int v3; // ebp@0 signed int v4; // ecx@1 int v5; // eax@1 v4 = 0; v5 = v3 - 40; do { (_DWORD )(unsigned int)v5 = 1; (_DWORD )(unsigned int)(v5 + 4) = 2; v5 += 8; ++v4; } while (v4 < 5); return (_DWORD )(unsigned int)(v3 - 36); } (Apologies for any typos, I'm transcribing this from a second computer). To be fair, most decompilers or binary analysis tools tend to have massive problems in this regard. It's only really in the past decade or so that the research community has started to shift from heuristic-heavy, pattern-matching based approaches to more principled, general-purpose algorithms, and IDA Pro is best characterized as "every heuristic ever developed."
- burfog 11y ago
  Well yes and no. You normally need to teach IDA once, and sometimes it needs a reminder. This means setting a proper prototype on the function before you attempt to decompile it.
SXX 11y ago
> Binary Format Support: ELF, PE-COFF exe, DOS exe, a.out, MachO, raw binary, etc. Sadly as far as I aware hex-rays is almost useless for DOS exe since it's not support 16-bit code and many applications are 16-bit. Is something changed in past few years?
- burfog 11y ago
  Something changed a couple decades ago: everybody started using 32-bit DOS extenders.
  - SXX 11y ago
    I would be really happy if software I wanted to study had 32-bit version, but it doesn't. Though I may overestimate how many 16-bit only applications are there.

by tropo 11y ago

jcranmer 11y ago

My recollection of IDA is that it completely keels over if you give it structures or arrays (unless you take the time to manually teach it about every little thing), and a colleague of ours has confirmed that Hex-Rays does a horrible job here as well in a similar situation. The exact example was: typedef struct { int x, y; } Point; int main() { int i; Point p[5]; for (i = 0; i < 5; ++i) { p[i].x = 1; p[i].y = 2; } return p[0].y; } which Hex-Rays turned into: int __cdecl main(int argc, const char argv, const char envp) { int v3; // ebp@0 signed int v4; // ecx@1 int v5; // eax@1 v4 = 0; v5 = v3 - 40; do { (_DWORD )(unsigned int)v5 = 1; (_DWORD )(unsigned int)(v5 + 4) = 2; v5 += 8; ++v4; } while (v4 < 5); return (_DWORD )(unsigned int)(v3 - 36); } (Apologies for any typos, I'm transcribing this from a second computer). To be fair, most decompilers or binary analysis tools tend to have massive problems in this regard. It's only really in the past decade or so that the research community has started to shift from heuristic-heavy, pattern-matching based approaches to more principled, general-purpose algorithms, and IDA Pro is best characterized as "every heuristic ever developed."

burfog 11y ago
Well yes and no. You normally need to teach IDA once, and sometimes it needs a reminder. This means setting a proper prototype on the function before you attempt to decompile it.

SXX 11y ago

> Binary Format Support: ELF, PE-COFF exe, DOS exe, a.out, MachO, raw binary, etc. Sadly as far as I aware hex-rays is almost useless for DOS exe since it's not support 16-bit code and many applications are 16-bit. Is something changed in past few years?

burfog 11y ago
Something changed a couple decades ago: everybody started using 32-bit DOS extenders.
- SXX 11y ago
  I would be really happy if software I wanted to study had 32-bit version, but it doesn't. Though I may overestimate how many 16-bit only applications are there.