idatips

Tips and tricks for everyone's favorite disassembler. Account not run by Hex-Rays.

[idatips @idatips]

Got a tip or trick? Drop me a line!

[Rolf Rolles @RolfRolles]

I finally found a good use for Hex-Rays "Decompile as call", albeit a pretty niche one.

[Ilfak Guilfanov @ilfak]

@aionescu @IgorSkochinsky Did you try Shift-Alt-Up/Down? While not exactly the same, these hotkeys search for the closest def/use of the highlighted register.
Exists since IDA 7.5, after our conversation :)

[RET2 Systems @ret2systems]

Is the Hex-Rays microcode API powerful? Yes.

But the real magic is how receptive the core analysis of the decompiler is to our own extensions. The results are stunning.

7 Days to Lift: A Mission in Microcode: https://t.co/JmRncfhHA8

[idatips @idatips]

This is a useful thread!

[_ZN4DionC1Ev @justdionysus]

Oh no, @GalenRTFSL just told me his trick of naming Hexrays variables “useful_name:v1” so you could click-highlight “useful_name” and see all the usage across the function is broken in the latest release. Boooooo!

[Layle @layle_ctf]

I'm happy to announce the first public release of IDACode! Execute and debug all your IDA scripts from VS Code :)

You can find the extension on the VS Code marketplace and the IDA plugin in the repository along with some information:

https://t.co/OuzWpJp1df

[Assaf Carlsbad @assaf_carlsbad]

In case Hex-Rays output seems way too partial, try annotating one the variables with the 'volatile' keyword, then decompile again. Chances are the decompiler went overly aggressive and eliminated the memory reference altogether 🙃

See https://t.co/Wa0xpTt41p for the full details

[idatips @idatips]

Everyone has mashed escape to find that one function they forgot to bookmark, but did you know you can go forward too? Try it with Control + Enter!

#idatips

[mav @MavLevin]

-Reversing Tip 28/30-
IDA auto-analysis missed a function arg because it was passed in an “unexpected” register?
Use the “__usercall” call convention with “@<register_name>” to declare args & their location:
#BinReversingTips #idaTips

[mav @MavLevin]

-Reversing Tip 25/30-
Get the best from both IDA’s decompiler & disassembler by overlaying the C code on the ASM in graph view (by clicking the “/” key)
#BinReversingTips

[cts🌸 @gf_256]

IDA pro tip: For custom calling convention, many people know __usercall (args / retval). But did you know __spoils for preserved and volatile registers?
https://t.co/ZC5nK8d5HX

[Naim A. @naim94a]

#idatips Ever get a pointer to the middle of a struct?

Just add the __shifted keyword to the variable's type definition!

[Chris Eagle @sk3wl]

Friday night tweetin' https://t.co/jawXi8Bvam for those that want their Ida and their Ghidra too. Chock full o' bugs no doubt.

[Proteas @ProteasWang]

#idatips how to disable arm macro instruction? Options>General…>Analysis>Kernel option3>Enable macro, uncheck it.

[idatips @idatips]

@AmarSaar @mattifestation @duzvik @aionescu Clearly a golden opportunity for you to start @x64tips!

[REhints @REhints]

New IDA 7.4 and Decompilers released!
Changelog:
- IdaPython move to Python 3
- New Local Types editor
- Improved GDB support (iOS 13)
- Multiple improvements in decompiler engine
- Global xrefs directly in pseudocode

https://t.co/xLHR8kt359

https://t.co/WgpQgmfKy9
#REhints

[Tamir Bahar @tmr232]

Remember that you can trigger actions in IDA's UI using

idaapi.process_ui_action(action_name)

(get the name from the shortcuts window)

https://t.co/crRcseUR4G
#idapython #idatips @idatips

[idatips @idatips]

@lichtlos Who needs a whole repo when @jinmo123’s vscode dark exists?

(No, I don’t know of any. Maybe @athre0z wants to turns IDASkins into that now that it’s deprecated? It’s the largest single collection of themes I know. Or maybe https://t.co/w8N3R4tMsf would be a good home?)

[idatips @idatips]

@RolfRolles @0xAlexei @basalberts I think: select the variable in the hexrays output and hit T. When you have only a variable highlighted a new context menu entry shows up with that title and shortcut.

[idatips @idatips]

Tired of decimal supremacy? Depressed that you recognize -2147483648? Try changing the default radix in hexrays!

- change DEFAULT_RADIX in your hexrays.cfg to 16

More info: https://t.co/snF9vCquBH

Thanks to @angel_killah for this tip!

#idatips

[idatips @idatips]

One thing to note here: by default IDA assumes your theme is a light theme and places the resulting user.css in %IDAUSR%/themes/default. If you have a dark theme, you'll need to move it to %IDAUSR%/themes/dark/user.css

[idatips @idatips]

Married to an old .clr color theme? Can't work unless your colours are just right?

- In <=IDA7.2, load a .clr and run idaapi.reg_write_int('PortedToCss', 0), then open a file in IDA7.3 to convert
- Or run: https://t.co/IheNIlgBqm

More info: https://t.co/H9cm6Hoawi

#idatips