New hexrays features:
1) use "Reset pointer type" on all variables that you want to scan.
2) Select one of these variables and choose "Scan variable (S)" Plugin deals with simple assignments "v1 = this;" automatically.
3) Again right click on such variable and choose open structure builder. Ajdust the structure to your likings.
In Structure builder you can open a list of functions you scanned so far and functions that were added from virtual function tables.
Open some of the functions and scan other variables that are of the same type. Be carefull there is no undo yet.
As you gather more evidence structure builder will show you guessed substructure sizes and guessed types.
Colliding types have yellow background. Use delete to solve the ambiguity.
With red colour is marked current master offset into structure being created.
Use "*" to change master offset. But you should not need this too often, because basic situations are detected automatically.
This deals with nested structures:
struct aa { int foo; }
struct bb { int foo; }
struct cc { aa a; bb b; }
void foo(struct *b) { b->foo=4;//while scanning b you should have master offset set to 4 }
void bar(struct *cc) { c->a.foo=5; foo(&c->b); }
use "+" and "-" on numeric keyboard to shift parts of the structure. Then use "pack substruct" to build substructures before finishing the structure.
4) Click on some variable in pseudocode and choose "finalize structure" You will be given a window with "C" declaration of the new structure that you can tweak by hand and then the new type will by assigned to all variables you have scanned.
Job done!
A class is any structure (A) that has as a pointer into another structure (A_VT). Where A_VT has a STRUCT comment containing address of the virtual table and "@0x".
Right clicking on any number in hexrays view. There are two new items in the menu: Which structs have this offset? Which structs have this size?
This will give you list of structures having exact size or this offset (even in substructures);
Imagine there are structures like this: 00000000 ; --------------------------------------------------------------------------- 00000000 one struc ; (sizeof=0x8, standard type) 00000000 vfptr dd ? ; offset 00000004 x dd ? 00000008 one ends 00000000 ; --------------------------------------------------------------------------- 00000000 two struc ; (sizeof=0x8) ; XREF: threer threer 00000000 baseclass_0 one ? 00000008 two ends 00000008 00000000 ; --------------------------------------------------------------------------- 00000000 two struc ; (sizeof=0x8) ; XREF: threer threer 00000000 baseclass_0 one ? 00000008 two ends 00000000 ; --------------------------------------------------------------------------- 00000000 00000000 three struc ; (sizeof=0x70) ; XREF: four::four(void)+29r 00000000 ; four::four(void)+2Ar ... 00000000 baseclass_0 two ? 00000008 a one ? 00000010 b two ? 00000018 c dd 20 dup(?) 00000068 d dd ? 0000006C e dd ? 00000070 three ends 00000070 00000000 ; --------------------------------------------------------------------------- 00000000 00000000 four struc ; (sizeof=0xCC) ; XREF: four::four(void)+3Cr 00000000 ; four::four(void)+43r ... 00000000 baseclass_0 three ? 00000070 a dd ? 00000074 b dd ? 00000078 c dd 20 dup(?) 000000C8 d dd ? 000000CC four ends
And you come across a code like this:
void __thiscall four::four(int this) { int v1; // esi@1
v1 = this;
(_DWORD )(this + 4) = 5;
(_DWORD )(this + 12) = 5;
(_DWORD )(this + 8) = &one::vftable'; *(_DWORD *)(this + 20) = 5; *(_DWORD *)(this + 16) = &two::vftable';
(_DWORD )(this + 104) = 0;
(_DWORD )(this + 108) = 0;
memset((void )(this + 24), 32, 0x50u);
(_DWORD )v1 = &four::`vftable';
(_DWORD )(v1 + 112) = 0;
(_DWORD )(v1 + 116) = 0;
(_DWORD )(v1 + 200) = 0;
memset((void )(v1 + 120), 33, 0x50u);
}
Right click on either "v1" or "this" and choose "recognize shape (T)". The plugin will show you that the only structure that matches this shape is "four".
See virtual_calls_4.idb.
Once I dealt with project that mixed Delphi and Visual C++. These two uses different registers for thiscall/fastcall etc so changing compiler resulted in ruining analysis. So I made this functionality to deal with it forever.
Just right click on first line of pseudocode and choose "Convert to __usercall".
Sometimes function does not return any value but hex-rays thinks it does. It was very tiresome to type "home, y, home, ctrl-shift-left, "void", enter" so I made Ida do it on one click.
Just right click on first line of pseudocode and choose "Remove return type" or type 'R'.
menu View / Open Subviews / Classes
Now just list of "interesting" structures inside database along with their functions.
Sometimes in pseudocode there is variable that gets assigned zero and is never changed. This feature propagates this zero to all places where this variable was.
The rules are:
""" zeroizer.cpp variable is assigned zero variable is never referenced warn if variable is on stack
replace every such variable with zero"""
Works automatically.
see test2_negative_offsets.idb @004010B0
Without my plugin: void __cdecl test3(pokusx p) { (_DWORD *)&p[-1].array[19996] = 124; p[-1].k = 666; }
With my plugin: void __cdecl test3(pokusx *p) { container_of(p, 8)->a = 124; container_of(p, 8)->cc = 666; }
Sometimes hexrays thinks that a register is used as an argument for a function but it isn't so. It was also tiresome to type "home, home, y, ctrl->right, ctrl-shift-right, delete, enter" So I made this to deal with it.
Just select that argument in the first line of pseudocode and choose "Remove this argument" or type 'A'.
Imagine you have pseudocode like this.
CASE 1: { type1 v1; type2 v2 v2 = (type2)v1; }
right click on "v2" in the last line and choose "recast item" v2 will be converted to type "type2";
CASE 2: you have type declarations:
struct object { struct vtable *v; }
struct vtable { int fnc1; int fnc2; }
and there is code like this in pseudocode:
struct object this; (void (__thiscall )(object *)this->v->fnc1)(this);
righ clicking on fnc1 and choosing "Recast item" will change type of "vtable.fnc1" to "void (__thiscall )(object )".
Now suppose there is virtual table for object at address 0xABCDEF.
Setting STRUCT comment for "struct vtable" as something containing "@0xABCDEF" (crucial part is "@0x" ) enables my plugin to navigate to functions located at 0xABCDEF.
But setting this by hand is seldom needed because structure builder takes care of this automatically.
Also there is experimental code for dealing with delphi classes. In menu Edit / Structs / Create Delphi class.
The cursor must be on first line of delphi class in ida-view before using this functionality.
warning: This feature is highly experimental.
Use right click in Structures view.
Select few lines in a structure and it will create a new structure off selected lines.
Does the opposite of Extract object. It in place unpacks selected structure.
It will try to guess which structure has the right offsets and types that can matche selected lines in Structures view.
Promotes a structure to a class.
Adds virtual table to a structure. It asks for address to a virtual table. Then this happens:
00000000 struc_1 struc ; (sizeof=0x10) 00000000 field_0 dd ? 00000004 field_4 dd ? 00000008 field_8 dd ? 0000000C field_C dd ? 00000010 struc_1 ends
--->
00000000 struc_1 struc ; (sizeof=0x10) 00000000 VT dd ? ; offset 00000004 field_4 dd ? 00000008 field_8 dd ? 0000000C field_C dd ? 00000010 struc_1 ends 00000010 00000000 ; --------------------------------------------------------------------------- 00000000 00000000 ; @0x004047B0 00000000 struc_1_VT struc ; (sizeof=0x10) 00000000 sub_40101E dd ? ; sub_40101E 00000004 j_RTCNumErrors dd ? ; jRTC_NumErrors 00000008 sub_401023 dd ? ; sub_401023 0000000C sub_401073 dd ? ; sub_401073 00000010 struc_1_VT ends
the type of "struc_1.VT" is "struc_1_VT*"
When asked for vtableaddress I gave it 0x004047B0.
This enables jumps in hexrays to virtual function.
I messed up my idb database and this was a cure:
static void reset_alt_calls(ea_t ea)
{
static const char * nname;
if ( ph.id == PLFM_MIPS )
nname = "$ mips";
else if ( ph.id == PLFM_ARM )
nname = " $arm";
else
nname = "$ vmm functions";
netnode n(nname);
for(nodeidx_t idx= n.alt1st(); idx != BADNODE; idx = n.altnxt(idx))
{
if(n.altval(idx)-1 == ea)
{
n.altdel(idx);
noUsed(idx); // reanalyze the current instruction
recalc_spd(idx);
}
//n.altdel_all(atag);
}
}
Just calls "Which structure has size num?".
structures_graph_0.png, see structures_graph.png menu View/graphs/show structures graph
Milan Bohacek