It’s ridiculously trivial, but it’s always the little things.Īlso, interestingly, when you google hex圆4.dll or hex圆4.p64 you only get a few hits. The 64-bit decompiler’s plugin name is not hexrays, it’s not hexrays64 either. Until you run it with the 64-bit idaw64.exe:Ĭ:\Ida\idaw64.exe -A -Ohexrays:-new:%%k.c:ALL “%%k” c file – more or less like the below (I am omitting the loop):Ĭ:\Ida\idaw.exe -A -Ohexrays:-new:%%k.c:ALL “%%k” The way it works is very simple – for every in a folder, run IDA in its automation/batch mode mode, decompile the, and finally save it in a. This was the case with my old batch decompilation script. are replaced by the new type automatically.If you are very used to 32-bit IDA you may sometimes find yourself in a blind alley when you try to port your working solution to IDA 64-bit. This is indicated by the arrow sign pointing to the new type’s definition.Īll uses of the old type in the function prototypes, local variable types etc. To map a type to another, open the Local Types window ( Shift– F1), and choose “Map to another type…” from the context menu on the type you want to map.Īfter choosing the type to replace it, the original type is deleted and all references to it are redirected to the new one. Of course, you can go and replace all references to the “wrong” one manually, which is doable if you discover this early, but if you already have hundreds of functions or other types referring to it, the process can become tedious. Or, after analyzing two different functions, you only find out later that two structures are, in fact, one and the same. For example, you find out that the “custom” structure you’ve been building up is actually a well-known type and you found the correct definition in debug info or header files. However, it may happen that eventually you discover duplicates.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |