1

I am trying to iterate all the C statement (could be very coarse-grained, it's fine) in IDA-Pro recovered assembly program.

Suppose I only consider these statements:

State :: =
  | if-else cond;
  | loop;
  | assignment;
  | function call
  | return
  | {s1; s2; s3 ...}

And after some quick search, I know that there are some (third-party) plugins that can help to identify some C control-flow structure, and I list some of them below:

if-else cond : N/A

loop : link1 link2 link3

So my questions are:

  1. Is there any plugins that can recover if/else statement? It looks easier than loop, but I just cannot find a well-developed way to recover the statement.

  2. Is there anyway/api/scripts to iterate C statements in IDA-Pro? Or I have to implement myself?

Ideally it should look like this as this is essentially used in source code analysis... (sorry for this pseudo code, I just want to clarify)

let aux s =
    match s with
    | If e1 b1 b2 -> analyze e1 b1 b2
    | Loop e1 e2 e3 b1 -> analyze e1 e2 e3 b1
    | Assign v1 v2 -> analyze v1 v2 
    | States sl -> List.iter analyze sl
    | ...  in
List.iter aux statement_list
...
Community
  • 1
lllllllllllll
  • 2,485
  • 2
  • 32
  • 50

1 Answers1

1
  1. Is there any plugins that can recover if/else statement? It looks easier than loop, but I just cannot find a well-developed way to recover the statement.

Yes, the Hex-Rays Decompiler recovers if/else statements.

  1. Is there anyway/api/scripts to iterate C statements in IDA-Pro? Or I have to implement myself?

Yes, the Hex-Rays SDK allows you to iterate the items (including if-else statements) in a decompilation tree.

Jason Geffner
  • 20,681
  • 1
  • 36
  • 75
  • 1
    A lot of functionality of HexRays SDK exists in IDAPython as a part of idaapi module in latest IDA versions (6.6 +). – w s Apr 06 '15 at 15:35
  • @ws, would you mind to give an example here? thank you – lllllllllllll Apr 06 '15 at 18:36
  • The only thing I can give is a IDAPython samples at google code: https://code.google.com/p/idapython/source/browse/#svn%2Ftrunk%2Fexamples%253Fstate%253Dclosed Desired code is in python files starting with vds – w s Apr 06 '15 at 19:46