Short answer: No, there is no other interactive decompiler, at least not for native codes. Long answer: The Hex-Rays decompiler was created with the idea of interactiveness while all the other decompilers for native code that I know (I'm not talking about Java or.NET) were created as batch tools.
The Hex-Rays Decompiler plugin for better code navigation in RE process. CodeXplorer automates code REconstruction of C++ applications or modern malware like Stuxnet, Flame, Equation, Animal Farm ...
Zhengbo Hu
The CodeXplorer plugin is one of the first publicly available Hex-Rays Decompiler plugins. We keep updated this project since summer of 2013 and continue contributing new features frequently. Also most interesting feutures of CodeXplorer have been presented on numerous security conferences like: REcon, ZeroNights, H2HC, NSEC and BHUS
Contributors:
Alex Matrosov (@matrosov)
Eugene Rodionov (@rodionov)
Rodrigo Branco (@rrbranco)
Gabriel Barbosa (@gabrielnb)
Supported versions of Hex-Rays products: everytime we focus on last versions of IDA and Decompiler because trying to use new interesting features in new SDK releases. It's also mean we tested just on last versions of Hex-Rays products and not guaranteed stable work on previous ones.
Why not IdaPython: all code developed on C/C++ because it's more stable way to support complex plugin for Hex-Rays Decompiler.
Supported Platforms: x86/x64 for Win, Linux and Mac.
HexRaysCodeXplorer - Hex-Rays Decompiler plugin for easier code navigation. Right-click context menu in the Pseudocode window shows CodeXplorer plugin commands:
- Automatic type REconstruction for C++ objects. To be able to reconstruct a type using HexRaysCodeXplorer one needs to select the variable holding pointer to the instance of position independed code or to an object and by right-button mouse click select from the context menu «REconstruct Type» option:
The reconstructed structure is displayed in “Output window”. Detailed information about type Reconstruction feature is provided in the blog post “Type REconstruction in HexRaysCodeXplorer”.
Also CodeXplorer plugin supports auto REconstruction type into IDA local types storage.
- Virtual function table identification - automatically identifies references to virtual function tables during type reconstruction. When a reference to a virtual function table is identified the plugin generates a corresponding C-structure. As shown below during reconstructing
struct_local_data_storage
two virtual function tables were identified and, as a result, two corresponding structures were generated:struct_local_data_storage_VTABLE_0
andstruct_local_data_storage_VTABLE_4
.
- C-tree graph visualization – a special tree-like structure representing a decompiled routine in citem_t terms (hexrays.hpp). Useful feature for understanding how the decompiler works. The highlighted graph node corresponds to the current cursor position in the HexRays Pseudocode window:
- Ctree Item View – show ctree representation for highlighted element:
- Extract Ctrees to File – dump calculate SHA1 hash and dump all ctrees to file.
Extract Types to File – dump all types information (include reconstructed types) into file.
Navigation through virtual function calls in HexRays Pseudocode window. After representing C++ objects by C-structures this feature make possible navigation by mouse clicking to the virtual function calls as structure fields:
- Jump to Disasm - small feature for navigate to assembly code into 'IDA View window' from current Pseudocode line position. It is help to find a place in assembly code associated with decompiled line.
- Object Explorer – useful interface for navigation through virtual tables (VTBL) structures. Object Explorer outputs VTBL information into IDA custom view window. The output window is shown by choosing «Object Explorer» option in right-button mouse click context menu:
Object Explorer supports following features:
Auto structures generation for VTBL into IDA local types
Navigation in virtual table list and jump to VTBL address into 'IDA View' window by click
Show hints for current position in virtual table list
Shows cross-references list by click into menu on 'Show XREFS to VTBL'
- Support auto parsing RTTI objects:
The Batch mode contains following features:
- Batch mode - useful feature to use CodeXplorer for processing multiple files without any interaction from user. We add this feature after Black Hat research in 2015 for processing 2 millions samples.
Compiling:
Windows:
- Open the solution in Visual Studio
- Open file
src/HexRaysCodeXplorer/PropertySheet.props
in notepad(++) and update values ofIDADIR
andIDASDK
paths to point to IDA installation path and IDA7 SDK path accordingly. HexRays SDK should be in$IDADIRpluginshexrays_sdk
(like by default) - Build
Release x64
andRelease x64 x64
configurations
Linux:
- cd src/HexRaysCodeXplorer/
- IDA_DIR=<PATH_TO_IDA> IDA_SDK=<PATH_TO_IDA_SDK> EA64=0 make -f makefile.lnx
- IDA_DIR=<PATH_TO_IDA> IDA_SDK=<PATH_TO_IDA_SDK> EA64=0 make -f makefile.lnx
Mac:
- cd src/HexRaysCodeXplorer/
- IDA_DIR=<PATH_TO_IDA> IDA_SDK=<PATH_TO_IDA_SDK> make -f makefile.mac
- The Mac makefile might need some hand editing, pull requests welcome!
- IDA 7.0
.pmc
file extension should be.dylib
- bash$
export IDA_DIR='/Applications/IDA Pro 7.0/ida.app/Contents/MacOS' && export IDA_SDK='/Applications/IDA Pro 7.0/ida.app/Contents/MacOS/idasdk' && make -f makefile7.mac
- Or open project in Xcode
HexRaysCodeXplorer.xcodeproj
Conference talks about CodeXplorer plugin:
- 2015
- 'Distributing the REconstruction of High-Level IR for Large Scale Malware Analysis', BHUS [slides]
- 'Object Oriented Code RE with HexraysCodeXplorer', NSEC [slides]
- 2014
- 'HexRaysCodeXplorer: object oriented RE for fun and profit', H2HC [slides]
- 2013
- 'HexRaysCodeXplorer: make object-oriented RE easier', ZeroNights [slides]
- 'Reconstructing Gapz: Position-Independent Code Analysis Problem', REcon [slides]
Navigation
Menu
- Software
- Security
- Office
- Internet and communication
- Multimedia
- Tools
- Programming
- Operating systems
- Graphics
- Business
- Extras
- Mobile devices support
- Education and science
- Home Software
- Drivers
- Video Cards
- Sound Cards
- Modems
- System
- Input Devices
- Printers
- Notebook
- Scanners
- Mainboards
- Network interface cards
- Tablets
- Webcams
- TV tuners
- Games
- Demos
- Updates and Patches
- Freeware
- Trailers
- Mods
- Tools
- Smartphones and Tablets
- Apps
Top downloads
Last week
- 1.5986 Gigabyte GA-990FXA-UD3(rev....
- 2.1633 Seven Transformation Pack
- 3.241 Intel Graphics Driver
- 4.223 Avira Free Antivirus
- 5.185 Microsoft Visual C++...
- 6.184 Realtek HD Audio Codecs Driver
- 7.176 Adobe Flash Player
- 8.166 Microsoft .NET Framework
- 9.141 CDisplay Comic Reader
- 10.116 Android Reverse Tethering
Recently in Q&A
News
How to Add Rotten Tomatoes Ratings to Amazon Prime.
13.09.2019
A short tutorial showing you how to add Rotten Tomatoes ratings to Amazon Prime videos. If you’ve done the same with Netflix but can’t figure out how for Amazon Prime, this guide has all the information you need.
How to Get Dark Mode For WhatsApp on Windows 10. (WhatsApp Dark Mode Windows Client)
11.09.2019
A short tutorial showing you how to enable dark mode ‘aka’ night mode on WhatsApp for Windows 10. A really easy way to get a dark theme for the Windows 10 WhatsApp client. If you have gradually been converting your operating system and other programs and apps, this is another great addition.
How to Fix Calculator Not Working On Windows 10. (Windows 10 Calculator Broken)
09.09.2019
A short tutorial showing you how to fix the calculator on Windows 10 not working or working incorrectly. A strange Windows 10 calculator problem that can thankfully be fixed using a range of different troubleshooting steps.
How to Turn Off or Change Content Blocking For Specific Websites on Firefox Version 69 and Newer.
07.09.2019
A short tutorial showing you how to customise Firefox 69’s new content blocking settings. By default Firefox now has Content Blocking enabled by default which may prevent some websites from working correctly. As a result, you may wish to white list websites you visit frequently.
How to Fix Corsair VOID PRO WIRELESS Not Working After Updating ICUE to 3.19.120. (Corsair Wireless Headset Not Working After Update)
05.09.2019
A short tutorial showing you how to fix the issue causing Corsair Void Pro Wireless headsets to stop working on Windows 10. An issue that has recently occurred within Corsair ICUE version 3.19.120. You may also find that your device is connected properly but simply won't play sound.
Most popular news
How to Request or Create Your Year in Review Video on Facebook #Yearinreview2016
08.12.2016
It’s the end of the year again and Facebook has released its year in review video. If you have seen them online but can’t figure out how to get yours. We’ll show you how. #yearinreview2016
Internet Explorer 8 Incompatible with Yahoo Mail And Gmail
25.05.2008
Microsoft recently released a beta version of Internet Explorer 8 and, since we're talking about one of the most popular browsers on the web, lots of people downloaded, installed and tested it. However, some of them may encounter unexpected ...
DirectX 11 belongs to Windows 7?
12.07.2008
As Windows 7, codenamed Vienna is an improved version of Vista, DirectX 11 will work on both systems. It looks that DirectX 11 will launch before Windows 7 and we have high hopes of seeing DirectX 11 by the end of 2009. DX11 is based on ...
Diablo 3 announced
30.06.2008
Announced at the Blizzard Worldwide Invitational in Paris, France, Diablo 3 is the third installment in the massive action-RPG (i.e Hack and Slash) series. The announcement was given by lead designer Jay Wilson, who outlined some key features ...
Red Alert 3 not coming to PS3
30.07.2008
EA announced they've currently got no plans to release a PS3 version of Command & Conquer: Red Alert 3. Apparently, the console is 'very exotic and tough to develop for,' and their game engine is simply not suited for PS3. The game was ...
Articles
The Elder Scrolls: Legends. (Free to play)
The Elder Scrolls: Legends. Download for Free below...
Argo a Free First Person Shooter Game. (FPS)
Argo a Free first person shooter available for download below...