0

While I was reversing a binary I noticed that IDA Pro had adjusted the pseudocode that initially was generated. This happened after I started reversing the binary and renamed functions and variables to more appropriate names. IDA Pro had then "prettified" or re-analyzed the pseudocode somehow.

I am not sure what keys I pressed or options I clicked to achieve this, but it was extremely useful.

How can I replicate this?

0xC0000022L
  • 10,908
  • 9
  • 41
  • 79
Nicolai Prebensen
  • 125
  • 6
  • Hi and welcome to RE.SE. Please be more specific. Also, since you mentioned pseudo-code (which IDA does not generate), I replaced [tag:ida] by [tag:hexrays]. The latter is the plugin for IDA providing decompilation (and generating pseudo-code). – 0xC0000022L Feb 28 '20 at 07:54

2 Answers2

3

While in the pseudocode view pressing F5 will re-decompile the current function.

Avery3R
  • 1,258
  • 1
  • 12
  • 31
0

Coming back to answer this question with the actual answer I was looking for now that I have some more experience and figured out what happened.

When opening a binary in IDA Pro that has the Hex-Rays decompiler plugin you may open the pseudocode view using the hotkey F5, and also re-analyze the current function by pressing F5 again as @Avery3R posted in his answer.

However, if you work your way through the binary by double-clicking functions you can go back to one of the functions you already have decompiled and re-analyze it. The pseudocode will then change to reflect the changes you have done (or simply the optimizations done by the Hex-Rays decompiler). Typical changes you will see are the number of function arguments that will be adjusted to be more correct.

Usually what I do if I encounter pseudocode that seems incorrect in terms of function arguments, I will click around and "peek" into the different problematic functions before I go back to the initial function I started with and re-analyze it. The pseudocode will then look way better and be easier to work with.

And if you would like to re-analyze the whole binary you coud always do that by going to Options -> General -> Analysis -> Reanalyze program, and Ctrl+F5 to decompile all functions.

Nicolai Prebensen
  • 125
  • 6