Keep this in mind, as it will be very important. The type of op (ctype_t) is an enumeration where all constants are named either cit_ (for statements) or cot_ (for expressions). Therefore, all nodes in the ctree will have the op property, which indicates the node type (variable, number, logical expression, etc.). We will define these in a moment, but for now it is important to know that both derive from a very basic type, namely the citem_t type, as seen in the following code snippet: The nodes of this tree are either of type cinsn_t or cexpr_t.

Now we know that Hex-Rays’s ctree is a tree-like data structure. From the given assembly code, it works back to produce an AST, and from this to produce pseudocode.įrom all the intermediate steps between code and assembly, we are stressing the AST so much because most of the time you will spend using the Hex-Rays API, you will actually be reading and/or modifying the Abstract Syntax Tree (or ctree in Hex-Rays terminology). From the AST, the compiler will produce assembly code for the specified platform.Ī decompiler takes the opposite route. In this phase of the compilation process, referred to as parsing, the code structure is represented as a complex object, the AST. In essence, a compiler takes the source code, splits it into tokens according to a grammar, then these tokens are grouped into logical expressions. In order to understand how the decompiler works, it’s helpful to first review the normal compilation process.Ĭompilation and decompilation center around the concept of an Abstract Syntax Tree (AST). In this blog, we aim to close that gap by showcasing examples where scripting Hex-Rays goes a long way. However, there seems to be a lack of a concise and complete resources regarding this topic (tutorials or otherwise). The decompiler (from now on referred to as Hex-Rays) has been around for a long time and has achieved a good level of maturity. The ability to switch between disassembled and decompiled code can greatly reduce the analysis time. Besides being a great disassembler and debugger, it is possible to extend it and include a powerful decompiler by purchasing an additional license from Hex-Rays. IDA Pro is the de facto standard when it comes to binary reverse engineering.

Hexrays