mizari / herast

Framework to automate working with AST in IDA Pro

herast

Rewritten for IDAPython3 (IDA_VERSION >= 7.4) version of @groke's HRAST. Contains more features, more convenient and richer language for AST patterns and its handling, simple GUI for easier management and expanding over time repository with ready AST patterns (PRs are welcome!).

What it does

Herast helps with finding AST subtrees and with following work with found items. Herast provides its API via herapi module and via GUI view via Shift-M hotkey. Herast is designed for easy expandability, simple reusage and for fast scripting.

Installation

$IDAUSR is "%APPDATA%/Hex-Rays/IDA Pro" on windows and "$HOME/.idapro" on linux and mac

• Place herast/ to $IDAUSR/python/3/ directory
• Place herapi.py to $IDAUSR/python/3/ directory
• Place herast.py to $IDAUSR/plugins directory

Use already written AST handlers

Add this folder for IDB in Schemes Storages View (Shift-M) or globally via herapi.add_storage_folder(folder_name, global_settings=True). Then enable needed storages and see the results applied to pseudocode.

Couple examples:
collapse_exception_branch replaces

into

propagate_error replaces

into

Create your own AST handlers

• Write patterns that describe parts of AST
• Write schemes that describe handling of found patterns
• Either export schemes to passive matcher (herapi.register_storage_scheme), that will later automatically apply them on the fly and modify every decompilation output (see examples) OR
• Use them as scripts with the help of Matcher (see examples)

herast's Issues

SeqPat doesn't work

start_from = container.index(instructions) in check(...) always None.

Detecting areas with dead code.

Would it be possible to use this to ID where there's dead code?
Sometimes it's useful to know what the decompiler omits.
like for example i had

*pDstT = iDu;
v5 = pDstT + 1;
*v5 = iDv;
pDstT = v5 + 1;

which was actually

format = D3DFMT_V8U8;
switch ( format )
{
    case D3DFMT_V8U8:
        *pDstT = iDu;
        v5 = pDstT + 1;
        *v5 = iDv;
        pDstT = v5 + 1;
        break;
    case D3DFMT_L6V5U5:
        *(_WORD *)pDstT = (iDu >> 3) & 0x1F;
        *(_WORD *)pDstT |= 0x20 * ((iDv >> 3) & 0x1F);
        *(_WORD *)pDstT |= (((signed int)uL >> 2) & 0x3F) << 0xA;
        pDstT += 2;
        break;
    case D3DFMT_X8L8V8U8:
        *pDstT = iDu;
        v6 = pDstT + 1;
        *v6++ = iDv;
        *v6++ = uL;
        *v6 = 0;
        pDstT = v6 + 1;
        break;
}

being able to tell that there was something missing here vs the asm automatically would be extremely useful
Finding out it was a switch in this case lead me to finding the original source code which turned out to be from DirectX SDK.
Likewise a similar case would be a
var = 0;
if(var) {}
where the decompiler would omit code.

as we can delete some of patterns (if files was changed on system), we can still point to valid index, but it would be wrong object

https://github.com/mostobriv/herast/blob/main/views/patterns_manager_view.py#L131

IfPat condition is wrapped in a block

Hi,

It seems like IfPat wraps the condition pattern with BlockPat. That got me a little confused - aren't conditions always expressions?

as we can delete some of patterns (if files was changed on system), we can still point to valid index, but it would be wrong object

https://github.com/mostobriv/herast/blob/main/views/patterns_manager_view.py#L111