Skip to content

Instantly share code, notes, and snippets.

@a0rtega
Last active June 7, 2024 15:38
Show Gist options
  • Save a0rtega/4df47deb16d8f28402cfc80d638dc9a7 to your computer and use it in GitHub Desktop.
Save a0rtega/4df47deb16d8f28402cfc80d638dc9a7 to your computer and use it in GitHub Desktop.
IDA plugin to decompile all functions at once to cache the result and avoid IDA's on-the-fly decompilation
# Installation: Copy hexrays_allthethings.py to the plugins/ directory of IDA, restart IDA
# Usage: Edit->Plugins->"Run Hex-Rays decompiler on all functions" or use Ctrl+9
# Tested in IDA 7.6, Python 3
# https://github.com/a0rtega
import ida_kernwin, ida_idaapi, ida_auto
import tempfile, os
class HexRaysAllTheThingsPlugin(ida_idaapi.plugin_t):
flags = ida_idaapi.PLUGIN_KEEP
comment = "Decompile all functions at once to cache the result and avoid IDA's on-the-fly decompilation"
help = "Decompile all functions at once to cache the result and avoid IDA's on-the-fly decompilation"
wanted_name = "Run Hex-Rays decompiler on all functions"
wanted_hotkey = "Ctrl+9"
def init(self):
return ida_idaapi.PLUGIN_KEEP
def run(self, arg):
# Check ida_hexrays availability
try:
import ida_hexrays
if not (ida_hexrays.init_hexrays_plugin()):
raise Exception("ERROMG")
except:
ida_kernwin.warning("Hex-Rays is required to run this plugin")
return
confirm = ida_kernwin.ask_yn(0,
"Do you want to decompile all the functions? This operation may take some time and will grow your IDB size.")
if (confirm == ida_kernwin.ASKBTN_YES):
ida_auto.auto_wait() # Wait for the initial autoanalysis to complete in case it's still running
ida_hexrays.clear_cached_cfuncs()
output_file = os.path.join(tempfile.gettempdir(), "HexRaysAllTheThingsPlugin.tmp")
ida_hexrays.decompile_many(output_file, None,
ida_hexrays.VDRUN_NEWFILE | ida_hexrays.VDRUN_MAYSTOP | ida_hexrays.VDRUN_SILENT)
os.remove(output_file)
def term(self):
return
def PLUGIN_ENTRY():
return HexRaysAllTheThingsPlugin()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment