Home

Awesome

+22: x64 binary → x86 Hex-Rays

Plus22 transforms x86_64 executables to be processed with 32-bit version of Hex-Rays Decompiler.

This tool was created in mid-2013 for internal use in More Smoked Leet Chicken, and made public in November 2014 when Hex-Rays x64 finally came out.

Usage

php plus22.php [-va] {x64_binary.bin or listing.asm}

  If file name ends with '.asm', it will be interpreted as an ASM listing.
  Otherwise, it will be interpreted as x64 ELF/PE, and disassembled with IDA.

  -v    be verbose and leave all temporary files
  -a    AutoNop all lines with errors

You can use _misc\php.exe to run the script.

Plus22 is designed to run in Windows environment, and works well under Wine.

Specifying your IDA path

To decompile and restore types automatically, Plus22 needs to know where IDA is installed. You can add your path to $idaPaths array right at the top of script, or have it done for you automatically when Plus22 needs your IDA installation path.

Without specifying IDA path, you can do the following by hand:

  1. Load binary in IDA64
  2. View → Unhide all (uncollapse functions)
  3. File → Produce file → Create ASM file
  4. php plus22.php mega_binary.asm
  5. If you're lucky, .obj is created.
  6. Load .obj in IDA
  7. File → Script file... — execute mega_binary+22.idc for correct function types

Files

Changelog

v0.3

v0.2.3

v0.2.2

v0.2.1

v0.2

v0.1.1

v0.1