User Manual

(the manual describes build 080215)

Interactive operation

The decompiler adds the following commands to the menus:

Note: interactive operation is not supported in the text version of IDA.

View, Open subviews, Pseudocode (hotkey F5)

This command decompiles the current function. If the decompilation is successful, it opens a new window titled "Pseudocode" and places the generated C text in this window.

You can use these commands in the pseudocode window: If the current item is a local variable, additional items may appear in the context menu:

You can also select text and copy it to the clipboard with the Ctrl-C combination.

Pressing Enter on a function name will decompile it. Pressing Esc will return to the previously decompiled function. If there is none, the pseudocode window will be closed.

Ctrl-Enter or Ctrl-double clicking on a function name will open a new pseudocode window for it.

Pressing F5 while staying in a pseudocode window will refresh its constants. Please note that the decompiler never refreshes pseudocode by itself because it can take really long.

You can use the mouse right click or keyboard hotkeys to access the commands. Please check the command descriptions for the details.

Jump, Jump to pseudocode (hotkey Tab)

This command toggles between the disassembly view and pseudocode view. If there is no pseudocode window, a new window will be created.

Pressing Tab while staying in the pseudocode window will switch to the disassembly window. The Tab key can be used to toggle pseudocode and disassembly views.

See above the Open pseudocode command for more details.

File, Produce file, Create C file (hotkey Ctrl-F5)

This command decompiles the selected functions or the whole application. It will ask for the name of the output .c file.

If there is a selected area in the disassembly view, only the selected functions will be decompiled. Otherwise, the whole application will be decompiled.

When the whole application is decompiled, the following rules apply:
  • the order of decompilation is determined by the decompiler. It will start with the leaf functions and will proceed in the postnumbering order in the call graph. This order makes sure that when we decompile a function, we will have all information about the called functions. Obviously, for recursive functions some information will be still missing.
  • the library (light blue) functions will not be decompiled. By the way, this is a handy feature to exclude functions from the output.
  • A decompilation failure will not stop the analysis but the internal errors will. The decompiler generates #error directives for failed functions.

Edit, Comments, Add pseudocode comments

This command decompiles the current function and copies the pseudocode to the disassembly listing in the form of anterior comments. If the current function already has a pseudocode window, its contents are used instead of decompiling the function anew.

This menu item performs exactly the same actions as the Copy to assembly command.

Edit, Comments, Delete pseudocode comments

This command deletes all anterior comments created by the previous command. Its name is a slight misnomer because it does not verify the comment origin. In fact, all anterior comments within the current function are deleted.

Edit, Other, Toggle skippable instructions

This command marks/unmarks instructions to be skipped by the decompiler. It is useful if some prolog/epilog instructions were missed by IDA Pro. If such instructions were not detected and marked, the decompilation may fail (most frequently the call analysis will fail).

The decompiler skips the prolog, epilog, and switch instructions. It relies on IDA Pro to mark these instructions. Sometimes IDA fails to mark them, and this command can be used to correct the situation.

If the command is applied to marked instructions, it will unmark them.

By default, the skipped instructions are not visualized. To make them visible, edit the IDA.CFG file and uncomment the following lines: 
PC_PROLOG_COLOR = 0xE0E0E0            // grey
PC_EPILOG_COLOR = 0xE0FFE0            // light green
PC_SWITCH_COLOR = 0xE0E0FF            // rose

Edit, Other, Reset decompiler type information

This command deletes decompiler type information about the current function.

Use this command if you inadvertently delete a type referenced by the decompiler function. Such a dangling reference makes decompilation impossible.

Help, Send database

This command packs and sends the current database to our server. You can specify your email and add notes about the error. This is the preferred way of filing bugreports because it is virtually impossible to do anything without a database. The database will also contain the internal state of the decompiler, which is necessary to reproduce the bug.

The database is sent in the compressed form to save the bandwidth. An encrypted connection (SSL) is used for the transfer.