Showing results for hex rays
Search instead for hexrays
๐ŸŒ
Hex-Rays
hex-rays.com
Hex-Rays: State-of-the-Art Binary Code Analysis Tools
Founded in 2005 by Ilfak Guilfanov, Hex-Rays is the force behind IDA, the industryโ€™s leading binary analysis tool.
IDA Pro State-of-the-art, binary code analysis tool
The Public Lumina server by Hex-Rays tracks metadata for functions, like names or operand types. Your IDA instance exchanges only hashes and metadata, avoiding sensitive byte patterns. To control your metadata, enable the Private Lumina add-on for a self-hosted server.
Pricing
If your perpetual license is in ... subscription to IDA 9! To start using IDA 9 today you can access the installer in the new customer portal at my.hex-rays.com....
IDA Free Lightweight IDA at no cost to evaluate basic features
Free disassembler and decompiler to learn reverse engineering. Core IDA features at no cost for students and non-commercial use. Download and start today.
Decompilers Easily readable pseudocode to enhance your binary analysis
- IDA Pro Ultimate comes with ALL available decompilers that all run locally (air gap). Whenever Hex-Rays releases a new decompiler, IDA Pro Ultimate users with an active subscription can automatically get access to the new decompiler.
๐ŸŒ
Wikipedia
en.wikipedia.org โ€บ wiki โ€บ Interactive_Disassembler
Interactive Disassembler - Wikipedia
November 14, 2025 - In 2005, Guilfanov founded Hex-Rays to pursue the development of the Hex-Rays Decompiler IDA extension.
๐ŸŒ
LinkedIn
be.linkedin.com โ€บ company โ€บ hex-rays-sa
Hex-Rays | LinkedIn
Fully independent from any governmental agencies and stock market pressures, Hex-rays is renowned for developing the state-of-the-art binary software analysis solutions used for reverse-engineering, hostile code analysis and vulnerability research.
๐ŸŒ
Hex-rays
hex-rays.co.il
Hex-Rays
Founded in 2005, privately held, Belgium based, Hex-Rays SA focuses on the development of robust binary analysis tools for the IT security market.
๐ŸŒ
Elastic
elastic.co โ€บ security-labs โ€บ introduction-to-hexrays-decompilation-internals
Introduction to Hex-Rays decompilation internals โ€” Elastic Security Labs
February 13, 2024 - Concluding our exploration into Hex-Rays microcode and CTree generation, we've gained practical techniques for navigating the complexities of malware obfuscation. The ability to modify Hex-Rays pseudo code allows us to cut through obfuscation like Control Flow Obfuscation, remove dead code, and many more.
๐ŸŒ
GitHub
github.com โ€บ HexRaysSA
Hex-Rays SA ยท GitHub
Hex-Rays - State of the art binary code analysis tools - Hex-Rays SA
๐ŸŒ
Reddit
reddit.com โ€บ r/cybersecurity โ€บ how good is the hex rays training? or the new sans 710?
r/cybersecurity on Reddit: How good is the Hex Rays training? Or the new SANS 710?
March 29, 2022 -

Looking up to improve my reversing skills for malware analysis, but I'm kind of at a dead end.
How do people get good at this? I read about some of the things FireEye FLARE team does and it blows me away. I can only get to about Challenge#4-5 on their Flare-On challenges
I'm eyeing on the Hex Rays training
https://hex-rays.com/training/
or the new SANS FOR710
https://www.sans.org/cyber-security-courses/reverse-engineering-malware-advanced-code-analysis/
idk how good these are but the GREM (FOR610) was very introductory.
Other than this, the only option seems to be to analyze lots of samples/challenges, gain experience, and just get gud.
FYI, I have the GREM cert and finished Practical Malware Analysis and most other related books.

๐ŸŒ
YouTube
youtube.com โ€บ watch
Introduction to the Hex-Rays Decompiler SDK - YouTube
This is a high-level introduction to the Hex-Rays decompiler. We cover various fundamental concepts and the two supported representations: Microcode and Ctre...
Published ย  December 25, 2023
Find elsewhere
๐ŸŒ
Solvusoft
solvusoft.com โ€บ en โ€บ file-extensions โ€บ software โ€บ hex-rays โ€บ hex-rays-ida
What Is Hex-Rays IDA? (from Hex-Rays)
This is a Windows, Mac OS X or Linux hosted multi-processor debugger and disassembler that provides a number of powerful features.
๐ŸŒ
X
x.com โ€บ hexrayssa
Hex-Rays SA (@HexRaysSA) / X
December 27, 2019 - We are a hi-tech company focusing on binary software analysis - IDA Pro and the Hex-Rays Decompiler.
๐ŸŒ
Vendr
vendr.com โ€บ buyer-guides โ€บ hex-rays
Hex-Rays Software Pricing & Plans 2025: Get the Lowest Price
Hex-Rays is a high-tech company specializing in binary software analysis. Their flagship products, IDA Pro and the Hex-Rays Decompiler, are widely recognized for their advanced capabilities in reverse engineering and debugging.
๐ŸŒ
YouTube
youtube.com โ€บ @HexRaysSA โ€บ videos
Hex-Rays - YouTube
---- Hex-Rays was founded in 2005 and is fully independent of any governmental agencies and stock market pressures. Hex-rays is renowned for developing state-of-the-art binary software analysis solutions used for reverse-engineering, hostile code ...
๐ŸŒ
E-SPIN Group
e-spincorp.com โ€บ category โ€บ brand โ€บ hex-rays
Hex-Rays Archives | E-SPIN Group
Hex-rays IDA Pro is a binary code analysis tool that empowers software analysts, reverse engineers, malware analyst and cybersecurity professionals. IDA pro is both a disassembler and debugger IDA Pro, as a disassembler, facilitates understanding a program when the source code is unavailable.
๐ŸŒ
SoftwareOne
platform.softwareone.com โ€บ vendor โ€บ hex-rays โ€บ VND-8794-0168
SoftwareOne Marketplace - Hex-Rays
Hex-Rays was founded in 2005 to improve digital security and face the rising cybersecurity threats that are increasingly affecting both public and private entities.
Top answer
1 of 2
4

The issue here is not strings, it's the fact that Hex-Rays didn't guess the right calling convention for sub_4022E0. Notice that the disassembly listing moves values into both ecx and edx before the call, whereas the decompilation for that call shows only one argument? Hex-Rays thinks there's only one argument -- maybe even only one stack argument -- whereas there are actually two register arguments and no stack arguments (i.e., 32-bit MSVC __fastcall).

The easy way to fix this would be to go into that function via the decompiler (put your cursor on sub_4022E0 and press enter), then after it decompiles, hit ESC to go back to the calling function and press F5 to re-decompile. This will probably cause Hex-Rays to guess the prototype properly, at which point it will show both arguments to the function.

Alternatively, or if it doesn't, you can press Y with your cursor on sub_4022E0, and change the prototype to void __fastcall sub_4022E0(void *, const char *).

Edit: I thought I might add some detail about Hex-Rays internals to illuminate where this behavior comes from.

IDA/Hex-Rays operate differently from Ghidra. Analyzing a binary in Ghidra involves decompiling every function, which you can see in the status bar as it repeatedly updates "Decompiling FUN_123456". In doing so, it performs analyses to determine which registers and stack locations the function expects to access throughout its lifetime (i.e., the function's prototype/calling convention). It works from the leaves of the call graph up to the roots -- that is to say, it begins with functions that don't call other functions, then analyzes the functions that only call those functions, and so on. Therefore, when analyzing any given function, for each function call, it already knows which registers and stack locations should be considered arguments to those calls. This is part of why it takes much longer to analyze a binary in Ghidra than in IDA.

In ordinary interactive operation, IDA and Hex-Rays don't work the same way as Ghidra. When you load a binary into IDA, it only performs its normal auto-analysis based on the disassembly listing. That means when you decompile a function for the first time, Hex-Rays does not know the prototypes for called functions, unless that information is provided due to a type library or mangled import symbol. As a result, Hex-Rays has to guess which registers and stack locations should be considered arguments to called functions -- and, as your question demonstrates, it does not always do it correctly. This is part of what is known as "call analysis", with which you may be familiar if you have ever received a "call analysis failure".

When decompiling a function, Hex-Rays also guesses the prototype for the function being analyzed, in a similar fashion to how I described Ghidra above. Prototypes guessed "from the outside" (at call sites), as described in the previous paragraph, and "from the inside", as described in the last sentence, are stored in a global cache of type information. For any given function, the function prototypes gleaned "from the inside" always take precedence over the ones gleaned "from the outside", as they are strictly more reliable.

So, what happened in this question was that:

  1. The user decompiled a function, which made calls to other functions which had never been seen before.
  2. Because Hex-Rays did not have prototype information for those functions, it guessed their prototypes (incorrectly).
  3. As a result, the decompilation for the function call showed one argument instead of two.
  4. I advised the user to press ENTER on the function, so as to decompile it and allow Hex-Rays to gain better information about its prototype. The prototype information was then stored in the global types cache.
  5. Upon backtracking to the calling function and refreshing, Hex-Rays now did not have to guess the arguments "from the outside". It retrieved the prototype from the global types cache, and hence it knew that the function call took two arguments in ecx and edx. It used that information to correctly decompile the arguments to the function call.
  6. My alternative suggestion was to supply the called function's prototype directly. User-supplied type information takes precedence over any form of guessed type information in the global types cache.

If you would like to simulate the auto-analysis functionality of Ghidra, you can use File->Produce file->Create .c file. This decompiles functions "from the leaves to the roots", and in so doing, populates the global types cache with the best information possible for the whole binary all at once. Be warned, however, that this process is not especially fast -- after all, the lack of this analysis is a major part of why IDA's auto-analysis is faster than Ghidra's.

2 of 2
1

Try unchecking Edit-> Plugins -> Hex-Rays Decompiler -> Print Only constant string literals

๐ŸŒ
Software Sources
software-sources.com โ€บ home โ€บ solutions โ€บ hex-rays
Hex-Rays - Software Sources - Software Sources
May 12, 2024 - IDA and the Hex-Rays decompiler are powerful tools, usable by engineers with any skill level; the higher the skills, the better the result. In order to get the best out of them, the people behind IDA regularly organize training sessions, to allow users to perfect their understanding of the ...
๐ŸŒ
Hacker News
news.ycombinator.com โ€บ item
IDA cybersecurity software provider Hex-Rays acquired | Hacker News
July 20, 2022 - I own a copy of IDA (legally). It was an absolute pain to purchase and it seems that a large portion of their margins are dedicated to piracy control. I won't detail the process...but it seems unusually personal ยท If I had to guess they will expand their decompilers (the actual flagship project).
๐ŸŒ
Reddit
reddit.com โ€บ r/reverseengineering โ€บ hex-rays is moving to a subscription model
r/ReverseEngineering on Reddit: Hex-rays is moving to a Subscription model
October 31, 2021 - My "last chance to renew your IDA/Hex-Rays license!" expired today, and while I was thinking about it yesterday, I sure as hell am happy I've seen this post today.