KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#dsh #dsh-plugin #typescript #developer-tools #claude-code #ai-agent #codex #deepseek-harness #ai-agents #cli #react #mcp

HRAST

★ 265 Open GitHub ↗

PoC of modifying HexRays AST

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# HexRaysAST matcher

[![MIT license](http://img.shields.io/badge/license-MIT-brightgreen.svg)](https://github.com/sibears/HRAST/blob/master/LICENSE)

This is simple PoC that allows you to define AST pattern you want to process and make some actions with them

### Current code contains templates for:
1.  Replacing inlined `strlen` called on global variable
2.  Auto renaming globals in expressions like `global_var = func(arg1, "newglobalname")`
3.  Auto renaming structure fields like `glob_str.f0 = sub_cafebabe` to `glob_str.sub_cafebabe = sub_cafebabe`

Scripts are not fully tested (e.g. it can fail on some ctree elements), but you can already make some useful things.

`ast_helper.py` contains some functions that help to create ctree items

*If you got some interr like 50680 etc after yours changes to ctree you should check IDADIR/hexrays_sdk/verifier/cverify.cpp (you need to have IDA 7.1+)*

### Usage:
1. Load **HRAST.py** into IDA
1. Write your patterns in **read_patterns.py**. You should define `PATTERNS` list with tuples (`template_code`, `replacement_fcn`, `is_chain`) as elements
1. Call `reLOAD()` function from IDAPython
1. Reload decompiler window
1. You can call `unLOAD()` function to disable modifications
1. Also `deBUG()` method switches DEBUG mode on/off
1. If you want to reload **HRAST.py** or remove hex-rays callback call `hr_remove()`

### Examples:

**Before**
![before screen](https://raw.githubusercontent.com/sibears/HRAST/master/pics/before.png)

**After**
![after screen](https://raw.githubusercontent.com/sibears/HRAST/master/pics/after.png)

cpp operator << replace:

**Before**
![before screen](https://raw.githubusercontent.com/sibears/HRAST/master/pics/cpp_before.png)

**After**
![after screen](https://raw.githubusercontent.com/sibears/HRAST/master/pics/cpp_after.png)

### License:
Released under [The MIT License](https://github.com/sibears/HRAST/blob/master/LICENSE)

HRAST

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README