https://github.com/l4ys/ida-wpp-remover
Remove WPP calls from hexrays decompiled code
https://github.com/l4ys/ida-wpp-remover
hexrays ida-plugin ida-pro idapython
Last synced: 29 days ago
JSON representation
Remove WPP calls from hexrays decompiled code
- Host: GitHub
- URL: https://github.com/l4ys/ida-wpp-remover
- Owner: L4ys
- License: mit
- Created: 2025-04-02T12:59:42.000Z (11 months ago)
- Default Branch: main
- Last Pushed: 2025-04-02T15:26:30.000Z (11 months ago)
- Last Synced: 2025-06-23T14:07:51.830Z (8 months ago)
- Topics: hexrays, ida-plugin, ida-pro, idapython
- Language: Python
- Homepage:
- Size: 1.96 MB
- Stars: 49
- Watchers: 1
- Forks: 2
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# WPP Remover - IDA Plugin for Removing WPP Calls
## Overview
WPP Remover is an IDA Pro plugin that removes Windows Performance Profiling (WPP) calls during decompilation, resulting in cleaner pseudocode for analysis.
## Features
- Removes WPP calls from Hex-Rays decompiler output
- Only activates for Windows PE files
## Installation
### Method 1: Using hcli (Recommended)
```
hcli plugin install wpp-remover
```
### Method 2: Manual Installation
Copy `wpp_remover.py` to your IDA plugins directory (`%IDADIR%\plugins` or `%APPDATA%\Hex-Rays\IDA Pro\plugins`)
## Usage
- Plugin activates automatically for Windows PE files
- Toggle on/off: Right-click in decompiled view → "Toggle WPP Remover"
## How it Works
It uses a Hex-Rays microcode optimization pass to find calls to `WPP_SF*` functions and replace them with NOPs before pseudocode generation.