在 Ida 的 6.x 版本中（可能需要为更新的版本进行调整），您需要遍历 each Segment，然后您可以枚举 each Function，然后从那里运行 hexrays 反编译器。

这将枚举所有函数，转储伪代码，然后搜索字符串 'foobar'：

import sys, idc, idautils, idaapi

# Writes out the C function pseudo code, with the starting effective address
# returns: string
def DumpPseudoCode(ea):
    if not idaapi.init_hexrays_plugin():
        return ""

    f = idaapi.get_func(ea)
    if f is None:
        return ""

    try:
        cfunc = idaapi.decompile(f);
        if cfunc is None:
            # Failed to decompile
            return ""
    except:
        return ""

    lines = []
    sv = cfunc.get_pseudocode();
    for sline in sv:
        line = idaapi.tag_remove(sline.line);
        lines.append(line)
    return "\r\n".join(lines)

# enumerate all the functions and search for a string in the generated pseudo code
for segea in Segments():
    for funcea in Functions(segea, SegEnd(segea)):
        ccode = DumpPseudoCode(funcea)
        if ('foobar' in ccode)
            # do something