WPP Remover - IDA Plugin for Removing WPP Calls

Overview

WPP Remover is an IDA Pro plugin that removes Windows Performance Profiling (WPP) calls during decompilation, resulting in cleaner pseudocode for analysis.

Features

• Removes WPP calls from Hex-Rays decompiler output
• Only activates for Windows PE files

Installation

Method 1: Using hcli (Recommended)

hcli plugin install wpp-remover

Method 2: Manual Installation

1. Download or clone this repository.
2. Copy wpp_remover.py into your IDA plugins directory:
   • Windows: %APPDATA%\Hex-Rays\IDA Pro\plugins\
   • macOS/Linux: ~/.idapro/plugins/
3. Restart IDA.

Usage

• Plugin activates automatically for Windows PE files
• Toggle on/off: Right-click in decompiled view → "Toggle WPP Remover"

How it Works

It uses a Hex-Rays microcode optimization pass to find calls to WPP_SF* functions and replace them with NOPs before pseudocode generation.