Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

IDA PRO's Hex-Ray gives me these variables.

  void *v7; // esp@1
  const char *v8; // ebx@1
  PLAYER *v9; // ebp@1
  int v10; // edi@5
  PLAYER *v11; // edx@6
  int v12; // ecx@9
  int v13; // esi@17
  int v14; // eax@33
  const char v15; // al@36
  const char *v16; // ebx@45
  PLAYER *v17; // eax@50
  int v18; // esi@51
  const CHAR *v19; // ecx@54
  int v20; // edx@56
  unsigned int v21; // eax@61
  signed int v22; // ebx@61
  ARENA *v23; // eax@63
  ARENA *v24; // edx@63
  int v25; // ecx@63
  int v26; // esi@64
  signed int v27; // edi@65
  int v28; // eax@66
  ARENA *v29; // ecx@66
  int v30; // esi@69
  int v31; // edi@71
  int v32; // esi@71
  signed int v33; // ecx@74
  int v34; // eax@75
  const CHAR *v35; // edi@78
  signed int v36; // ecx@78
  signed int v37; // ecx@81
  const void *v38; // esi@81
  const CHAR *v39; // edi@81
  unsigned int v40; // edx@81
  signed int v41; // ecx@81
  const char v42; // al@89
  const char *v43; // ebx@89
  const char v44; // al@90
  const char v45; // al@96
  const char *v46; // ebx@96
  const char v47; // al@97
  const char v48; // al@103
  const char *v49; // ebx@103
  const char v50; // al@104
  int v51; // ebx@107
  const char *v52; // edx@108
  unsigned int v53; // kr48_4@108
  unsigned int v54; // kr50_4@108
  const char *v55; // edi@108
  unsigned int v56; // kr58_4@110
  const char *v57; // esi@110
  const char *v58; // edi@110
  int v59; // ecx@110
  bool v60; // zf@110
  int v61; // edi@121
  int i; // esi@121
  const char *v63; // eax@122
  signed int v64; // esi@126
  const char *v65; // ebx@134
  PLAYER *v66; // eax@140
  int v67; // edx@141
  int v68; // ecx@141
  PLAYER *v69; // eax@146
  int v70; // edx@147
  int v71; // ecx@147
  const CHAR v72; // cl@153
  int v73; // eax@153
  const CHAR *j; // edx@153
  char v75; // cl@156
  const CHAR v76; // cl@157
  int v77; // eax@157
  const CHAR *k; // edx@157
  char v79; // cl@160
  const CHAR v80; // cl@161
  int v81; // eax@161
  const CHAR *l; // edx@161
  char *v83; // eax@163
  const CHAR v84; // al@171
  int v85; // esi@171
  const CHAR *m; // ecx@171
  char v87; // al@174
  const CHAR v88; // al@175
  int v89; // esi@175
  const CHAR *n; // ecx@175
  const CHAR v91; // al@180
  int v92; // esi@180
  const CHAR *ii; // ecx@180
  const char *v94; // ebx@189
  const char v95; // al@200
  const char *v96; // ebx@200
  const char v97; // al@201
  ARENA *v98; // eax@204
  unsigned int v99; // kr68_4@208
  int v100; // edi@208
  PLAYER **v101; // ebx@209
  int v102; // ebx@215
  PLAYER *v103; // ecx@217
  __int64 v104; // qax@218
  int v105; // ecx@218
  __int64 v106; // qax@218
  int v107; // ST24_4@218
  __int64 v108; // qax@218
  PLAYER *v109; // esi@223
  int v110; // ST24_4@224
  int v111; // ST1C_4@224
  int v112; // ST18_4@224
  char *v113; // eax@224
  ARENA *v114; // eax@226
  signed int v115; // ecx@228
  int v116; // eax@228
  ENCRYPTION *v117; // ecx@230
  int v118; // edi@230
  int v119; // edx@233
  int v120; // edi@233
  unsigned __int64 v121; // st7@233
  DWORD v122; // eax@235
  int v123; // ecx@235
  DWORD v124; // eax@237
  unsigned __int64 v125; // st7@237
  int v126; // ecx@237
  int v127; // edx@239
  DWORD v128; // edi@239
  time_t v129; // ST20_8@242
  signed __int64 v130; // qax@242
  signed int v131; // edi@242
  __int64 v132; // qax@243
  __int64 v133; // ST20_8@243
  signed int v134; // ecx@243
  __int64 v135; // ST18_8@243
  int v136; // ecx@247
  PLAYER *v137; // eax@268
  int v138; // ecx@269
  const char v139; // al@276
  const char *v140; // edi@276
  const char v141; // al@277
  const char v142; // al@279
  __int16 v143; // ax@284
  PLAYER *v144; // edi@289
  ARENA *v145; // eax@292
  int v146; // ecx@292
  signed int v147; // edx@293
  PLAYER *v148; // eax@294
  ARENA *v149; // eax@296
  int v150; // ecx@296
  signed int v151; // edx@297
  PLAYER *v152; // eax@298
  PLAYER *v153; // eax@308
  char *v154; // eax@309
  const char v155; // al@312
  const char *v156; // edi@312
  const char v157; // al@313
  ARENA *v158; // eax@318
  unsigned int v159; // kr88_4@320
  const char v160; // al@323
  const char *v161; // edi@323
  const char v162; // al@324
  const char v163; // al@330
  const char *v164; // edi@330
  const char v165; // al@331
  int v166; // eax@336
  __int16 v167; // ax@342
  PLAYER *v168; // esi@346
  int v169; // edx@350
  const char v170; // al@384
  const char *v171; // edi@384
  const char v172; // al@385
  PLAYER *v173; // esi@392
  int v174; // edx@397
  PLAYER *v175; // esi@403
  int v176; // edi@408
  int v177; // eax@409
  int v178; // esi@410
  int v179; // eax@410
  ARENA *v180; // ecx@413
  int v181; // edi@415
  ARENA **v182; // esi@416
  PLAYER *v183; // ecx@423
  int v184; // edi@427
  PLAYER **v185; // esi@428
  PLAYER *v186; // ecx@437
  ARENA *v187; // ecx@443
  FILE *v188; // eax@449
  const char *v189; // edi@449
  int v190; // ebx@451
  int v191; // eax@451
  FILE *v192; // eax@454
  ARENA *v193; // eax@455
  int v194; // esi@456
  signed int v195; // edi@457
  PLAYER *v196; // eax@458
  const char *v197; // esi@461
  int v198; // eax@461
  signed int v199; // edi@463
  int v200; // edx@471
  time_t v201; // ST20_8@478
  signed __int64 v202; // qax@478
  signed int v203; // esi@478
  signed int v204; // ecx@481
  int v205; // edi@481
  const char *v206; // esi@481
  bool v207; // zf@481
  const char *v208; // ebx@485
  signed int v209; // ebx@490
  char *v210; // eax@491
  int v211; // ecx@491
  int v212; // edi@494
  signed int v213; // ecx@496
  signed int v214; // ecx@499
  const void *v215; // esi@499
  const CHAR *v216; // edi@499
  unsigned int v217; // edx@499
  signed int v218; // ecx@499
  const CHAR *v219; // edi@502
  signed int v220; // ecx@502
  signed int v221; // ecx@505
  const void *v222; // esi@505
  const CHAR *v223; // edi@505
  unsigned int v224; // edx@505
  signed int v225; // ecx@505
  int v226; // ebx@516
  signed int v227; // esi@516
  ARENA *v228; // edx@520
  int v229; // eax@520
  int v230; // esi@520
  int v231; // edi@520
  int v232; // edx@520
  int v233; // ecx@524
  ARENA *v234; // eax@527
  int v235; // edx@527
  int v236; // ecx@527
  __int16 v237; // ax@527
  int v238; // eax@527
  int v239; // ecx@527
  int v240; // eax@527
  int v241; // eax@540
  ARENA *v242; // ecx@543
  char *v243; // eax@543
  char *v244; // edx@544
  char *v245; // ebx@546
  DWORD v246; // eax@546
  ARENA *v247; // esi@547
  char *v248; // esi@550
  signed int v249; // ebp@554
  int v250; // eax@557
  int v251; // eax@562
  signed int v252; // ecx@570
  int v253; // edi@570
  const char *v254; // esi@570
  bool v255; // zf@570
  int v256; // eax@575
  const char *v257; // edx@578
  ARENA *v258; // ecx@585
  signed int v259; // ebx@586
  PLAYER *v260; // ecx@587
  signed int v261; // esi@587
  __int64 v262; // qax@590
  __int64 v263; // qax@591
  int v264; // edi@602
  signed int v265; // ecx@604
  signed int v266; // ecx@607
  const void *v267; // esi@607
  const CHAR *v268; // edi@607
  unsigned int v269; // edx@607
  signed int v270; // ecx@607
  const CHAR *v271; // edi@610
  signed int v272; // ecx@610
  signed int v273; // ecx@613
  const void *v274; // esi@613
  const CHAR *v275; // edi@613
  unsigned int v276; // edx@613
  signed int v277; // ecx@613
  int v278; // edx@617
  int v279; // ecx@621
  int v280; // edx@638
  char *v281; // ebx@638
  unsigned int v282; // ebx@646
  PLAYER *v283; // eax@646
  signed int v284; // ecx@654
  signed int v285; // ecx@658
  signed int v286; // ecx@662
  signed int v287; // ecx@671
  int v288; // edi@671
  const char *v289; // esi@671
  bool v290; // zf@671
  signed int v291; // ecx@675
  int v292; // edi@675
  const char *v293; // esi@675
  bool v294; // zf@675
  signed int v295; // ecx@682
  int v296; // eax@683
  const char v297; // al@688
  const char *v298; // edi@688
  const CHAR *jj; // ecx@688
  const char v300; // al@691
  const CHAR v301; // al@692
  int v302; // edi@692
  const CHAR *kk; // ecx@692
  const char v304; // al@696
  int *v305; // edi@704
  int *v306; // esi@704
  char v307; // al@707
  int v308; // ecx@708
  int v309; // edi@708
  int v310; // esi@708
  const char *v311; // eax@709
  ARENA *v312; // edi@711
  ARENA *v313; // ecx@718
  int v314; // eax@718
  int v315; // eax@723
  __int64 v316; // qax@727
  __int64 v317; // qax@728
  __int64 v318; // qax@729
  const char *v319; // ebx@730
  int v320; // edi@737
  char *v321; // ST1C_4@737
  int v322; // esi@737
  ARENA *v323; // eax@738
  ARENA *v324; // eax@743
  DWORD v325; // eax@748
  int v326; // edx@749
  PLAYER *v327; // esi@749
  bool v328; // sf@749
  ARENA **v329; // edi@750
  ARENA *v330; // eax@751
  int v331; // ebx@751
  signed int v332; // esi@752
  unsigned int v333; // krD8_4@774
  ARENA **v334; // esi@775
  int v335; // ebp@776
  signed int v336; // edi@777
  ARENA *v337; // edx@784
  int v338; // esi@785
  int v339; // ecx@785
  const char *v340; // ecx@797
  const char v341; // al@799
  const CHAR *ll; // edx@799
  const char v343; // al@803
  const char v344; // al@804
  const char *v345; // ecx@804
  int v346; // eax@819
  int v347; // eax@833
  unsigned int v348; // krE8_4@836
  int v349; // edi@836
  PLAYER **v350; // ebp@837
  char *v351; // [sp+4h] [bp-1608Ch]@668
  const char *v352; // [sp+8h] [bp-16088h]@668
  char *v353; // [sp+Ch] [bp-16084h]@52
  char *v354; // [sp+Ch] [bp-16084h]@351
  char *v355; // [sp+Ch] [bp-16084h]@598
  char *v356; // [sp+Ch] [bp-16084h]@644
  int v357; // [sp+Ch] [bp-16084h]@668
  const char *v358; // [sp+10h] [bp-16080h]@52
  const char *v359; // [sp+10h] [bp-16080h]@57
  const char *v360; // [sp+10h] [bp-16080h]@218
  const char *v361; // [sp+10h] [bp-16080h]@351
  int v362; // [sp+10h] [bp-16080h]@525
  const char *v363; // [sp+10h] [bp-16080h]@598
  const char *v364; // [sp+10h] [bp-16080h]@644
  int v365; // [sp+10h] [bp-16080h]@668
  int v366; // [sp+14h] [bp-1607Ch]@52
  char v367; // [sp+14h] [bp-1607Ch]@54
  char v368; // [sp+14h] [bp-1607Ch]@218
  int v369; // [sp+14h] [bp-1607Ch]@351
  int v370; // [sp+14h] [bp-1607Ch]@525
  int v371; // [sp+14h] [bp-1607Ch]@598
  char *v372; // [sp+14h] [bp-1607Ch]@644
  int v373; // [sp+14h] [bp-1607Ch]@668
  time_t v374; // [sp+18h] [bp-16078h]@1
  ARENA *a5[2]; // [sp+28h] [bp-16068h]@63
  int v376; // [sp+30h] [bp-16060h]@69
  int v377; // [sp+34h] [bp-1605Ch]@61
  DWORD ExitCode; // [sp+38h] [bp-16058h]@233
  char v379; // [sp+3Fh] [bp-16051h]@420
  size_t Size; // [sp+40h] [bp-16050h]@69
  int v381; // [sp+44h] [bp-1604Ch]@233
  int v382; // [sp+48h] [bp-16048h]@69
  int v383; // [sp+4Ch] [bp-16044h]@69
  char v384; // [sp+50h] [bp-16040h]@527
  __int16 v385; // [sp+51h] [bp-1603Fh]@527
  int v386; // [sp+53h] [bp-1603Dh]@527
  int v387; // [sp+57h] [bp-16039h]@527
  __int16 v388; // [sp+5Bh] [bp-16035h]@527
  __int16 v389; // [sp+5Dh] [bp-16033h]@527
  int v390; // [sp+60h] [bp-16030h]@233
  const CHAR KeyName; // [sp+64h] [bp-1602Ch]@157
  const CHAR CommandLine; // [sp+84h] [bp-1600Ch]@52
  char v393; // [sp+85h] [bp-1600Bh]@773
  const CHAR Dest; // [sp+184h] [bp-15F0Ch]@69
  __int16 v395; // [sp+185h] [bp-15F0Bh]@342
  char v396; // [sp+187h] [bp-15F09h]@342
  const CHAR Str1; // [sp+284h] [bp-15E0Ch]@153
  const CHAR AppName; // [sp+2C4h] [bp-15DCCh]@76
  int buf; // [sp+304h] [bp-15D8Ch]@45
  char v400; // [sp+309h] [bp-15D87h]@208
  char v401; // [sp+404h] [bp-15C8Ch]@255
  char v402; // [sp+405h] [bp-15C8Bh]@255
  char v403; // [sp+414h] [bp-15C7Ch]@255
  CHAR StartupInfo[4]; // [sp+504h] [bp-15B8Ch]@163
  int v405; // [sp+510h] [bp-15B80h]@309
  char v406; // [sp+604h] [bp-15A8Ch]@741
  char v407; // [sp+605h] [bp-15A8Bh]@741
  char v408; // [sp+606h] [bp-15A8Ah]@741
  __int16 v409; // [sp+607h] [bp-15A89h]@748
  char v410; // [sp+609h] [bp-15A87h]@765
  char v411; // [sp+804h] [bp-1588Ch]@638
  char v412; // [sp+805h] [bp-1588Bh]@638
  char v413; // [sp+2804h] [bp-1388Ch]@543
  char Str; // [sp+2805h] [bp-1388Bh]@544
  char v415; // [sp+2815h] [bp-1387Bh]@546
  int v416; // [sp+16084h] [bp-Ch]@1
  int (*v417)(); // [sp+16088h] [bp-8h]@1
  int v418; // [sp+1608Ch] [bp-4h]@1
  const char *Buf1b; // [sp+160A0h] [bp+10h]@485
  const char *Buf1a; // [sp+160A0h] [bp+10h]@489

I was told on email by a very skilled reverser how to handle this, I don't know if he wants me to say his/her name so I'll not say anything.

But they said start doing repairs to arrays or structures starting at [sp+####h] and do calculations from that.

So the first part to start repairing is the since it begins with [sp+#h]

char *v351; // [sp+4h] [bp-1608Ch]@668 

Now you go down to

  char *v372; // [sp+14h] [bp-1607Ch]@644
  int v373; // [sp+14h] [bp-1607Ch]@668
  time_t v374; // [sp+18h] [bp-16078h]@1
  ARENA *a5[2]; // [sp+28h] [bp-16068h]@63
  int v376; // [sp+30h] [bp-16060h]@69


  char *v372; // [sp+14h]                                      [0]
  int v373; // [sp+14h]                     14-14 = 0 goes up  [4]
  time_t v374; // [sp+18h] [bp-16078h]@1    18-14 = 4 goes up  [16]
  ARENA *a5[2]; // [sp+28h] [bp-16068h]@63  28-18 = 16 goes up [8]
  int v376; // [sp+30h] [bp-16060h]@69      30-28 = 8 goes up  [4]
  int v377; // [sp+34h] [bp-1605Ch]@61       34-30 = 4 goes up  [ignored]

So 0 would mean char? yet it's a pointer to a char (4 bytes)?, Probably shouldn't touch those
The 4 after would be int which seems right.
The 16 after looks like 2 x 8 bytes.
Since time_t could be 4 bytes or 8 bytes.

I checked and time_t is defined as

-00016080 var_16080       dd 6 dup(?)             ; offset

So it thinks it's 4 bytes x 6 which would be 24 bytes? why does it think that? Yes I get that var_16080 when I click on the time_t

So this is where I get confused I think it's really 8 bytes and all I have to do is make it time_t v374[2]

ARENA *a5[2]; looks right 2 pointers of 4 bytes. = 8 bytes and the int after looks right.

Can someone tell me how what to do in certain hard cases if I have to do it all manually I would do it..

But if there is a way to automate this I'd also appreciate that if anyone can tell me of a plugin or a script to do that.

Here is how I got it down to is it right?

  int v369; // [sp+14h] [bp-1607Ch]@351
  int v370; // [sp+14h] [bp-1607Ch]@525
  int v371; // [sp+14h] [bp-1607Ch]@598
  char *v372; // [sp+14h] [bp-1607Ch]@644
  int v373; // [sp+14h] [bp-1607Ch]@668
  char v374[16]; // [sp+18h] [bp-16078h]@1
  ARENA *a5[2]; // [sp+28h] [bp-16068h]@63
  int v376; // [sp+30h] [bp-16060h]@69
  int v377; // [sp+34h] [bp-1605Ch]@61
  char ExitCode[7]; // [sp+38h] [bp-16058h]@233
  char v379; // [sp+3Fh] [bp-16051h]@420
  size_t Size; // [sp+40h] [bp-16050h]@69
  int v381; // [sp+44h] [bp-1604Ch]@233
  int v382; // [sp+48h] [bp-16048h]@69

A bit lower you see this

  __int16 v385; // [sp+51h] [bp-1603Fh]@527                   2
  int v386; // [sp+53h] [bp-1603Dh]@527               53-51 = 2 up [4]
  int v387; // [sp+57h] [bp-16039h]@527               57-53 = 4 up [4]
  __int16 v388; // [sp+5Bh] [bp-16035h]@527           5B-57 = 4 up [2]
  __int16 v389; // [sp+5Dh] [bp-16033h]@527           5D-5B = 2 up [3] ???
  int v390; // [sp+60h] [bp-16030h]@233               60-5D = 3 up

Why is that one 3 bytes when it's a __int16 or is it a char[3] ?

After I translated it to

  int v386; // [sp+53h] [bp-1603Dh]@527
  int v387; // [sp+57h] [bp-16039h]@527
  __int16 v388; // [sp+5Bh] [bp-16035h]@527
  char v389[3]; // [sp+5Dh] [bp-16033h]@527
  int v390; // [sp+60h] [bp-16030h]@233

Now it does something like this in code, so it must of been __int16 after all. Maybe it's a __int16 followed by a char after, but you can't do that in Hex-Rays afaik.

                *(_WORD *)v389 = v236;

Okay it's highly unpredictable and I don't think I can rely on the [so+###h]'s too much just in some cases.

I managed to get it down to this, but it has problems all over the place

Trimmed off the top stuff that didn't change

  char *v351; // [sp+4h] [bp-1608Ch]@668
  const char *v352; // [sp+8h] [bp-16088h]@668
  char *v353; // [sp+Ch] [bp-16084h]@52
  char *v354; // [sp+Ch] [bp-16084h]@351
  char *v355; // [sp+Ch] [bp-16084h]@598
  char *v356; // [sp+Ch] [bp-16084h]@644
  int v357; // [sp+Ch] [bp-16084h]@668
  const char *v358; // [sp+10h] [bp-16080h]@52
  char *v359; // [sp+10h] [bp-16080h]@57
  char *v360; // [sp+10h] [bp-16080h]@218
  const char *v361; // [sp+10h] [bp-16080h]@351
  int v362; // [sp+10h] [bp-16080h]@525
  const char *v363; // [sp+10h] [bp-16080h]@598
  const char *v364; // [sp+10h] [bp-16080h]@644
  int v365; // [sp+10h] [bp-16080h]@668
  int v366; // [sp+14h] [bp-1607Ch]@52
  char v367; // [sp+14h] [bp-1607Ch]@54
  char v368; // [sp+14h] [bp-1607Ch]@218
  int v369; // [sp+14h] [bp-1607Ch]@351
  int v370; // [sp+14h] [bp-1607Ch]@525
  int v371; // [sp+14h] [bp-1607Ch]@598
  char *v372; // [sp+14h] [bp-1607Ch]@644
  int v373; // [sp+14h] [bp-1607Ch]@668
  char v374[16]; // [sp+18h] [bp-16078h]@1
  ARENA *a5[2]; // [sp+28h] [bp-16068h]@63
  int v376; // [sp+30h] [bp-16060h]@69
  int v377; // [sp+34h] [bp-1605Ch]@61
  char ExitCode[7]; // [sp+38h] [bp-16058h]@233
  char v379; // [sp+3Fh] [bp-16051h]@420
  size_t Size; // [sp+40h] [bp-16050h]@69
  int v381; // [sp+44h] [bp-1604Ch]@233
  int v382; // [sp+48h] [bp-16048h]@69
  int v383; // [sp+4Ch] [bp-16044h]@69
  char v384; // [sp+50h] [bp-16040h]@527
  __int16 v385; // [sp+51h] [bp-1603Fh]@527
  int v386; // [sp+53h] [bp-1603Dh]@527
  int v387; // [sp+57h] [bp-16039h]@527
  __int16 v388; // [sp+5Bh] [bp-16035h]@527
  char v389[3]; // [sp+5Dh] [bp-16033h]@527
  int v390; // [sp+60h] [bp-16030h]@233
  char array1[32]; // [sp+64h] [bp-1602Ch]@157
  char array2[256]; // [sp+84h] [bp-1600Ch]@52
  char Dest[256]; // [sp+184h] [bp-15F0Ch]@69
  char Str1[64]; // [sp+284h] [bp-15E0Ch]@153
  char AppName[64]; // [sp+2C4h] [bp-15DCCh]@76
  char buf[512]; // [sp+304h] [bp-15D8Ch]@45
  char StartupInfo[256]; // [sp+504h] [bp-15B8Ch]@163
  char v398[512]; // [sp+604h] [bp-15A8Ch]@741
  char v399[8192]; // [sp+804h] [bp-1588Ch]@638
  char v400[80000]; // [sp+2804h] [bp-1388Ch]@543
  int v401; // [sp+16084h] [bp-Ch]@1
  int (*v402)(); // [sp+16088h] [bp-8h]@1
  int v403; // [sp+1608Ch] [bp-4h]@1
  const char *Buf1b; // [sp+160A0h] [bp+10h]@485
  const char *Buf1a; // [sp+160A0h] [bp+10h]@489

Seems all the array/buffers are only found at the bottom of all the variables all of them are buffers completely (maybe it's just the type of compiler / optimizer this program used).

I wonder what If it probably reuses all the buffers as just one big buffer?

share|improve this question
Which DA version are you using ? – w s Apr 22 '14 at 4:24
I use the IDA 6.1 version. – SSpoke Apr 22 '14 at 5:48
up vote 5 down vote accepted

I'm not sure that it is possible to answer this question without seeing all the function because correctness of local variable type recovery can be done only by understanding of the context where variables are used.

However, I'd suggest the following algorithm for dealing with local variables in Hex-Rays:

  1. As your friend said, do nothing with variables allocated on the registers.

  2. For all other variables allocated on the stack, do the following:

  3. Look where this variable is used.

  4. If you see one of patterns below, act accordingly, but press F5 after each change and review results. Remember, you can revert each type back by pressing Y and entering previous type on it.

  5. If you see usage of some different offsets relative to this variable it may be a structure. Try to create one by right-click on the variable and choosing corresponding menu item. Usage of this variable as function parameter or other connections to already known types may give you a hint about type of the variable.

  6. If you see not constant offsets (such as offset in another variable) it can be array. Press asterisk (*) on the variable, IDA will suggest the length of the array, it does it relatively good.

  7. If you see both of those patterns, it is possibly array of structures or more complicated case like array of structures in structure which is member of array and vice versa :) In this case try to find a smallest structure/array and start with it.

At all, there are the following possibilities to affect the function stack in Hex-Rays:

  1. Changing variable type (press y on the variable, enter type)
  2. Making variable an array (press * on it)
  3. Creating new structure type on a variable basis (Right click on the variable, corresponding menu item)
  4. Undefining a variable: Doubleclick on stack variable will open stack function stack window. Pressing u on a variable will undefine it.
  5. Merging a variable: if you see that two different variables are actually the same you can press = and tell to the decompiler that they are really the same. AFAIR it works in IDA 6.5 and IDA6.5

Don't forget to refresh the decompiled code view by pressing F5 after each change to see results.

That's all.

By the way, there is one point you are probably missing: IDA and HexRays can make more than one variable on the same place in stack, so v369, v370, v371, v372, v373 are using same place in the stack, but are different variables from decompiled code point of view.

share|improve this answer
Yup I eliminated a bunch of those v369, v370 v371 v372 v373 since it's just one array. I found the last gap in the [sp+###h] to be exactly 80000 bytes and I made it into a array. It's almost all right except for like a5[] seems to be pointer to a structure but in other area's it's set to value 1 casted to pointer which is not possible. Don't think I need to Press F5 everytime I change a variable it automatically re-decompiles it. Also guessing these local variables lead me to redo the project over at one point as it started to overwrite my rdata. Here full code: – SSpoke Apr 22 '14 at 5:47
Here is my project too, maybe you can run it under the 6.5 and give me the C file haha so I could use it as a reference sheet. I started fixing the C file in notepad not relying on IDA PRO which changes the stuff all over the place which I like but sometimes it just doesn't do right in one area after you do it right in another area kinda like one screws up the other nearly all the problems I encountered in this function ChatProcesser() the other is in the PlayerHandleGamePacket(). Now error 414850: could not find valid save-restore pair for edi – SSpoke Apr 22 '14 at 5:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.