4

I have identified a routine that behaves exactly like printf in an ARM64 binary. Arguments are passed in the standard fashion (e.g. X0, X1, X2 ...) and I have given the function the signature (Y) of:

int printf(char* fmt, ...)

This does the "right thing" some of the time, but not very frequently. Usually it'll miss any arguments after the second one.

Is there any way to tell HexRays more about this routine, so that it "does the right thing" and displays the data correctly? As an example, one of the lines is effectively:

printf("%s: %s: foo: 0x%llx, bar: 0x%llx, baz: %u\n", "function_name");

When it should have several more arguments, as indicated by the format string (and which are actually loaded into registers immediately before the call).

2 Answers 2

4

If the decompiler detects wrong number of arguments for a variadic function call, you can adjust it using the context menu comands or Numpad +/- hotkeys.

2
  • It'd be a great feature to add to Hex-Rays to automatically pick up format arguments and infer type information (string vs. int vs. pointer) from that. I thought the limitation was that it wasn't sure about the ABI (e.g. stack spill for GCC vs. MSVC) in my particular binary. Commented Nov 1, 2017 at 18:49
  • There is already some limited heuristic in the decompiler but the format string does not always correspond to the actually passed arguments and the format specifiers may change meaning depending on implementation, that's why the manual override is there. If you get misidentified number of arguments often, you should send in reports with sample binaries/IDBs.
    – Igor Skochinsky
    Commented Nov 1, 2017 at 18:54
1

Right click on a function invocation in decompiler window, you'll see add and delete variadic argument. Checked in Ida 6.95 on x86, function should be defined with variadic prototype.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.