0

I have a function that seems to calculate the length of a string.

I have made this type declaration and it does kind of work as IDA now flags the string correctly.

__int64 __fastcall strlen(char strlen_string);

Now, RAX seems to hold the length of the string. But doing strlen@<rax> tells me that 'location rax is not allowed here'. Also, I'd like to flag exactly where the length is being used.

This is what I have now:

mov     rdi, rcx ; strlen_string
call    strlen
mov     [rbp+var001], rax  

and this is what I want to have with the new type declaration:

mov     rdi, rcx ; strlen_string
call    strlen
mov     [rbp+var001], rax ; string_length

How can I do that? Is it even possible?

1
  • If I'm not mistaken you can only specify argument locations when you use __usercall, you can't combine custom locations with predefined calling conventions like __fastcall. I have also never seen IDA name return value locations so unless I've missed it the whole time, you'd probably need to write your own script for that. Commented Feb 28, 2019 at 4:12

1 Answer 1

0

Specifying argument locations syntax is only available in the specific __usercall pseudo calling convention, which IDA supports precisely for that use case, where no other calling convention fit.

However, as mentioned in the comments, setting IDA's return value location has little impact, and it is impossible to have IDA automatically set a comment for the returned value (only arguments support that). You can, however, write a short IDAPython script for that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.