0

Im reverse engineering a Games Entity System from scratch. I found a function that initializes some sort of descriptor, it looks up a given property name in a huge array and initializes the structure with some default values using the found index.

This is where my trouble starts

Every function that call this function consists of huge ammounts of assembler code (0xE00 bytes) with 100+ case jumptables yet when i apply Hexrays decompiler i get something like this:

char __usercall sub_B2C0E0@<al>(int a1@<edx>, int a2@<ecx>, int a3, _DWORD *a4)
{
  int v4; // eax@1
  int v5; // ecx@2
  int v6; // eax@2
  int v7; // esi@3
  int v8; // edx@3
  int v10; // [sp+18h] [bp-BCh]@1
  int v11; // [sp+1Ch] [bp-B8h]@1
  int v12; // [sp+28h] [bp-ACh]@1
  _DWORD *v13; // [sp+30h] [bp-A4h]@1
  int v14; // [sp+3Ch] [bp-98h]@1

  v10 = a3;
  v14 = 0;
  v4 = *a4 - 1;
  v11 = a1;
  v13 = a4;
  v12 = a2;
  if ( v4 > 0 )
  {
    v5 = a2 - 8;
    v6 = v4 + 1;
    do
    {
      v7 = *(v5 + 8);
      v8 = *(v5 + 12);
      v5 += 8;
      --v6;
    }
    while ( v6 );
  }
  return 0;
}

Which, while the function may execute like that in a small part, is not nearly enough to actually be the code i wanted decompiled.

My question now is if anyone knows what could cause this behavior in the ida decompiler.

Can i do my part to help it understand the function ? Is it a known bug ?

Anyway i will try and analyze the ASM code without the the decompilers help but its a real pain :D

  • 1
    If you think the Hex-Rays decompiler is malfunctioning, please email support@hex-rays.com – Jason Geffner Mar 4 '16 at 16:19
  • Thanks, i will do that. Also i noticed that the first line in the manual is similar to my problem ashes on my head – Blob31 Mar 4 '16 at 16:23
  • Generally, it might be better to stop depending on decompilers to do all the work. – NirIzr Aug 21 '16 at 10:48
1

May be, function have a switch idiom, that hasn't recognized by IDA (not hexrays), in this case hexrays can omit all switch code in output. You need search near that function for switch offset tables and manually set switch idioms for referencing code

| improve this answer | |
0

First, there's no disassembly output given, so I can only give general suggestion.

There are thousands of reasons stop hex rays decompiling.Your situation is extremely common in reverse engineering.

Usually that's because other functions are not analyzed, its effect on the control flow is not being calculated, leads to wrong or incomplete output.

You can simply click into every functions, forcing hexrays analyze them.

As you mentioned you are reversing a game, there might be obfuscation. Maybe obfuscation made hexrays believe that those case statements cannot be executed, then dropped them from the output. To fix this you can modify function's control flow graph, and then make it clear that case statements WILL be executed, then the decompiler will produce the correct output.

P.S.: Personally I think incomplete output is because of the Junk Code Removing technology, which might based on symbolic executing.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.