Suppose you have code like this (and you don't want to shell out the amount for the HexRays decompiler plugin):
loc_4BEEEF: ; CODE XREF: DriverEntry+28j
push 50505050h ; Tag
push 1234h ; NumberOfBytes
push ebx ; PoolType
call ds:ExAllocatePoolWithTag
cmp eax, ebx
jz short loc_4BEEFF
Now for these cases I tend to write IDC scripts that collapse the push
, push
, push
, call
into a single hidden area.
However, since the hidden areas in IDA seem to be based on the address and the first push
is a "named location", the indication that this is a label gets lost when I "name" my hidden area with descriptive pseudo-code, like this:
; eax := ExAllocatePoolWithTag(ebx, 1234h, 'PPPP')
cmp eax, ebx
jz short loc_4BEEFF
and if I can deduce the value of ebx
, as would be possible here, I'd even convert that into:
; eax := ExAllocatePoolWithTag(NonpagedPool, 1234h, 'PPPP')
cmp eax, ebx
jz short loc_4BEEFF
Is there any way, short of starting my hidden area after the first push
, that would allow me to hide the instructions and replace them with more descriptive pseudo-code, while at the same time retaining the label/name that coincides with the passing of the (last) argument?!
That is, my goal is to have it something like:
loc_4BEEEF: ; CODE XREF: DriverEntry+28j
; eax := ExAllocatePoolWithTag(NonpagedPool, 1234h, 'PPPP')
cmp eax, ebx
jz short loc_4BEEFF
(the comment behind the loc_4BEEEF
label is not important to me, though)
Of course allocation is but one of the cases where this applies and where the first pushed (i.e. last) argument ends up at a named location.