Suppose you have code like this (and you don't want to shell out the amount for the HexRays decompiler plugin):
loc_4BEEEF: ; CODE XREF: DriverEntry+28j push 50505050h ; Tag push 1234h ; NumberOfBytes push ebx ; PoolType call ds:ExAllocatePoolWithTag cmp eax, ebx jz short loc_4BEEFF
Now for these cases I tend to write IDC scripts that collapse the
call into a single hidden area.
However, since the hidden areas in IDA seem to be based on the address and the first
push is a "named location", the indication that this is a label gets lost when I "name" my hidden area with descriptive pseudo-code, like this:
; eax := ExAllocatePoolWithTag(ebx, 1234h, 'PPPP') cmp eax, ebx jz short loc_4BEEFF
and if I can deduce the value of
ebx, as would be possible here, I'd even convert that into:
; eax := ExAllocatePoolWithTag(NonpagedPool, 1234h, 'PPPP') cmp eax, ebx jz short loc_4BEEFF
Is there any way, short of starting my hidden area after the first
push, that would allow me to hide the instructions and replace them with more descriptive pseudo-code, while at the same time retaining the label/name that coincides with the passing of the (last) argument?!
That is, my goal is to have it something like:
loc_4BEEEF: ; CODE XREF: DriverEntry+28j ; eax := ExAllocatePoolWithTag(NonpagedPool, 1234h, 'PPPP') cmp eax, ebx jz short loc_4BEEFF
(the comment behind the
loc_4BEEEF label is not important to me, though)
Of course allocation is but one of the cases where this applies and where the first pushed (i.e. last) argument ends up at a named location.