Question about IDA 6.8, also why its creating unnecessary vars

Question

recently I've been learning to do RE.

I made a simple program in 10 seconds that I was going to mess around with in IDA.

#include <iostream>

int main(int argc, char* argv[])
{
    printf("Hello, world!\n");

    int i = 0;

    if (i == 0)
    {
        printf("i == 0\n");
    }
    else
    {
        printf("i > 0 OR i < 0\n");
    }

    while (i == 0)
    {
        printf("I'm a while loop\n");
        _sleep(510);
    }
}

As you can see its the main function. But when I go into IDA and click on start its not that function (assuming start is the main function, correct?)

But, after clicking on a few functions in the function window I came across it. Here it is

int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
    {
      char v3; // ST04_1@1
      char v4; // [sp+0h] [bp-4h]@0
      char v5; // [sp+0h] [bp-4h]@1

      printf("Hello, world!\n", v4);
      printf("i == 0\n", v3);
      while ( 1 )
      {
        printf("I'm a while loop\n", v5);
        sleep(0x1FEu);
      }
    }

I've already reversed most of it. (printf was originally sub_50505 or something like that).

However, for some odd reason, its created unnecessary vars and I'm curious as to why it did that. It should've only created one, which is i.

Also, why is it while (1) { ... }

Shouldn't it by while (i == 0) { ... }?

I'm curious about all these questions. Thanks! And sorry if they're silly. I'm new to RE!

Answer 1

Welcome to RE.

it created unnecessary vars and I'm curious as to why it did that

The problem is with the printf function.

Normally, when IDA encounters a function call, it looks up the function signature to know how many parameters are passed at which locations.

In the case of the printf function, it is at least one parameter. In order to know how many parameters are passed, one would need to evaluate the format string. However, IDA doesn't and rather employs some heuristic to determine which part of the stack 'belongs' to this function call.

Since the main function retrieves parameters

(int argc, const char **argv, const char **envp)

when invoked, IDA notices the stack contains something.

Also, why is it while (1) { ... }

Most probably your compiler optimized the code because he noticed i is never assigned anything else but 0. It also removed the 'dead code' in the else-clause. If you use gcc, try turning off optimization (e.g. -O0)