0

I am trying to reverse engineer exe file and have some difficulties of pseudo code understanding.

Can someone please help me understand what is doing the code below:

char __userpurge sub_41C140@<al>(int a1@<esi>, void *Src)
{
  size_t v2; // ebp@1
  int v3; // eax@1
  unsigned int v4; // edi@2
  void *v5; // ebx@2
  const void *v6; // eax@4
  int v7; // edx@9
  char result; // al@9
  int v9; // edx@9

  v2 = strlen((const char *)Src);
  v3 = *(_DWORD *)(a1 + 44);
  *(_DWORD *)(a1 + 48) = v3;
  if ( v3 + v2 + 3 <= *(_DWORD *)(a1 + 40) )
  {
LABEL_9:
    memcpy((void *)(*(_DWORD *)(a1 + 48) + *(_DWORD *)(a1 + 36)), Src, v2);
    *(_DWORD *)(a1 + 48) += v2;
    *(_BYTE *)(*(_DWORD *)(a1 + 48) + *(_DWORD *)(a1 + 36)) = 13;
    v7 = *(_DWORD *)(a1 + 36);
    result = 1;
    *(_BYTE *)(++*(_DWORD *)(a1 + 48) + v7) = 10;
    v9 = ++*(_DWORD *)(a1 + 48);
    *(_DWORD *)(a1 + 44) = *(_DWORD *)(a1 + 48);
    *(_BYTE *)(*(_DWORD *)(a1 + 36) + v9) = 0;
  }
  else
  {
    while ( 1 )
    {
      v4 = *(_DWORD *)(a1 + 40) + 2048;
      v5 = operator new(v4);
      if ( !v5 )
        break;
      if ( *(_DWORD *)(a1 + 40) )
      {
        v6 = *(const void **)(a1 + 36);
        if ( v6 )
          memcpy(v5, v6, *(_DWORD *)(a1 + 48));
      }
      if ( *(_DWORD *)(a1 + 36) )
        operator delete(*(void **)(a1 + 36));
      *(_DWORD *)(a1 + 40) = v4;
      *(_DWORD *)(a1 + 36) = v5;
      if ( *(_DWORD *)(a1 + 48) + v2 + 3 <= v4 )
        goto LABEL_9;
    }
    result = 0;
  }
  return result;
}
  • 1
    anything in particular you don't understand? It is pretty close to C-Syntax. – Nordwald Jan 6 '17 at 9:21
  • 1
    In this case I'd rather read the original assembly code. – usr2564301 Jan 6 '17 at 19:52
  • i have more knowledge in vb or c#. c/c++ and pointers are mistery to me. – Bekim Tetova Jan 10 '17 at 11:55
3

As far as I can tell a1 here is pointer to structure or object, so I'd suggest to use IDA structures to make the generated code simpler:

  • Decompile the function you are working with.
  • Right click on a1 variable inside a function
  • Press "create new struct type" menu item and press OK.

This should convert all the references like *(_DWORD *)(a1 + 40) to a1->fieldname and a1 will be treated as structure pointer.

You'll be able to rename the structure in the structures window and you'll be able to rename fields by pressing n on the fields just as like on variables.

Good luck.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.