3

I'm currently working on taking apart a game (Soul Reaver: Legacy of Kain) and I often come across odd looking sections such as this in the decompiler

  *(_DWORD *)(a2 + 16) = a2 + 624;
  *(_DWORD *)(a2 + 38200) = a2 + 8;
  *(_DWORD *)(a2 + 20) = 0;
  *(_DWORD *)(a2 + 37592) = 0;
  *(_DWORD *)(a2 + 37596) = a2 + 36968;
  *(_DWORD *)(a1 + 8) = a2;
  *(_DWORD *)a1 = 0;
  *(_DWORD *)(a1 + 4) = 0;

These appear to me to be offsets in a struct, but some of the offsets make little sense, e.g. 36968. I'm aware that it is quite difficult to be sure, but some pointers in the correct direction would be much appreciated :)

Assembly for those who want it :)

.text:004B0126                   xor     esi, esi
.text:004B0128                   mov     [ecx+10h], eax
.text:004B012B                   lea     eax, [ecx+8]
.text:004B012E                   mov     [ecx+9538h], eax
.text:004B0134                   mov     eax, [esp+4+arg_0]
.text:004B0138                   lea     edx, [ecx+9068h]
.text:004B013E                   mov     [ecx+14h], esi
.text:004B0141                   mov     [ecx+92D8h], esi
.text:004B0147                   mov     [ecx+92DCh], edx
.text:004B014D                   mov     [eax+8], ecx
.text:004B0150                   mov     [eax], esi
.text:004B0152                   mov     [eax+4], esi
3

There is nothing strange in structures or objects with large arrays or other structures inside.In addition I see that most of the large offsets are counted from ecx register, which fits to the definition of Visual Studio variant of __thiscall calling convention. So I think that it is just large structure or object. In addition - structures in IDA not intended to restore original structures, they are intended to make structure in created code, so if it organizes resulting code better - why not to use it anyway ?

Anyway, you can check where the memory in which this parameter allocated comes from. If you see that it is allocated with single malloc or new operator it should be single object/structure or array of objects/structures.

(quote from x86 calling conventions Wiki article)

On the Microsoft Visual C++ compiler, the this pointer is passed in ECX and it is the callee that cleans the stack, mirroring the stdcall convention used in C for this compiler and in Windows API functions. When functions use a variable number of arguments, it is the caller that cleans the stack (cf. cdecl). The thiscall calling convention can only be explicitly specified on Microsoft Visual C++ 2005 and later. On any other compiler thiscall is not a keyword. (However, disassemblers, such as IDA, must specify it. So IDA uses keyword __thiscall for this.)

  • Many thanks for the answer. I should also mention it's compiled using Visual C++ 6.0. I have so far come across next to no new or malloc occurences (it appears to use its own memory allocation system, due to its porting from the PS1, which is a wrapper around malloc). I understand how IDA uses structs primarily to organise assembly and make it easier to read. The primary reason it was throwing me off was the large gaps between offsets, and that the values written did not appear to be capable of filling the gaps. Once again, many thanks for the answer, it's a great help :) – MicroTransactionsMatterToo Mar 10 '17 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.