IDA Hex-Rays suggests an invalid offset

Question

While running Hex-Rays decompiler against an application, Hex-Rays gave the following output:

__int64 v29; // r10 ...  v29 = 0i64;    if( !v28)    v19 = 0;

 do
  {
    v30 = *(_BYTE *)(v29 + 5394926180i64);
    v31 = *(_BYTE *)(v29 + 5394926172i64);
    v32 = *(_BYTE *)(v29 + 5394926184i64);
    v33 = *(_BYTE *)(v29 + 5394926176i64);
    v34 = *(_BYTE *)(v29++ + 5394926224i64);
    v75.m128i_i8[v29 + 15] = v30 ^ v34;
    *((_BYTE *)&v76 + v29 + 3) = v31 ^ *(_BYTE *)(v29 + 5394926227i64);
    *((_BYTE *)&v76 + v29 + 7) = v32 ^ *(_BYTE *)(v29 + 5394926231i64);
    *((_BYTE *)&v76 + v29 + 11) = v33 ^ *(_BYTE *)(v29 + 5394926235i64);
    *((_BYTE *)&v74 + v29 + 15) = v30 ^ *(_BYTE *)(v29 + 5394926239i64);
    v75.m128i_i8[v29 + 3] = v31 ^ *(_BYTE *)(v29 + 5394926243i64);
    v75.m128i_i8[v29 + 7] = v32 ^ *(_BYTE *)(v29 + 5394926247i64);
    v75.m128i_i8[v29 + 11] = v33 ^ *(_BYTE *)(v29 + 5394926251i64);
  }
  while ( v29 < 4 );

I'm confused about the references:

*((_BYTE *)&v76 + v29 + 3) = v31 ^ *(_BYTE *)(v29 + 5394926227i64);
*((_BYTE *)&v76 + v29 + 7) = v32 ^ *(_BYTE *)(v29 + 5394926231i64);
*((_BYTE *)&v76 + v29 + 11) = v33 ^ *(_BYTE *)(v29 + 5394926235i64);
*((_BYTE *)&v74 + v29 + 15) = v30 ^ *(_BYTE *)(v29 + 5394926239i64);

These seem to be well outside the realm of any possible array? Am I missing something?

Answer 1

It looks like you're dealing with constant address around 5394926180i64 (0x141900a64) and v29 looks like an index in the array of structures. I'd say that it looks like kind of work with memory mapped registers - I had seen such a things before with various IOT devices ROMs . I'd suggest to do the following:

• Verify that you have a segment that includes the address. If not - create additional data segment that includes all mentioned addresses.
• Mark the suspicious number as offsets (just press O on them).

This should cause IDA to threat all these things as offsets in memory.

If this is low level code that deals with hardware directly you'll probably find all segment addresses either in it SDK or in the corresponding datasheet.

Answer 2

Appears I may have figured it out. In this case, it's just dereferencing offsets from 0 which ultimately point to some data in .rdata. I hadn't realized it until I modified the number representation to hex.