0

Here is an example of a subroutine as pseudocode in IDA:

HRESULT __stdcall func(PCWSTR name, PCWSTR command, BOOL folder, DWORD *pCode) {
  _OWORD *v4;
  __int128 v5, v12, v13;
  __int64 v6;
  HRESULT v11;
  DWORD **v14;
  PCWSTR v16, v17; BOOL v18; DWORD *v19;

  v19 = pCode; v18 = folder; v17 = command; v16 = name;
  v11 = 0x80004005;
  *(_QWORD *)&v12 = &v11;
  *((_QWORD *)&v12 + 1) = &v16;
  *(_QWORD *)&v13 = &v17;
  *((_QWORD *)&v13 + 1) = &v18;
  v14 = &v19;
  v4 = (_OWORD *)sub_1800050B4(40i64); //contains malloc
  if ( v4 ) {
    v5 = v13;
    *v4 = v12;
    v6 = (__int64)v14;
    v4[1] = v5;
    *((_QWORD *)v4 + 4) = v6;
  }
  function(v4);
}

It is easy to understand the pointer offsets with v12 and v13. But some subroutines have many more variables which is not easy to follow. So can I convert that pointer offsets to an array? And why IDA shows so many local variables?

Improve this question

1 Answer 1

Reset to default
1

IDA deals with optimized assembler generated by the compiler. In this case compiler definitely combined several values into 128-bit registers and several stack locations. IDA doesn't know what it was initially, it can only guess. So it uses the stack locations and registers as if they are the variables in the source code. To understand it better you should read about 'Stack Frame'.

As for making the array, you should change the type of v12 variable to void * [4]. This is done via selecting v12 and pressing Y.

Improve this answer
4
  • How did you get void* [4] ? Why not void* [2] ? When I use [4] IDA shows error "New variable size is bigger than the old one".
    – Biswapriyo
    Apr 4, 2018 at 13:11
  • Yes the array will be bigger then initial tiny variable which IDA created. And it's ok. void* [2] may be correct too, if you're sure that there were two arrays in v12 and v13, not one big array of 4 elements which is placed in both stack location. My experience tells me that it looks like one big array. Anyway you'll be able to delete the function and decompile again if you did some mistake. It's eternal learning :)
    – Anton Kukoba
    Apr 4, 2018 at 13:21
  • void* [4] combines all the variables. It is better than [2]. Should I have to do some trial and error?
    – Biswapriyo
    Apr 4, 2018 at 13:23
  • 1
    nope, it's all the alternative representations of the data, IDA doesn't care.
    – Anton Kukoba
    Apr 4, 2018 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.