6

With Microsoft Visual C++ executables, I often run into decompilations like this:

void __cdecl Pbdf::ReadString(char *dst, Pbdf *pbdfOrLength)
{
    Pbdf *pbdf; // esi

    pbdf = pbdfOrLength;
    Pbdf::ReadBytes(&pbdfOrLength, 1, pbdfOrLength);
    Pbdf::ReadBytes(dst, (unsigned __int8)pbdfOrLength, pbdf);
    dst[(unsigned __int8)pbdfOrLength] = 0;
}

The function is actually more like this (as seen in a Watcom executable doing the same thing):

void __usercall Pbdf::ReadString(char *dst@<eax>, Pbdf *pbdf@<edx>)
{
    unsigned __int8 length; // [esp+0h] [ebp-14h]

    Pbdf::ReadBytes(pbdf, &length, 1u);
    Pbdf::ReadBytes(pbdf, dst, length);
    *((_BYTE *)dst + length) = 0;
}

So, from a Pbdf file-like struct, it's reading a single byte determining the number of following bytes to read into a buffer, and terminates that buffer with a 0.

However, in the MSVC decompilation, you can see it merged the length and Pbdf struct into one variable, causing me to name the variable "pbdfOrLength".

Is it somehow possible to tell the decompiler to "split" these variables up / handle them as two separate ones, to get an output similar to what is seen in Watcom?

3

I don't think there's a way to add a new function variable, since the decompiler creates those based on registers and stack locations.

However, in situations where it's really annoying, creating a union type in the Structure viewer can be helpful.

Union Definition

Then, in your decompiler, set the type of the variable to the union type (Y is the keyboard shortcut). variable type declaration

In the disassembly, depending on the variable usage, you can use "Alt-Y" to select the appropriate union field. (it's also accessible in the right click menu) Union field select

  • Good idea. It would not be able to fix displaying of the variable in the second line, where the addressof operator is used on the merged variable (still displays only &pbdfOrLength without any member access), but I guess this is the best solution possible. – Ray Koopa May 8 '18 at 20:36
  • Bummer. I didn't realize it would act that way for the address operator. Appreciate the info. – mayahustle May 8 '18 at 21:48
0

I don't think there's any such feature in the IDA interface, nevertheless there's API in IDA SDK which allows you to create register variables: https://www.hex-rays.com/products/ida/support/sdkdoc/group__regvar.html#ga5f77d2c231f8faeb5939be2bc8e2a298

  • 1
    That doesn't create a new decompiler variable. That's for re-naming a variable in the disassembly (Put your cursor over a register and hit "N"). – mayahustle May 8 '18 at 19:01

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.