Split variable in Hexrays decompiler?

Question

With Microsoft Visual C++ executables, I often run into decompilations like this:

void __cdecl Pbdf::ReadString(char *dst, Pbdf *pbdfOrLength)
{
    Pbdf *pbdf; // esi

    pbdf = pbdfOrLength;
    Pbdf::ReadBytes(&pbdfOrLength, 1, pbdfOrLength);
    Pbdf::ReadBytes(dst, (unsigned __int8)pbdfOrLength, pbdf);
    dst[(unsigned __int8)pbdfOrLength] = 0;
}

The function is actually more like this (as seen in a Watcom executable doing the same thing):

void __usercall Pbdf::ReadString(char *dst@<eax>, Pbdf *pbdf@<edx>)
{
    unsigned __int8 length; // [esp+0h] [ebp-14h]

    Pbdf::ReadBytes(pbdf, &length, 1u);
    Pbdf::ReadBytes(pbdf, dst, length);
    *((_BYTE *)dst + length) = 0;
}

So, from a Pbdf file-like struct, it's reading a single byte determining the number of following bytes to read into a buffer, and terminates that buffer with a 0.

However, in the MSVC decompilation, you can see it merged the length and Pbdf struct into one variable, causing me to name the variable "pbdfOrLength".

Is it somehow possible to tell the decompiler to "split" these variables up / handle them as two separate ones, to get an output similar to what is seen in Watcom?

Answer 1

I don't think there's a way to add a new function variable, since the decompiler creates those based on registers and stack locations.

However, in situations where it's really annoying, creating a union type in the Structure viewer can be helpful.

Then, in your decompiler, set the type of the variable to the union type (Y is the keyboard shortcut).

In the disassembly, depending on the variable usage, you can use "Alt-Y" to select the appropriate union field. (it's also accessible in the right click menu)

Answer 2

I don't think there's any such feature in the IDA interface, nevertheless there's API in IDA SDK which allows you to create register variables: https://www.hex-rays.com/products/ida/support/sdkdoc/group__regvar.html#ga5f77d2c231f8faeb5939be2bc8e2a298