2

Some times the psuedo code generated by IDA is baffling

v8 = (signed int)&loc_100010; //ida
v8 = 0x100010; //actual code

This is not so bad when it is just one value but sometimes the offset for member variables are also distorted this way

v2 = a1 + (_DWORD)&loc_2043B90 - 33831600); //ida
v2 = a1 + 224; //actual offset

This makes for horrible readability and it is even worse for arrays. Is there a way to fix this?

This happens a lot with floating point numbers

v63 = **(float **)((char *)&loc_15D9503 + 33831601)

I should add this is a MACH-O x86 binary (if that matters)

0

Names with loc_ prefix are generated in case IDA thinks that it's code at that address. So now IDA thinks that theres' code at 2043B90 and at 100010.

You should go to 2043B90 (in the disassembly view), undefine the code piece which IDA create and create a data structure there, then specify the type information (Y key) that it's an array like "int myarray[300]". This is just an example, you need to determine the type of the data yourself.

As for loc_100010, you should also go to the address 100010 undefine the code there and create a string, if you think that there's a literal.

Then press F5 in you function again to renew the decompiler output.

p.s. IDA might want to keep the loc_ names even after you undefine the code piece, so you'll need to delete this loc_ name in order to make IDA generate the new one.

  • But it is a literal value and not a data structure. An integer not an array of ints – Sinister Mephisto May 17 '18 at 9:42
  • I tried it and got v8 = (signed int)&loc_1048592D; – Sinister Mephisto May 17 '18 at 18:19
  • I've update the answer, I hope it helps. – Anton Kukoba May 22 '18 at 8:13
  • Thanks for the reply/update. When i undefined the code it simply replace loc_xxxx with unk_xxxx – Sinister Mephisto May 24 '18 at 13:30

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.