0

I have a pseudo code in IDA which is as such

consdering v5= 3838385024767399985LL

v1 += 53 * *((char *)&v5 + i);

In C-Friendly format this should be v1 += 53 * v5[i]

Is there any way in IDA Pro to convert the above gibberish into a nicer array style value?

1
  • Provide the assembly. It will be easy to understand that if v5 is a long long or a struct/array. – Biswapriyo Oct 3 '18 at 10:10
1

If old pseudocode looks like this

int __cdecl main(int argc, const char **argv, const char **envp)
{
  signed int i; 
  int v5; 
  __int64 v6; 

  v6 = 5208208757389214273LL;
  v5 = 0;
  for ( i = 0; i <= 7; ++i )
    v5 += *((char *)&v6 + i);
  return 0;
}

Select v6 and press Y (Set lvar type in right click context). Change from __int64 v6 to char v6[8];

Now it looks like

int __cdecl main(int argc, const char **argv, const char **envp)
{
  signed int i; 
  int v5; 
  char v6[8]; 

  *(_QWORD *)v6 = 5208208757389214273LL;
  v5 = 0;
  for ( i = 0; i <= 7; ++i )
    v5 += v6[i];
  return 0;
}
4
  • Should it be 8 or 10 ? (the array size) @sudhackar – Adshead Oct 2 '18 at 19:43
  • _QWORD and __int64 are both 64bit(8 bytes) – sudhackar Oct 2 '18 at 19:47
  • I see. So, let's see the array has size like 10. How would the IDA show ? Would it use two variables _int64 and int? – Adshead Oct 2 '18 at 19:48
  • Sometimes IDA will see these optimised array assignment as qwords, you should start at the base of the string and then set the length to what you expect, IDA will automatically merge the next qwords into the string. – sudhackar Oct 2 '18 at 19:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.