IDA 6.8 + Hex-Rays Plugins: HexRaysCodeXplorer, HexRaysPyTools

I am faced with strange things.

// Before
int sub_406350()
// After
int __usercall sub_406350@<eax>(int a1@<ebp>)

// Before
int __cdecl sub_403B80(unsigned __int16 a1, unsigned __int16 a2, int a3)
// After
int __usercall sub_403B80@<eax>(int a1@<ebp>, unsigned __int16 a2, unsigned __int16 a3, int a4)

And so on, and so on...

What's going on? Why Hex-Rays changes a signature of the function? How to prevent this? How to revert 270 functions back to the original shape? How dangerous are these changes?

As far as I know, this means that part of the arguments are passed through registers, bypassing the calling convention. Does this mean that the stack has shifted somewhere, and if I return it back, everything will go back to the normal shapre?


Ok, I see, some of arguments passed via registers:

// Before:
int __cdecl CheckMagicNumber(void* dataBuffer)
// After:
int __usercall CheckMagicNumber@<eax>(int expectedMagicNumber@<ecx>, int bufferSize@<ebp>, void* dataBuffer)

But how to run such analize to find and correct functions like this?

  • As far as I can tell Hex-rays don't do it "automatically", you must have done something for this to change. – user202729 Oct 23 '18 at 16:14
  • Yeah, but Idk what I did to change it like this. :( – Albeoris Oct 23 '18 at 16:40
  • Calling conventions depends on memory stack and cpu register usage. Analyse the assembly carefully. You can manually change function prototype in pseduocode. Read this: en.wikipedia.org/wiki/X86_calling_conventions – Biswapriyo Oct 23 '18 at 19:38
  • @Biswapriyo, yes, I know, but idk what I did to change it for hundreds of functions. :( – Albeoris Oct 24 '18 at 18:45

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.