0

I have this function, named __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6__initEPKcm.

And this is the relevant assembly:

mov     rdi, [rbp+var_A80]
mov     rsi, [rbp+var_A88] 
mov     rdx, [rbp+string_length]
call    __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6__initEPKcm

From what I've noticed by looking at the registers before and after calling the function, the address of RSI is incremented by string_length, but I still have no idea what RDI is doing.

Another weird thing is that the string length reported by the register is 0x046, but the address is incremented by 0x040.

The RDI is 00007FFEEFBFF240 before the call, 0000000100400040 after it.

EDIT:

IDA is not letting me debug the function, as it throws SIGBUS.

I am slowly reversing the function, i'll update here with progress.

RDI is compared with 0FFFFFFFFFFFFFFF0h (Why?)

Improve this question
3
  • This is most likely just a std::string constructor. From personal experience with STL code, take educated guesses and move on. You'll turn crazy if you reverse all of it. I usually just check xrefs to some function and if it looks like it may be simply creating an std::string from a C string, I treat the function as such until further context shows it doesn't.
    – Johann Aydinbas
    Commented Feb 27, 2019 at 16:27
  • One more tip to make code more readable: Go to Options -> Demangled names -> Select names so you don't have to look at 500 character mangled names all day.
    – Johann Aydinbas
    Commented Feb 27, 2019 at 16:30
  • it is a gcc demangled name _std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >::__init(char const*, unsigned long) as suggested turn on demangling in options and iirc ida should probably show it as standard function using flirt
    – blabb
    Commented Feb 27, 2019 at 21:24

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.