0

Recently, i have gone through some kind of win32-64 executable files which can't be decompiled under IDA (into Pseudocode). Only the Assembly Code can be read. When i try to press F5 to decompile the file,it only shows me a Diaglog Box says "Positive Stack Value found".The Debugging process is still fine.It's just i can't not decompile the file into c source code.

I wonder how can they do that? I mean they can make the executable unable to decompile under IDA or maybe other Disassembler.

I want to accomplish this using other compilers such as GCC,MinGW,Clang,or even Turbo.

Improve this question

1 Answer 1

Reset to default
4

When you encounter this kind of error, just make sure that the stack pointer is aligned.

enter image description here

Go to Options tab.

enter image description here

Click General...

enter image description here

Click the Stack Pointer.

It will show the stack pointers at the left side. enter image description here

enter image description here

Click the sub esp, 0x15c, press Alt+k, then click OK.

enter image description here

So it must be able to solve your problem.

enter image description here

Press F5.

enter image description here

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.