I am getting started with Ghidra, and am decompiling a simple program of mine. The platform is Linux (ELF) on ARM. I found in the decompiled code things like:

gTime._0_4_ = (undefined4)(time1 >> 0x20);
gTime._4_4_ = (undefined4)time1;

Here, gTime is a global and time1 a local. Both should be 64 bit integers (uint64_t). I've alreads set the types accordingly. This code is setting the high bits of gTime to the high bits of time1 and the same for the low bits. Is there any way I could transform this to:

gTime = time1

Or is there e.g. an endianness issue here? At some places, it also has the similarly redundant:

uVar1 = CONCAT44(gTime, gTime._4_4)

I was expecting to be able to select the code and "refactor" it to an equivalent form. The only thing that I could find was the "retype" function, with works great, but not here. Any ideas how to clean up this code a bit?

  • 1
    Can you post the disassembly? It seems like it sets the higher part of time to the lower part of gTime and the lower part of time to the higher part of gTime – NotGI May 3 '19 at 13:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.