2

I often have some code like this on the beginning of every function of a decompiled program:

iVar1 = 0x42;
  puVar2 = local_10c;
  while (iVar1 != 0) {
    iVar1 = iVar1 + -1;
    *puVar2 = 0xcccccccc;
    puVar2 = puVar2 + 1;
  }

0xcccccccc in web search seems related to "uninitialized memory" but I don't see the link with this blanket code.

What is it? What purpose does it have? Why is it there as "template" for every function?

  • Thanks a lot for the answers. – Phil L. Jun 17 at 7:41
2

0xCC stands for int 3 in x86 architecture, that is a special interrupt used to implement software breakpoint by debuggers.

So, this code sets the memory to int 3 interrupts for debugging purposes. Imagine that the code accidentally jumps to some random location. If some garbage bytes are there, the behaviour is undefined.

However, in case where such a jump accesses int 3 instruction, it will just cause software breakpoint in the debugger thus preventing udefined behaviour from happening and showing you that some strange jump happened and stopping the execution at this point, exectly as in the case you set a breakpoint there.

Note: Moving 0xCCCCCCCC just sets 4 contiguous bytes to 0xCC.

2

This is probably code compiled by Visual C++ in debug build setting. In such case, the compiler generates code which fills all stack variables with the byte 0xCC, so that any uninitialized value is clearly visible during debugging. See also https://stackoverflow.com/a/11865164

  • It's worth mentioning that int 3 invokes a software breakpoint, while the answer you gave a link to says that it invokes a hardware one. – bart1e Jun 16 at 12:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.