6

I've been thinking of reversing some firmware I have laying around. One characteristic of the firmware is that it is compiled using lots of pre-processor macros. Now, as I understand it, these are not included in the binary, so a decompiler cannot help with these. Is there any way to recover these? Is there a known technique for inferring their existance?

2
  • Although the answers seem to be authoritative in their "No", I don't see offhand why such a translation system couldn't be written to at least make an effort. At heart, think of this as text substitution going on which is sometimes reversible. If my macro does a substitution of "abc" -> "x" and "def" -> "x", then when I see "x" it might be "abc" or "def" or just "x". Bad. However in practice it works the other way where the bigger and more unique string is generally on the right-hand side. So I imagine that there might be some situations that could be detected.
    – rocky
    Oct 25 '17 at 6:29
  • When I wrote the post I was thinking more from a heuristic type of place, like if you saw a piece of code that seemed to be copied in a way consistent with the way the compiler handles a macro. In retrospect that would be pretty hard/impossible.
    – baordog
    Oct 25 '17 at 8:58
9

No. Decompilers can include special pattern-matching heuristics layered on top of their other functionality to detect macros, but in general, macros are just pieces of code that get treated by the compiler the same way as other pieces of code. They might be subject to optimizations that transform their appearance, such as constant propagation, dead code elimination, common subexpression elimination, loop-invariant code motion, etc. which means they might not manifest themselves with an easy-to-solidify syntactic pattern that can be matched against. Your options are basically to write a post-pass for the decompiler (e.g. a Hex-Rays plugin) or to identify the macros manually.

1
  • 1
    And you may as well forget about conditional compilation.
    – Antimony
    Jun 1 '13 at 2:47
3

No.
Macros are pieces of code that you have named.
At compilation time when the compiler encounters a macro it just replaces it with the code behind it, then continues the compilation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.