1

I am having some troubles with my learning of Assembly and reverse engineering. Specifically, I am learning about Global vs Local variables. For Global variables I have managed to get insights in assembly that they are stored in memory address. For Local variables I expect them to be stored on stack (theory), but my simple C code below, when being disassembled in Ghidra, does not show anything in main function.

C CODE:

void main()
{
    int x = 1;
    int y = 2;
    x = x + y;
}

GHIDRA OUTPUT:

enter image description here

Why can't I see anything in my Ghidra? It looks like an empty function to me, but clearly there should be some local variable declaration and then addition performed afterwards.

I really apologize for opening threads here often, but this is the only source where I can get help for such things. On Reddit they do not allow posting questions and referred me here.

EDIT - 25.09.2019:

As per suggestion I have added some code to my existing C Code to see if it will show up now in Assembly:

#include <stdio.h>

void main()
{
    int x = 1;
    int y = 2;

    x = x + y;

    printf("Rezultat = %d\n", x);

}

For this I had to set entry point back to CRT initialize, otherwise I could not use stdio Library. This is now the result of main function in Ghidra:

enter image description here

Now I am able to see the PUSH instruction and the value 0x03. This is probably the resulting value of addition 1 + 2, but I again can't nowhere see where are the local variables initialized nor where the arithmetic operation is performed.

4
  • 1
    The variables are not used further so compiler optimizes it to nothing. Try to create a different function and call it in main. For example add(1, 2);.
    – Biswapriyo
    Commented Sep 25, 2019 at 8:26
  • @Biswapriyo I have added some additional code to be able to see more in assembly. I have updated my initial question. There is more info now, but I still cannot see the declaration of local variables nor the use of arithmetic operation.
    – Rebegin
    Commented Sep 25, 2019 at 8:48
  • You’re free to ask as many questions as you want here, as long as they are on-topic. The purpose of this site is to help people out with RE related problems, so there is no need to apologize
    – julian
    Commented Sep 25, 2019 at 9:09
  • did you try volatile? Example: volatile int x = 1; Commented Feb 20, 2020 at 11:59

2 Answers 2

1

you may either need to use the local variables or compile with optimizations disabled

I assume you are using msvc on windows ?? shown below is a snippet that was compiled on x64 for x64 in win 10 where you can clearly see the local vars being initialized and used

f:\git\usr\bin\ls -lg
total 1
-rw-r--r-- 1 197121 61 Sep 25 15:24 local.cpp

f:\git\usr\bin\cat *
int main (void)
{
        int x = 1;
        int y = 2;
        return x+y;
}
cl /Zi /W4 -GS /analyze /Od /nologo local.cpp /link /release /ENTRY:main /SUBSYSTEM:windows /FIXED
local.cpp

f:\git\usr\bin\ls -lg *.exe
-rwxr-xr-x 1 197121 2560 Sep 25 15:32 local.exe

description of options given to compiler and linker

/Zi = build with debug info embedded in pdbfile 
/w4 build with highest possible warning level
-GS disable stack cookie
/analyze run code analysis on the src files 
/Od disable optimization
/entry:main (no crt libs are sued so you need to set the entry point
/subsystem:windows  no cmd or no crt or no input output this is not a console app 
so you need to specify which subsystem will this program work on
/fixed disable relocations

opening the exe in ghidra and the function main copied as is

                             //
                             // .text 
                             // ram: 140001000-140001022
                             //
                             **************************************************************
                             *                          FUNCTION                          *
                             **************************************************************
                             int __fastcall main(int _Argc, char * * _Argv, char * * 
             int               EAX:4          <RETURN>
             int               ECX:4          _Argc
             char * *          RDX:8          _Argv
             char * *          R8:8           _Env
             undefined4        Stack[-0x14]:4 local_14                                XREF[2]:     140001004(W), 
                                                                                                   140001016(R)  
             undefined4        Stack[-0x18]:4 local_18                                XREF[2]:     14000100c(*), 
                                                                                                   140001013(*)  

|||||||||||||||||||| FUNCTION |||||||||||||||||||||||||||||||
                             Symbol Ref: main
                             entry                                           XREF[4]:     Entry Point(*), 1400000e0(*), 
                             .text$mn                                                     1400000e4(*), [more]
                             main
       140001000 48 83 ec 18     SUB        RSP,0x18
       140001004 c7 44 24        MOV        dword ptr [RSP + local_14],0x1
                 04 01 00 
                 00 00
       14000100c c7 04 24        MOV        dword ptr [RSP]=>local_18,0x2
                 02 00 00 00
       140001013 8b 04 24        MOV        EAX,dword ptr [RSP]=>local_18
       140001016 8b 4c 24 04     MOV        _Argc,dword ptr [RSP + local_14]
       14000101a 03 c8           ADD        _Argc,EAX
       14000101c 8b c1           MOV        EAX,_Argc
       14000101e 48 83 c4 18     ADD        RSP,0x18
       140001022 c3              RET
                             ********** main Exit ********** 

if you want to disable optimization for specific functions only and not wholesale with /Od you can use #pragmas see the screen shot below which shows vscode / vsdevcmdprompt / compilation all in one

replaced the image with a gif that does a "show and show" show

enter image description here

8
  • Could you please let me know how to disable Optimizations in VS 2017? I am using that for compiling my programs. Your output is exactly what I would expect in Ghidra, but cannot get to it.
    – Rebegin
    Commented Sep 25, 2019 at 10:19
  • I added the description of the options give to compiler and linker I am using the devcmd prompt not vs projects I build on cmdline
    – blabb
    Commented Sep 25, 2019 at 10:26
  • Oh crap.. I need to learn then how to do it with devcmd, it looks like you more control over the VS attempt. Do you develop code in some texteditor and then compile it with devcmd afterwards?
    – Rebegin
    Commented Sep 25, 2019 at 10:30
  • i use vs code and its terminal for simple one file codes like like this no devcmd prompt isn't powerfull or otherwise you can specify all this in the property pages of vs just too much clickety click and i hate clicking around
    – blabb
    Commented Sep 25, 2019 at 10:34
  • hehehe, I am going to try your approach!
    – Rebegin
    Commented Sep 25, 2019 at 10:56
0

These are the compiler optimizations of the release build. You should build a debug build and then load it to ghidra

2
  • I am attempting that now. Are there any other ways to disable optimization in VS 2017?
    – Rebegin
    Commented Sep 25, 2019 at 10:28
  • In debug configuration they are disabled by default. But if you want to disable them for release build, there are project settings for that. Here's the video on how to disable optimization in VS: youtube.com/watch?v=xq7FIX3BCO4 Commented Sep 25, 2019 at 13:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.