0

I've been a bit stumped recently on my decomp work. I've not dealt with C in depth nor have I dealt with IDA's pseudocode system very much at all. I understand asm, but because of how IDA merges instructions together in its pseudocode system, I'm having some trouble finding out how this translates.

In my pseudocode I have the following line:

// v1 is a pointer to RDI (stored as a single in pseudocode)
// v7 is a pointer to R8 (stored as a single in pseudocode)
// v10 is XMM1 (single)

v1[1818] = (float)(v10 * (float)(*v7 - v7[1])) + v7[1];

I'm having trouble understanding what the square brackets do. I was thinking that it was an offset (e.g. "set the data at the location of v1 in memory + 1818i64 bytes to...") but the asm doesn't match up with that addr. What's the difference between setting v1 = vs setting v1[1818] =?

Improve this question
3
  • 1
    In C they denote an array access. To correspond with assembly you might have to multiply the index with size of one member of the array.
    – sudhackar
    Sep 26 '19 at 3:19
  • 1
    Ah-ha! Yes, you were right. That was my mistake. I forgot to multiply 1818 by the size of the value (4 in this case, since it's a single). Suppose I'm just too used to the asm usage of [], yeah? I found the line movss dword ptr [rdi+1C68h], xmm1 -- rdi+1C68h is indeed the right location after doing RDI+(4*1818i16).
    – Eti the Spirit
    Sep 26 '19 at 3:29
  • 2
    If your problem is solved, please write a short answer, accept it and close this question.
    – sudhackar
    Sep 26 '19 at 10:44
2

I've found out how this works. I had the right idea, but I had made the mistake of assuming it was n bytes ahead, failing to factor in the size of the actual value at hand.

Since the specific type of v1 was a single, this means I had to multiply the 1818 by 4 bytes. Looking at the corresponding ASM, movss dword ptr [rdi+1C68h], xmm1, I can see that rdi+1C68h comes out to v1 (rdi) + 7272i64 or rdi+1C68h - it checks out.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.