3

Some portion of code I am analyzing gets decompiled as below in ghidra:

if (((*puVar8 == CONCAT22(DAT_0040a37a,DAT_0040a378)) &&
     (*(uint *)((int)puVar9 + 6) ==
     (CONCAT22(DAT_0040a37e,DAT_0040a37c) | (int)DAT_0040a37a >> 0xf))) &&
     ((*(short *)((int)puVar9 + 10) == 0x20 || (*(short *)((int)puVar9 + 10) == 0)))) {
    local_2c8.PrivilegeCount = local_2c8.PrivilegeCount | 4;
  }

I want to understand what this CONCAT22 is. This is found at multiple places in the same function.

  • When you click on the CONCAT22 statement it should show the corresponding disassembly. Please include this disassembly – julian Oct 9 at 2:00
5

I wanted to comment but it grew up so answering

CONCAT is Concatenation

22 is a suffix that denotes concatenate two bytes with two bytes

it takes two bytes from first location two bytes from second location and produces a 4 byte result

here it is probably making a wide character string

you can see the difference of two bytes in the address too xxa37e,yya37c etc

as commented click on the address or macro to go to the disassembly and look at the construct

here is a big concat

return CONCAT2325(extraout_var,CONCAT124(1,CONCAT816(local_48,CONCAT88(uVar3,local_58)))) &
       0xffffffffffffffff;

concat           88 = 8+8  say something RDX+rcx   
next is          816 which means 8 + 16      << 16 is from earlier concat   
next is          124 which means 1 + 24      << 24 is from earlier concat   
next is          2325 which means 23 + 25     << 25 is from earlier concat   

and the relevant disassembly for this decompilation

00461277 48 89 84        MOV        qword ptr [Stack[0x18] + RSP],RAX
         24 80 00 
         00 00
00461284 48 89 84        MOV        qword ptr [Stack[0x20] + RSP],RAX
         24 88 00 
         00 00
0046128c c6 84 24        MOV        byte ptr [Stack[0x28] + RSP],0x1
         90 00 00 
         00 01
00461297 0f 11 84        MOVUPS     xmmword ptr [Stack[0x30] + RSP],XMM0
         24 98 00 
         00 00
004612a8 c3              RET
                     ********** bufio.(*Reader).ReadLine Exit ********** 
  • "next is 2335" should probably be "next is 2325" – Rok Tavčar Oct 9 at 6:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.