0

I'm trying to analyze a binary that I unpacked, rebuilt, and dumped, using Scylla. After loading it into IDA and viewing pseudocode, I can see that there are errors where IDA tells me that it notices writes to constant memory addresses. After some searching online, I find that this seems quite common, but I haven't really come across a solution for fixing it, and I've just tried to ignore it up to now.

enter image description here

enter image description here

At first, I tried to just change all my segments to have write access, but that didn't seem to change anything. 0x007F944F is the first memory error.

Would anyone mind telling me how I go about to solve this? Thank you.

EDIT: Here is the entire disassembly of that function:

.MPRESS1:007F93F2                     align 10h
.MPRESS1:007F9400
.MPRESS1:007F9400     ; =============== S U B R O U T I N E =======================================
.MPRESS1:007F9400
.MPRESS1:007F9400     ; Attributes: bp-based frame
.MPRESS1:007F9400
.MPRESS1:007F9400     sub_7F9400      proc near               ; CODE XREF: Stool__ctor+6F↑p
.MPRESS1:007F9400                                             ; Stool__ctor+91↑p ...
.MPRESS1:007F9400
.MPRESS1:007F9400     a3              = dword ptr  8
.MPRESS1:007F9400     u0              = dword ptr  0Ch
.MPRESS1:007F9400
.MPRESS1:007F9400 000                 push    ebp
.MPRESS1:007F9401 004                 mov     ebp, esp
.MPRESS1:007F9403 004                 cmp     ds:lpParameter, 0
.MPRESS1:007F940A 004                 jz      short loc_7F9410
.MPRESS1:007F940C 004                 xor     eax, eax
.MPRESS1:007F940E 004                 pop     ebp
.MPRESS1:007F940F 000                 retn
.MPRESS1:007F9410     ; ---------------------------------------------------------------------------
.MPRESS1:007F9410
.MPRESS1:007F9410     loc_7F9410:                             ; CODE XREF: sub_7F9400+A↑j
.MPRESS1:007F9410 004                 push    esi             ; a2
.MPRESS1:007F9411 008                 push    offset sub_7F49C0 ; lpTopLevelExceptionFilter
.MPRESS1:007F9416 00C                 call    ds:SetUnhandledExceptionFilter
.MPRESS1:007F941C 008                 push    3DA4h           ; size_t
.MPRESS1:007F9421 00C                 mov     esi, eax        ; a2
.MPRESS1:007F9423 00C                 call    ??2@YAPAXI@Z    ; operator new(uint)
.MPRESS1:007F9428 00C                 add     esp, 4
.MPRESS1:007F942B 008                 test    eax, eax
.MPRESS1:007F942D 008                 jz      short loc_7F9438
.MPRESS1:007F942F 008                 mov     ecx, eax
.MPRESS1:007F9431 008                 call    StoolGuard__ctor
.MPRESS1:007F9436 008                 jmp     short loc_7F943A
.MPRESS1:007F9438     ; ---------------------------------------------------------------------------
.MPRESS1:007F9438
.MPRESS1:007F9438     loc_7F9438:                             ; CODE XREF: sub_7F9400+2D↑j
.MPRESS1:007F9438 008                 xor     eax, eax
.MPRESS1:007F943A
.MPRESS1:007F943A     loc_7F943A:                             ; CODE XREF: sub_7F9400+36↑j
.MPRESS1:007F943A 008                 push    [ebp+a3]        ; a2
.MPRESS1:007F943D 00C                 mov     ecx, eax        ; a1
.MPRESS1:007F943F 00C                 mov     ds:lpParameter, eax
.MPRESS1:007F9444 00C                 call    sub_7F6610
.MPRESS1:007F9449 008                 mov     ecx, ds:lpParameter
.MPRESS1:007F944F 008                 mov     [ecx+10h], eax
.MPRESS1:007F9452 008                 cmp     eax, 755h
.MPRESS1:007F9457 008                 jz      short loc_7F9460
.MPRESS1:007F9459 008                 call    sub_7F4B00
.MPRESS1:007F945E 008                 jmp     short loc_7F9476
.MPRESS1:007F9460     ; ---------------------------------------------------------------------------
.MPRESS1:007F9460
.MPRESS1:007F9460     loc_7F9460:                             ; CODE XREF: sub_7F9400+57↑j
.MPRESS1:007F9460 008                 cmp     ds:byte_8EB238, 0
.MPRESS1:007F9467 008                 jz      short loc_7F9476
.MPRESS1:007F9469 008                 push    offset byte_8EB238 ; lpString
.MPRESS1:007F946E 00C                 call    SToolGameGuard__Nop3
.MPRESS1:007F9473 00C                 add     esp, 4
.MPRESS1:007F9476
.MPRESS1:007F9476     loc_7F9476:                             ; CODE XREF: sub_7F9400+5E↑j
.MPRESS1:007F9476                                             ; sub_7F9400+67↑j
.MPRESS1:007F9476 008                 mov     eax, ds:lpParameter
.MPRESS1:007F947B 008                 mov     eax, [eax+18h]
.MPRESS1:007F947E 008                 test    eax, eax
.MPRESS1:007F9480 008                 jz      short loc_7F9489
.MPRESS1:007F9482 008                 push    eax             ; hEvent
.MPRESS1:007F9483 00C                 call    ds:SetEvent
.MPRESS1:007F9489
.MPRESS1:007F9489     loc_7F9489:                             ; CODE XREF: sub_7F9400+80↑j
.MPRESS1:007F9489 008                 mov     eax, ds:lpParameter
.MPRESS1:007F948E 008                 mov     eax, [eax+1Ch]
.MPRESS1:007F9491 008                 test    eax, eax
.MPRESS1:007F9493 008                 jz      short loc_7F949E
.MPRESS1:007F9495 008                 push    0               ; uExitCode
.MPRESS1:007F9497 00C                 push    eax             ; hProcess
.MPRESS1:007F9498 010                 call    ds:TerminateProcess
.MPRESS1:007F949E
.MPRESS1:007F949E     loc_7F949E:                             ; CODE XREF: sub_7F9400+93↑j
.MPRESS1:007F949E 008                 test    esi, esi
.MPRESS1:007F94A0 008                 jz      short loc_7F94A9
.MPRESS1:007F94A2 008                 push    esi             ; lpTopLevelExceptionFilter
.MPRESS1:007F94A3 00C                 call    ds:SetUnhandledExceptionFilter
.MPRESS1:007F94A9
.MPRESS1:007F94A9     loc_7F94A9:                             ; CODE XREF: sub_7F9400+A0↑j
.MPRESS1:007F94A9 008                 mov     eax, ds:lpParameter
.MPRESS1:007F94AE 008                 pop     esi
.MPRESS1:007F94AF 004                 mov     eax, [eax+10h]
.MPRESS1:007F94B2 004                 pop     ebp
.MPRESS1:007F94B3 000                 retn
.MPRESS1:007F94B3     sub_7F9400      endp
.MPRESS1:007F94B3
.MPRESS1:007F94B3     ; ---------------------------------------------------------------------------
Improve this question
1
  • I'm not sure that decompiler generates correct code. Can you post the assembly code of the whole function ?
    – w s
    Jan 27, 2020 at 6:39

2 Answers 2

Reset to default
1

At a guess, lpParameter is located in a segment marked read-only (e.g. a code section), so the decompiler considers its value to be constant (probably zero) which is why all subsequent accesses are also zero-based. There are two solutions:

  1. Mark the segment containing lpParameter to be writable (edit segment properties). In case the writable data is a small part of the otherwise read-only segment, creating a new segment just for data is a good idea

  2. Mark only lpParameter as writable by adding volatile specifier to its type definition (use the Y key). In a similar manner, an otherwise writable variable can be marked as constant by adding a const specifier.

Reference: Volatile and Constant memory.

Improve this answer
3
  • Thank you! This is very helpful. I will give this a try when I get an opportunity.
    – Ci3
    Jan 27, 2020 at 16:18
  • Option 2 is the only one that worked fully. I did try to create a new segment just for the data, but even though the writable flag was checked, it did not resolve it. However, option 2 works just fine for me. Thank you!
    – Ci3
    Jan 27, 2020 at 18:07
  • @Ci3: the segment name and class are also important, see the link.
    – Igor Skochinsky ♦
    Jan 27, 2020 at 18:08
1

As far as I can see according to the decompiler output the program accesses not-existing (not created) segment at address 0x0. This may be a reason why it thinks that some memory is not writeable. You can check this by creating a segment with r/w permissions at address 0 and size at least 0x20.

In addition as we can see from the full listing of the function the decompiler does not generate a correct code. All the accesses marked as MEMORY[SOME_OFFSET] should be relative to ds:lpParameter, not to 0.

Improve this answer
7
  • Yeah, that does seem to make the MEMORY parts go away. I don't understand why it would be trying to write to address 0x0. What could be at that address?
    – Ci3
    Jan 27, 2020 at 7:18
  • That's why I asked in comment to provide the full listing of the function. I'm not sure that decompiler works properly. If I understand correctly the posted part of assembly code it should write to the same offsets related to lpParameter, not to 0.
    – w s
    Jan 27, 2020 at 7:56
  • Sure, I provided the full function. I agree, to me it seems it should write to offsets of lpParameter...
    – Ci3
    Jan 27, 2020 at 8:04
  • So, what value do you have in lpParameter ? Is it marked as offset ?
    – w s
    Jan 27, 2020 at 8:06
  • 1
    Thank you for your help. I marked lpParameter as volatile and this solved it.
    – Ci3
    Jan 27, 2020 at 18:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.