0

While reading this paper on type recovery from executables, I came across following paragraph:

It is worth noting that the domain of parameters of a function can be considered as a structure placed on the stack; in this case, the register %ebp points to the beginning of this structure. For that reason, the automatic detection of the structured types located at the stack (local variables and function parameters of a structured type) is very complicated and is not considered in this paper.

And they mentioned that they don't consider such structures in their analysis. Do they simply mean programs like these?

#include <stdio.h>

struct P
{
  int a;
  int b;
};

int main()
{
  struct P p, *pp;
  pp = &p;
  pp->a = 4;
  printf("%d\n", pp->a);
  return 0;
}

Or is there any other way which resonates their statement?

2

Consider a function like this:

int func1(int x)
{
  int y;
  char buf[16];
  y = x;
  buf[0]=x&0xff;
  return y+buf[0];
}

If the compiler uses a naive variable allocation algorithm and does not try to use registers for variables, it will likely lay out the variables sequentially in the stack:

off|
00 | y dd ?
04 | buf db 16 dup ?

Which can be thought of as a structure:

 struct frame_func1
 {
    int y;
    char buf[16];
 };

In reality, the "base" of the structure will not be ebp, since usually it points between local variables and incoming arguments, i.e "after" this pseudo-structure.

I'm not quite sure why the paper goes to the conclusion mentioned in your quote. Maybe the authors mean that detecting local variables which are structures would be akin to detecting structure members in a structure an thus out of scope? Not sure....

| improve this answer | |
  • Although this doesn't ans the question, thanks for this great explanation – R4444 Apr 7 at 15:38
  • 1
    @R4444 I understand the paper the same as Igor. Why it doesn't answer your question? – Paweł Łukasik Apr 10 at 19:09
  • hmmm, I take it back it does answer the question, though the conclusion (of paper authors) is convoluted. thanks – R4444 Apr 10 at 19:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.