4

Looking at a large x86 binary, I'm seeing lots of instances where strings are assembled on the stack as quadwords like so:

original decompiled output

If I try to set the type of puStack40 to char[38], I get the following output that's still not very helpful:

final decompiled output

I am guessing that this is because each quadword is moved in a separate instruction:

assembly

I assume there isn't, but does anyone know of a way that I can get puStack40 to be displayed as a string in the decompiler window?

(As a side note: why is this approach taken? My only guess would be to decrease the number of memory accesses. I don't think this is obfuscation since it's a large, commercial application)

Improve this question
2

1 Answer 1

Reset to default
0

https://github.com/0x6d696368/ghidra_scripts/blob/master/SearchSimpleStackStrings.md https://github.com/0x6d696368/ghidra_scripts/blob/master/SimpleStackStrings.md

The only difference looks like search vs at current cursor position

Improve this answer
1
  • 1
    This is helpful, but I'm asking if there's a way to set the data types such that there is a char array on the stack. The script(s) you linked only set comments as to what the strings are. I'm thinking I'll have to patch the program to accomplish this
    – genghiskhan
    Commented May 2, 2020 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.