0

Looking at a large x86 binary, I'm seeing lots of instances where strings are assembled on the stack as quadwords like so:

original decompiled output

If I try to set the type of puStack40 to char[38], I get the following output that's still not very helpful:

final decompiled output

I am guessing that this is because each quadword is moved in a separate instruction:

assembly

I assume there isn't, but does anyone know of a way that I can get puStack40 to be displayed as a string in the decompiler window?

(As a side note: why is this approach taken? My only guess would be to decrease the number of memory accesses. I don't think this is obfuscation since it's a large, commercial application)

  • 1
    Can you post the actual text (formatted as code) instead of images? – usr2564301 May 2 at 10:46
-1

https://github.com/0x6d696368/ghidra_scripts/blob/master/SearchSimpleStackStrings.md https://github.com/0x6d696368/ghidra_scripts/blob/master/SimpleStackStrings.md

The only difference looks like search vs at current cursor position

| improve this answer | |
  • This is helpful, but I'm asking if there's a way to set the data types such that there is a char array on the stack. The script(s) you linked only set comments as to what the strings are. I'm thinking I'll have to patch the program to accomplish this – genghiskhan May 2 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.