0

After show the pseudo code in IDA I see different results:

enter image description here

enter image description here

The function 4436C0 show different pseudo code.

For example:

result = sub_4376C0("vvcbb3.wav",v8,0);

and

result = sub_4376C0((int)"vvcbb3.wav",v8,0);

Have you never seen a similar situation?

It is a IDA bug ?

7
  • 2
    Hi! A couple of points you need to mention to make this question better 1. Post code as text instead of pictures 2. Please add more details on what's the exact "result" that you were expecting and what's happening. Also add more context to the problem if you can.
    – sudhackar
    Jul 17, 2020 at 7:13
  • 1
    If you open a function in decompile view in IDA, IDA will try to guess the type of the function args based heuristics such as the operations that are performed over them. You might have decompiled sub_4376C0 after you took the first screenshot and then return back to sub_4436C0
    – sudhackar
    Jul 17, 2020 at 7:34
  • Thank you !!!I have hook correct the function sub_4376C0 and work fine. but the first parameter is a integer and I need get the real string value passed "vvcbb3.wav" inside this function: result = sub_4376C0((int)"vvcbb3.wav",v8,0); sub_4376C0(int a1, int a2, int a3) Do you known how I can get the string passed of the first parameter ? Jul 17, 2020 at 11:41
  • You can modify the function definition at any time in IDA. by doing so you can change the type of every parameter or even add/remove parameters that have been detected incorrectly (assuming you know the exact function definition).
    – Robert
    Jul 17, 2020 at 11:50
  • thank you Robert, if possible I like to avoid to update the game exe. For your opinion is possible get the string value by modify my hook.dll c++ source code ? Jul 17, 2020 at 12:16

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.