I'm currently working on a binary that has encrypted strings, using IDA 7.0. The encrypted data is copied to another location in memory, which is then decrypted. I have already decrypted the strings in-place, but due to the way the strings are accessed the decompiler is having trouble resolving them.
This is an example of ASM that accesses a decrypted string:
mov rcx, cs:StringTableOffset lea rax, cs:180000000h lea rcx, [rcx+rax+130A4h] call cs:GetModuleHandleA
For the purpose of reversing,
StringTableOffset can be considered 0, so the final
lea instruction effectively just moves the value
rcx. The decompiler doesn't know that, though, and shows pointer arithmetic instead.
|| ((v11 = GetModuleHandleA((LPCSTR)(StringTableOffset + 0x1800130A4i64))
Is there any way to signal to the decompiler that the value of
rcx (the argument to GetModuleHandleA) is known, so that it can display the defined string?