0

I want to make all local variables contained in a structure with appropriate padding put in the gaps (unused parts of the frame). I want to do the same for the global data. And I want to rename identifiers to be in compliance with the compilers standard.

I looked at the Hex-Rays SDK but I gave up at the point there was a comment in the headers stating that deleting local variables would require to fix-up references.

Maybe there is a way to aid the decompilation process instead of trying to apply fixups later. Or maybe it wouldn't be so scary to transform all the locals into a structure. Has anyone attempted something similar before?

4
  • Your question is unclear. You want to create a structure in the data section? You want all local variables to be in a structure? You want to delete local variables? What are you actually trying to do? – Rolf Rolles Mar 6 at 19:02
  • @RolfRolles I want to put all local variables in a structure where each section that is not used will be padded with dummy variables. Same for the globals. Because currently the decompiled output simply assumes that only direct references exists. Where an indirect reference may need bytes after or before the direct referenced region. – rec Mar 6 at 19:09
  • 1
    Your response says basically the same thing as the question. It is possible to write a script/plugin that creates structures on the stack; I have one. It's probably not a good idea to do that automatically; I only use it in a manual capacity. As for doing that in the data section, are you familiar with: selecting a group of data, right-click, "Create struct from selection"? – Rolf Rolles Mar 6 at 21:19
  • @RolfRolles OK thanks for the answer - I was able to write a custom plugin that simply copies the frame lvar section into a structure and replaces all the local variables with it (Sometimes though the Hex-Rays decompile ignores this fact and create distinct variables anyway but it's possibly for good). Right now I'm on the segments part - yes there seem to be an option in the IDA interface but I don't seem like waiting ten ages for it to complete. – rec Mar 7 at 16:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.