I'm new to ghidra but best I can tell the decompiler here is just plain wrong. Just want to make sure that I'm not somehow missing some x64 or fastcall concept here and that I'm right that I can safely ignore this output.

Machine Code + ASM:

1800170da    8b fa           - MOV EDI, EDX
1800170dc    48 8b d9        - MOV RBX, RCX
1800170df    ba 01 00 00 00  - MOV EDX, 1
1800170e4    3b fa           - CMP EDI, EDX  
1800170e6    75 05           - JNZ some_label  
1800170e8    e8 a7 d2 00 00  - CALL some_function  
1800170ed    8b d7           - MOV EDX, EDI  

What I think this should equate to:

if (param_2 == 1) {
    some_function(); // function definition and args don't matter

What Ghidra gives:

if (param2 == 1) {
    uStack47 = 0x1800170ed;

Since this uStack47 looks like it's just the EIP value after some_label I'm not sure why ghidra would even bother showing this. As far as I can tell you would just "fall through" the control statement right into the label with EIP incrementing as normal. Is this just a case of decompilers being not very good?

  • Is uStack47 used again later in the function? Commented Mar 22, 2021 at 22:50
  • Is param2 auto or manual param2 must be rdx not edx iirc also iirc jnz != ==
    – blabb
    Commented Mar 23, 2021 at 4:19
  • It is never used again. As far as I know jnz is essentially the same as jne.. They both check the zero. Param2 may be passed as rdx but if it's known to be a DWORD size then only edx will be used. Either way I don't see either of those things are relevant.
    – Perolan
    Commented Mar 23, 2021 at 14:55
  • 1
    The call instruction pushes the return address to the stack. So ghidra is in fact right that this store happens. The actual question is why does ghidra show this store to the user? I guess ghidra is unable to prove that the stack location used for the return address is not used as part of a structure, is is thus hesitant to hide it from you. Commented Mar 23, 2021 at 17:16
  • Don't know why I didn't consider ghidra was just showing me call's push. This makes total sense. The decompiler doesn't show it for any other functions that I've noticed but maybe something about the control logic made ghidra want to err on the side of caution. Thanks Michael!
    – Perolan
    Commented Mar 23, 2021 at 17:21


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.