10

I am currently reversing a windows driver in order to write a Linux compatible driver for a DVB card, but I have come up against a small issue that I can work around, but if it is possible I would like to make it correct.

There is a function that part of which reads the 256 byte PCI config space into a local buffer that has been allocated on the stack. The decompilation shows the output as:

unsigned __int16 configSpaceBuffer[128];

.... SNIP ...

configSpace->vtable->tmRegisterAccess_ConfigSpace__tmIGetReg(
        configSpace,
        &address,
        4,
        configSpaceBuffer,
        256u,
        0)

 _this->field_4A = v74;
 _this->field_4C = *(unsigned __int16 *)configSpaceBuffer;
 _this->field_4E = v75;
 _this->field_50 = v77;
 _this->field_52 = v76;

Is it possible to fix the detected function variables to show the following instead?

 _this->field_4A = configSpaceBuffer[0];
 _this->field_4C = configSpaceBuffer[1];
 _this->field_4E = configSpaceBuffer[2];
 _this->field_50 = configSpaceBuffer[6];
 _this->field_52 = configSpaceBuffer[8];
15

I found the solution. Double click the variable name (configSpaceBuffer in this case) which brings up the stack window for the method where you can undefine the invalid variables and then define it as an array.

Here is the output after this change:

      _this->ConfigSpace1 = configSpaceBuffer[1];
      _this->ConfigSpace0 = configSpaceBuffer[0];
      _this->ConfigSpace4 = LOBYTE(configSpaceBuffer[4]);
      _this->ConfigSpace23 = configSpaceBuffer[23];
      _this->ConfigSpace22 = configSpaceBuffer[22];
| improve this answer | |
  • 2
    You don't even need to undefine the invalid variables. Once you tell IDA that field_4A is an array, it will automatically remove the invalid variables. – Jason Geffner Sep 5 '13 at 13:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.