0

I'm new to Ghidra, my goal is to add localizations for a small EXE program. The program was written in Visual Studio and has Russian dialogs, which I like to convert to English.

I've loaded the EXE into Ghidra, it shows up a lot of information:

  • visualstudio:unknown
  • Portable Executable (PE)
  • Little Endian
  • and much more Then I let it analyze the program. After that, I'd like to find is the main() function. In the "Symbol Tree" under "Exports" or "Functions" there is only an "entry" function shown, and the decompile of this function makes no sense to me:
/* WARNING: Instruction at (ram,0x0045280e) overlaps instruction at (ram,0x0045280d)
    */
/* WARNING: Removing unreachable block (ram,0x004527db) */
/* WARNING: Removing unreachable block (ram,0x00452823) */
/* WARNING: Removing unreachable block (ram,0x004527a1) */

ulonglong entry(void)

{
  undefined8 uVar1;
  ulonglong uVar2;
  uint uVar3;
  int iVar4;
  int iVar5;
  
  iVar4 = -1;
  while (iVar4 != 0) {
    iVar4 = 0;
  }
  uVar3 = 0;
  iVar4 = -1;
  while (iVar4 != 0) {
    iVar4 = 0;
  }
  uVar1 = rdtsc();
  iVar4 = 1;
  do {
    if (uVar3 == 0) {
      uVar3 = 0;
    }
    else {
      uVar3 = (uint)uVar1 | 2;
    }
    iVar5 = -1;
    while (iVar5 != 0) {
      iVar5 = 0;
    }
    iVar4 = iVar4 + -1;
  } while (iVar4 != 0);
  uVar2 = rdtsc();
  uVar3 = (int)uVar2 - (uint)uVar1;
  do {
  } while (0x1000000 < uVar3);
  iVar4 = -1;
  while (iVar4 != 0) {
    iVar4 = 0;
  }
  iVar4 = -1;
  while (iVar4 != 0) {
    iVar4 = 0;
  }
  return uVar2 & 0xffffffff00000000 | (ulonglong)uVar3;
}

I don't get what this means, I somehow expected a whole function-tree with a lot of subs and stuff.

1
  • Look at the disassembly, especially the mentioned removed blocks. It seems you can’t trust this decompilation.
    – Igor Skochinsky
    Jul 26 at 14:16
0

that appears to be an antidebugging trick using rdtsc.
(read date time stamp counter) it is a monitonically increasing counter

when the process is executing without any external interference like a debugger the difference between two successive readings will be small

the loops look like junk interspersed in between

this code block supposedly checks for that

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.