How to determine the data type of a register

Question

I'm learning reverse engineering and I'm trying to understand what process people use to identify a variable type.

For example, I'm looking at an argument being passed to a function and I'm trying to understand what it is. This application uses Objective-C. This parameter could be an NSString, it could be a pointer to some struct, it could be anything, right? Printing it out shows this:

(lldb) po $rsi
140732653141208

How do I find out what it is? I understand there is probably no perfect formula to definitely know what this represents, but is there some process that a more experienced person would use to try to decipher what this represents?

I'm currently just trying every format and hoping something catches my eye.

(lldb) p/x $rsi
(lldb) p/s $rsi
(lldb) x/x $rsi
(lldb) x/s $rsi

Could someone walk me through what they do or point me to some resources? This is specifically for lldb.

Answer 1

Short story: you can't without context.

In memory, everything is data, and your registers will always be populated with data.

Sometime, you can guess the data type (a small integer, some characters or a string), but you don't know for sure. Is "\x42\x43" the string "BC" ? Is it a handler on something ? Is it the "16963" integer value ? Is it used as a single byte (so you don't care about "\x43") ? Nobody known without the context where you found this value.

You may also see that a data may be in a specific range, and you can make a guess about its type. For instance, something in the memory range of a buffer that you previously saw may be a pointer. But once again, you don't know what this pointer represents.

The goal of reverse engineering is to trace back those values from where they were instantiated, and it will become easier :)

Maybe this register hold the address of a buffer. Maybe it holds an error code. Maybe it holds an old data that was here, and a part of the register (let's say the lower 16 bits) contains an important value.

Opening your target binary in a disassembler (like IDA) would probably help you, as the tool may type some variables for you, saving some time.

In your case, try to trace back where this argument is being instantiated, it will become clearer :)