1

I was inspecting the c-pseudocode for a PE executable in IDA.

I found some function called j__ftol2_sse_excpt()

c-pseudocode function calls

When I open that function I see that the function is calling another function named _ftol2_sse_excpt.

c-Pseudocode of that function

When I open that function, I saw this(I can't understand it)

c-pseudocode of that function which is called by j__ftol2_sse_excpt()

Dissassembly around function calls:

Disassembly of original function calls

Disassembly of the function

Disassembly of the function which is called by j__ftol2_sse_excpt()__1

Disassembly of the function which is called by j__ftol2_sse_excpt()__2

Disassembly of the function which is called by j__ftol2_sse_excpt()__3

1
  • From what I found on the Internet, for example this, this and this, it seems that _ftol2_sse_excpt is a standard function from msvcrt and is used to round a number from float to int.
    – raspiduino
    Jul 9 at 3:36

1 Answer 1

4

j_ prefix is used by IDA for functions which do not do anything besides jumping to another function, likely the real implementation. So the real function you need is ftol2_sse_excpt.

This function doesn’t seem to be documented anywhere but the name is very close to ftol which is the standard CRT function for converting a float to a long int.

According to this MASM forum post:

ftol2_sse is an internal C function that is called when a cast or conversion is made from a floating point variable to an integer. It was first used in VC 2005 (8.0).  Before that it was ftol_sse and before that ftol.

The _excpt suffix probably means it can raise an exception (e.g. if called with a NaN value).

Because the function is internal, the function prototype is not known and the decompiler did not detect the arguments, probably because they’re passed in FPU registers and not on stack. If the function is really equivalent to ftol, you can try renaming it to that and the decompiler should recognize it. Alternatively, you can try specifying a manual function prototype using __usercall calling convention.

2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.