The program I'm working with has stuff like this all over:

      strbuf = 0x20746567;
      local_824 = (undefined *)0x6863616d;
      local_820 = (undefined *)0x20656e69;
      local_81c = (undefined *)0x6c696166;
      local_818 = &DAT_000a6465;
                    /* get machine failed */

Here I've added a comment showing what the gibberish actually means. Often when strings are declared in local functions, they look like this, and I type them into an online hex-to-ascii converter to determine what they say.

For what it's worth, this is what the listing window shows:

      0001c1a0 0f 00 ae      stmia     lr!,{ fd r1 r2 r3 }=>strbuf
      0001c1a4 06 10 a0      cpy       r1,r6
      0001c1a8 00 20 a0      mov       r2,#0x0
      0001c1ac 03 00 a0      mov       fd,#0x3
      0001c1b0 00 c0 8e      str       r12=>DAT_000a6465,[lr,#0x0]=>local_818

I admittedly have zero experience with assembly, so this means nothing to me, but it may help someone else. I'm also only about a week into my Ghidra experience.

In these cases, is there a way to retype the data so that it shows up in the decompiler as a human-readable string?

  • Do you know the OS the analyzed binary is designed to be executed on?
    – Robert
    Oct 14 at 10:10
  • tried right click retype variable char * or club all those locals into a char array
    – blabb
    Oct 14 at 10:22
  • @Robert, this is running on an embedded GNU/Linux platform (kernel version 4.9), aarch64.
    – mattmunee
    Oct 15 at 13:58
  • @blabb, retyping strbuf to char* just results in strbuf = (char *)0x73726170; and similar for the other locals. Retyping it as a char[20] results in the second local changing to strbuf._4_4_ = (undefined *)0x6863616d; and similar for the rest of the lines.
    – mattmunee
    Oct 15 at 14:09
  • try going tho the address DAT_000a6465 undefine and define an array maybe these are easy to experiment with when one has the binary in front . kinda hard to explain in comments :(
    – blabb
    Oct 17 at 17:51


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.