The program I'm working with has stuff like this all over:

      strbuf = 0x20746567;
      local_824 = (undefined *)0x6863616d;
      local_820 = (undefined *)0x20656e69;
      local_81c = (undefined *)0x6c696166;
      local_818 = &DAT_000a6465;
                    /* get machine failed */

Here I've added a comment showing what the gibberish actually means. Often when strings are declared in local functions, they look like this, and I type them into an online hex-to-ascii converter to determine what they say.

For what it's worth, this is what the listing window shows:

      0001c1a0 0f 00 ae      stmia     lr!,{ fd r1 r2 r3 }=>strbuf
      0001c1a4 06 10 a0      cpy       r1,r6
      0001c1a8 00 20 a0      mov       r2,#0x0
      0001c1ac 03 00 a0      mov       fd,#0x3
      0001c1b0 00 c0 8e      str       r12=>DAT_000a6465,[lr,#0x0]=>local_818

I admittedly have zero experience with assembly, so this means nothing to me, but it may help someone else. I'm also only about a week into my Ghidra experience.

In these cases, is there a way to retype the data so that it shows up in the decompiler as a human-readable string?

  • Do you know the OS the analyzed binary is designed to be executed on?
    – Robert
    Oct 14, 2022 at 10:10
  • tried right click retype variable char * or club all those locals into a char array
    – blabb
    Oct 14, 2022 at 10:22
  • @Robert, this is running on an embedded GNU/Linux platform (kernel version 4.9), aarch64.
    – mattmunee
    Oct 15, 2022 at 13:58
  • @blabb, retyping strbuf to char* just results in strbuf = (char *)0x73726170; and similar for the other locals. Retyping it as a char[20] results in the second local changing to strbuf._4_4_ = (undefined *)0x6863616d; and similar for the rest of the lines.
    – mattmunee
    Oct 15, 2022 at 14:09
  • try going tho the address DAT_000a6465 undefine and define an array maybe these are easy to experiment with when one has the binary in front . kinda hard to explain in comments :(
    – blabb
    Oct 17, 2022 at 17:51


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.