4

Some codes in IDA are not clear enough. Especially when they do reference after calculation

while ( dx33[rdi24] );
  if ( rax35 != &WPP_GLOBAL_Control && (*((_BYTE *)rax35 + 68) & 2) != 0 && *((_BYTE *)rax35 + 65) >= 4u )
  {
    WPP_SF_sd(
      (unsigned int)rax35[7],
      22,
      (unsigned int)&WPP_b7e02e4f98cc3b1bbc566e561d210229_Traceguids,
      (_DWORD)dx33,
      rdi24 - 1);
    dx33 = Str;
  }
  if ( (_DWORD)rdi24 != 1 && dx33[(int)rdi24 - 1] == 46 && dx33[(int)rdi24 - 2] == 46 )
  {
    dx33[(int)rdi24 - 1] = 0;
    dx33 = Str;
  }

For some parts like

(*((_BYTE *)rax35 + 68) & 2)

Can I change it to a more human-readable form? I remember changing the function argument type like int a1 to JNIEnv* can make the pointer reference more readable because it recovers some JNI function names so that

...(_DWORD)(a1+312)(a1,v9)

will become something like

->func(a1,v9)

But I'm not sure how to do this for other types.

2
  • Quite frankly in this particular case you may want to look at WPP Software Tracing and ETW in general for the first if condition. I am almost certain that this is pretty much some idiomatic way of how the respective WPP macros get expanded. The GUIDs will vary across different pieces of software (or even within a single software). I.e. this would be a piece you don't want to reverse engineer normally. Is this KM or UM?
    – 0xC0000022L
    Nov 8 at 9:57
  • @0xC0000022L It's a piece of code in dns.exe. I think it's UM because when I used Windbg the function in dns.exe didn't appear in all the kernel files Nov 12 at 13:21

2 Answers 2

2

To make the listing more human-readable, you just need to add structure definitions, for example: type of variable rax35 - obviously not unsigned int

there should be a pointer to the structure you need to define.


The first thing you need is to find the size of this struct or class. To do this, you need to find its constructor.

  • If the memory for this object is allocated using the operator New, you can determine the size.
  • If memory is allocated on the stack, then heuristic methods must be used here. That is, you have to manually parse the stack frame.

After the size of the structure or class is found, it's time to add it to Local Types in IDA Pro.

To simplify static analysis as much as possible, you should:

  • add, if any, pdb-file to the project.
  • for each function declaration - restore prototypes
1
  • 1
    But how do I know which structure should I define Nov 13 at 7:35
1

There’s no single solution for every case but basically you need to use the devompiler’s interactive features:

  • Renaming
  • Retyping
  • Commenting
  • Navigation between different functions

Just looking at small parts of the function and renaming a few variables to some name which makes sense can go a long way. Start small and keep making changes until things start to make sense. Sometimes you may need yo visit multiple functions to see how a specific variable is used to figure out its type.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.