2

I am getting this simplified function from the decomplication results of Ghidra, and I am having a hard time interpreting what the predicate would evaluate to since I do not have access to __ctype_b structure, in other words, what is this predicate indicating (eg. no blank spaces, digits only, ect...) ?

int myFunc(char myChar) {

    if ((*(unsigned short*)((char)myChar * 2 + __ctype_b) >> 6 & 1) == 0) {
        return true;
    } else {
        return false;
    }

}

1 Answer 1

2

_ctype is a common name for an array with flags used for implementing the is... family of C runtime function-like macros from ctype.h (isupper, islower, isalpha, isdigit and so on). For example, see this file from early glibc:

CONST unsigned short int __ctype_b_C[] =
  {
    0,
    _IScntrl,
    _IScntrl,
    _IScntrl,
    _IScntrl,
    _IScntrl,
    _IScntrl,
    _IScntrl,
    _IScntrl,
    _IScntrl,
    _IScntrl|_ISspace|_ISblank,

If we assume that __ctype_b is an array of shorts, the function seems to be equivalent to:

return (__ctype_b[myChar]>>6 & 1)==0;

or

return (__ctype_b[myChar]& (1<<6))==0;

If the bits in the table use standard values, 1<<6 corresponds to the _ISpunct flag, so the function seems to return !ispunct(myChar);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.