5

Is it possible to force IDA to show "5 * 20" instead of "100" in the below disassembled and decompiled lines?

MOV     R1, #100  ->  MOV     R1, #(5 * 20)
LDR     R8, =var  |   LDR     R8, =var
STR     R1, [R8]  |   STR     R1, [R8]

Corresponding decompiled code:

var = 100;        ->  var = 5 * 20;
1
  • 2
    @rce It's not a stupid question. As I read it, the question is about how to ask IDA to show an operand (in the disassembly) or an expression (in the decompilation) in an alternative fashion, as a form of annotation to aid in comprehension. This is not that much different from displaying a constant as an enum element. And as my answer illustrates, it is in fact possible to do this. Everybody else seems to have interpreted the question as being how to undo compiler optimizations instead of a question about how to annotate the database. Commented Apr 13, 2023 at 1:40

2 Answers 2

5

Right-click on the operand, click "Manual...", enter the string "5 * 20". Note that this only works in the disassembly listing, and that there is no comparable functionality in the decompilation.

1

At the assembly level, IDA reconstructs the instructions as seen in memory.

Constant multiplication adds an overhead of at least one additional instruction (like MUL or MLA for ARM CPUs); when a compiler detects two constants being multiplied in source code, the result is usually calculated at compile time and used as a single constant in the compiled binary.

If the compiler optimized your code by replacing 5 * 20 with 100, there isn't any way for IDA to disassemble or decompile it differently. In such a case that information has been lost during compilation and only exists in the application's source code.

Assuming ARM architecture and a little-endian CPU like TI MSP430, the first instruction,

MOV R1, #100

would produce the following opcodes:

\x64\x10\xa0\xe3

If that is the case for you, you need to recompile the program with different compiler settings or use a different compiler to exclude compilation-time optimizations.

You can enable the view of opcodes in IDA with Options/General/DisassemblyNumber of opcode bytes (non-graph).

8
  • 1
    but there should be no reason why the reverse engineer shouldn't be able to tell IDA that it was 5*20 Commented Apr 11, 2023 at 22:04
  • ida or you after you lost your source looking at the disassembly 10 years later wouldnt be able to tell if 100 was 1+99 or 200-100 Or 1000/10 or 10*10 or 5*20
    – blabb
    Commented Apr 12, 2023 at 3:30
  • 2
    @blabb While you likely don't know whether it was 5 * 20 in the source code, you very much can determine during reverse engineering that 5 * 20 helps understanding the disassembly, and prefer to have it printed that way. The "manual operand" feature is meant for exactly this case. On the most common assemblers, IDA is even able to verify that your manually entered operand expression matches the value found in the machine code. Features like this make IDA an Interactive Dis-Assembler and IMHO are a significant reason why IDA use is so wide-spread. Commented Apr 12, 2023 at 5:36
  • 1
    @blabb Yes exactly, if there is a hard-coded 100 in disassembly then a reverse engineer can (maybe must) resolve it to "1 + 99", "4 * 25", "(23 * 2) + 11 + 43", and so on. As an example consider a situation that the variable "var" with immediate value 100 is compared with another variable that holds a temperature sensor value in disassembly. From its datasheet you know sensor is reporting the read temperature in "4X °C" format. Now the mysterious value "100" became the friendly "4 * 25" which means the original code was comparing the sensor value with 25 °C.
    – E.A
    Commented Apr 12, 2023 at 10:51
  • 3
    @blabb it's impossible to know what the original source had for the constant from the disassembly, but it doesn't really matter. If 5*20 makes the code more legible and understandable it's better to decompile it to that regardless of what the original source code had. It may even be an improvement over the original source code.
    – Rick
    Commented Apr 12, 2023 at 11:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.