3

There is a structure with size of 16-Bytes, and an array of it is defined. The disassembly code for navigation through the array is:

MOV     i, i,LSL#4
LDR     R4, =arr_of_struct 
ADD     i, i, R4
LDR     var, [i] 

But the decompiled code is:

var = arr_of_struct[4 * i];

Which is wrong and should be:

var = arr_of_struct[4 * i].field_0;

I think the problem is in first line of disassembly MOV i, i,LSL#4. Obviously it is multiplying the array index by 16 which is the size of my struct. But IDA translated this line to [4 * i] !!!

So the first question is what's the reason of this behavior in IDA? And the second is how can I fix this?

EDIT: More information:

enter image description here

3
  • 2
    Which version of IDA and decompiler do you use?
    – Robert
    Apr 17 at 9:04
  • 1
    IDA version 7.6 SP1, Decompiler ver 7.6.0.210427
    – E.A
    Apr 17 at 11:34
  • 2
    You'll need to show more of the decompiler output. One line is not sufficient. Apr 17 at 14:01

1 Answer 1

1

I found the solution for this issue, and post it here hope help someone someday...

I undefined the "arr_of_struct" (Ctrl+U), undefined both the array and also the structure variable:

enter description here ====> enter image description here

The output changed to deal with the undefined variable:

enter image description here

Declare struct variable again (Alt+Q), and define its location as an array (Pressing *), and the output changed to the right and expected shape:

enter image description here

Now I know how to fix it, but the first question is still remains:

What's the reason of this behavior in IDA? Is there a sequence needed to consider while defining array of structures?

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.