2

I developed a program, and sadly I did some updates, compiled it and then lost the updated source code, but I do have the original source code (I think I added like 3 functions in the update).

So is it possible to somehow map the decompiled program to my original source code.

For example, here I have a decompiled function (I believe this is some window callback function).

undefined4 FUN_1000b5a0(HWND param_1,uint param_2,HWND param_3,HWND param_4)

{
  int iVar1;
  int iVar2;
  HWND pHVar3;
  undefined4 uVar4;
  int iVar5;
  
  FUN_1000b790();
  if (0x110 < param_2) {
    if (param_2 == 0x111) {
      uVar4 = FUN_1000b720(param_1,(uint)param_3 & 0xffff);
      return uVar4;
    }
    if ((param_2 == 0x138) && (iVar5 = GetDlgCtrlID(param_4), iVar5 == 0x543)) {
      uVar4 = FUN_1000bb60((HDC)param_3);
      return uVar4;
    }
    return 0;
  }
  if (param_2 == 0x110) {
    SetWindowLongA(param_1,-0x15,(LONG)param_4);
    pHVar3 = GetParent(param_1);
    FUN_1002a660(param_1,pHVar3);
    DAT_100a24a4 = param_4[0x12].unused;
    DAT_100a2580 = param_4[0x13].unused;
  }
  else {
    if (param_2 == 0x2b) {
      FUN_1000b8c0((int)param_3,(int)param_4);
      return 1;
    }
    if (param_2 != 0x53) {
      if (param_2 != 0x7b) {
        return 0;
      }
      FUN_1001beb0(&DAT_1008c5d0,param_3,(int)param_4,1,1);
      return 1;
    }
    iVar5 = 0;
    if (DAT_1008c5d0 != 0) {
      iVar1 = param_4[2].unused;
      iVar2 = DAT_1008c5d0;
      while (iVar2 != iVar1) {
        iVar2 = (&DAT_1008c5d4)[iVar5];
        iVar5 = iVar5 + 1;
        if (iVar2 == 0) {
          return 1;
        }
      }
      if ((iVar1 != 1) && (iVar1 != 2)) {
        WinHelpA((HWND)param_4[3].unused,&DAT_100a0a78,0xc,(ULONG_PTR)&DAT_1008c5d0);
        return 1;
      }
      WinHelpA((HWND)param_4[3].unused,s_windows.hlp_1008ce4c,0xc,(ULONG_PTR)&DAT_1008c5d0);
      return 1;
    }
  }
  return 1;
}

For instance, I know that 0x110 is WM_INITDIALOG, 0x53 is WM_COMMAND and so on, so that is probably a switch statement that compiler modified to if statement.

But I don't know which function is FUN_1000b720 (it is probably somewhere in my source code) so is it possible to give Ghidra my source code and it would map it to its decompiled output by using some patterns, and then it would leave the rest for a human to solve.

Improve this question

1 Answer 1

Reset to default
1

Compile the original program with debug information (i.e., tell MSVC to generate a PDB, preferably a full PDB), and then use something like BinDiff or Ghidra's "Version Tracker" tool to compare the original binary against the one you lost the code for.

Improve this answer
2
  • Thanks, could you maybe explain how to use Ghidra's "Version Tracker" tool? I did compile my old program with pdb file, If I load it with my older binary, it does show me all the function names, but if I try it out with newer binary, it says PDB file not match and doesnt show me all the functions (it shows some, but for most of them its still FUNxxx
    – user3368585
    Jun 11 at 17:35
  • The PDB will not match the binary you lost the code for. Version Tracker will try to match the functions against the two binaries against one another, and you'll be able to tell the names of what was matched. For some information on using Version Tracker, see cve-north-stars.github.io/docs/Ghidra-Patch-Diffing
    – Rolf Rolles
    Jun 11 at 23:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.