1

I have an ARM (thumb) function from Nokia's firmware:

ROM:10A5409C srv_opps_normal_push_ind_handler        ; CODE XREF: srv_opp_event_hdlr+1C6↑p
ROM:10A5409C
ROM:10A5409C var_18          = -0x18
ROM:10A5409C var_14          = -0x14
ROM:10A5409C var_10          = -0x10
ROM:10A5409C
ROM:10A5409C                 PUSH            {R1-R5,LR}
ROM:10A5409E                 LDR             R1, =srv_oppc_p
ROM:10A540A0                 LDR             R4, [R1,#(srv_opps_p - 0xF00E4880)]
ROM:10A540A2                 ADDS            R4, #0xC
ROM:10A540A4                 LDRB            R1, [R4,#1]
ROM:10A540A6                 CMP             R1, #9
ROM:10A540A8                 BEQ             locret_10A540BE
ROM:10A540AA                 CMP             R1, #0xA
ROM:10A540AC                 BEQ             locret_10A540BE
ROM:10A540AE                 CMP             R1, #3
ROM:10A540B0                 BEQ             locret_10A540BE
ROM:10A540B2                 CMP             R1, #8
ROM:10A540B4                 BEQ             loc_10A540C0
ROM:10A540B6                 LDRB            R0, [R4]
ROM:10A540B8                 MOVS            R1, #0x50 ; 'P'
ROM:10A540BA                 BL              sub_10B31478
ROM:10A540BE
ROM:10A540BE locret_10A540BE                         ; CODE XREF: srv_opps_normal_push_ind_handler+C↑j
ROM:10A540BE                                         ; srv_opps_normal_push_ind_handler+10↑j ...
ROM:10A540BE                 POP             {R1-R5,PC}
ROM:10A540C0 ; ---------------------------------------------------------------------------
ROM:10A540C0
ROM:10A540C0 loc_10A540C0                            ; CODE XREF: srv_opps_normal_push_ind_handler+18↑j
ROM:10A540C0                 MOVS            R1, #0x3000
ROM:10A540C4                 ADDS            R1, R4, R1
ROM:10A540C6                 LDRB            R1, [R1,#0x1C]
ROM:10A540C8                 CMP             R1, #0
ROM:10A540CA                 BEQ             loc_10A540DA
ROM:10A540CC                 MOVS            R0, #0x6000
ROM:10A540D0                 ADDS            R0, R4, R0
ROM:10A540D2                 LDR             R0, [R0,#0x24]
ROM:10A540D4                 BL              sub_10A6CCC4
ROM:10A540D8
ROM:10A540D8 locret_10A540D8                         ; CODE XREF: srv_opps_normal_push_ind_handler+66↓j
ROM:10A540D8                 POP             {R1-R5,PC}
ROM:10A540DA ; ---------------------------------------------------------------------------
ROM:10A540DA
ROM:10A540DA loc_10A540DA                            ; CODE XREF: srv_opps_normal_push_ind_handler+2E↑j
ROM:10A540DA                 MOVS            R1, #0x260
ROM:10A540DE                 ADDS            R1, R0, R1
ROM:10A540E0                 LDRH            R3, [R1,#0x10]
ROM:10A540E2                 CMP             R3, #0
ROM:10A540E4                 BEQ             loc_10A54104
ROM:10A540E6                 LDRB            R1, [R0,#0x16]
ROM:10A540E8                 MOVS            R2, #0
ROM:10A540EA                 STR             R2, [SP,#0x18+var_14]
ROM:10A540EC                 STR             R1, [SP,#0x18+var_18]
ROM:10A540EE                 MOVS            R1, #0x240
ROM:10A540F2                 ADDS            R0, R0, R1
ROM:10A540F4                 LDR             R1, [R0,#0x2C]
ROM:10A540F6                 MOVS            R2, R3
ROM:10A540F8                 LDR             R0, [R4,#8]
ROM:10A540FA                 ADD             R3, SP, #0x18+var_10
ROM:10A540FC                 BL              srv_opps_write_file
ROM:10A54100                 CMP             R0, #0
ROM:10A54102                 BLT             locret_10A540D8
ROM:10A54104
ROM:10A54104 loc_10A54104                            ; CODE XREF: srv_opps_normal_push_ind_handler+48↑j
ROM:10A54104                 LDR             R0, [R4,#8]
ROM:10A54106                 CMP             R0, #0
ROM:10A54108                 BEQ             loc_10A54112
ROM:10A5410A                 BLX             $Ven$AT$L$$FS_Close
ROM:10A5410E                 MOVS            R0, #0
ROM:10A54110                 STR             R0, [R4,#8]
ROM:10A54112
ROM:10A54112 loc_10A54112                            ; CODE XREF: srv_opps_normal_push_ind_handler+6C↑j
ROM:10A54112                 LDR             R0, [R4,#4]
ROM:10A54114                 BL              sub_10A6CB64
ROM:10A54118                 POP             {R1-R5,PC}
ROM:10A54118 ; End of function srv_opps_normal_push_ind_handler
ROM:10A54118
ROM:10A54118 ; ---------------------------------------------------------------------------
ROM:10A5411A                 ALIGN 4
ROM:10A5411C off_10A5411C    DCD srv_oppc_p          ; DATA XREF: srv_opps_normal_push_ind_handler+2↑r
ROM:10A54120

When I press F5 to decompile the function to pseudocode, it shows nothing:

decompile view

While I am able to decompile other functions normally, without any problems. For example, still that function, but on another Nokia firmware:

ALICE:1052B91C ; =============== S U B R O U T I N E =======================================
ALICE:1052B91C
ALICE:1052B91C
ALICE:1052B91C srv_opps_normal_push_ind_handler        ; CODE XREF: srv_opp_event_hdlr+1C0↑p
ALICE:1052B91C
ALICE:1052B91C var_18          = -0x18
ALICE:1052B91C var_14          = -0x14
ALICE:1052B91C
ALICE:1052B91C                 PUSH            {R2-R6,LR}
ALICE:1052B91E                 LDR             R1, =srv_oppc_p
ALICE:1052B920                 LDR             R4, [R1,#(srv_opps_p - 0xF00A9108)] ; srv_opps_inst
ALICE:1052B922                 ADDS            R4, #0xC
ALICE:1052B924                 LDRB            R1, [R4,#(byte_F0208859 - 0xF0208858)]
ALICE:1052B926                 CMP             R1, #9
ALICE:1052B928                 BEQ             locret_1052B970
ALICE:1052B92A                 CMP             R1, #0xA
ALICE:1052B92C                 BEQ             locret_1052B970
ALICE:1052B92E                 CMP             R1, #3
ALICE:1052B930                 BEQ             locret_1052B970
ALICE:1052B932                 CMP             R1, #8
ALICE:1052B934                 BEQ             loc_1052B93C
ALICE:1052B936                 LDRB            R0, [R4]
ALICE:1052B938                 MOVS            R1, #0x50 ; 'P'
ALICE:1052B93A                 B               loc_1052B96C
ALICE:1052B93C ; ---------------------------------------------------------------------------
ALICE:1052B93C
ALICE:1052B93C loc_1052B93C                            ; CODE XREF: srv_opps_normal_push_ind_handler+18↑j
ALICE:1052B93C                 MOVS            R1, #0x240
ALICE:1052B940                 ADDS            R1, R0, R1
ALICE:1052B942                 LDR             R5, [R1,#0x2C]
ALICE:1052B944                 MOVS            R1, #0x260
ALICE:1052B948                 ADDS            R1, R0, R1
ALICE:1052B94A                 LDRH            R3, [R1,#0x10]
ALICE:1052B94C                 CMP             R3, #0
ALICE:1052B94E                 BEQ             loc_1052B968
ALICE:1052B950                 LDRB            R1, [R0,#0x16]
ALICE:1052B952                 MOVS            R2, #0
ALICE:1052B954                 STR             R2, [SP,#0x18+var_14]
ALICE:1052B956                 STR             R1, [SP,#0x18+var_18]
ALICE:1052B958                 MOVS            R2, R3
ALICE:1052B95A                 LDR             R0, [R4,#(dword_F0208860 - 0xF0208858)]
ALICE:1052B95C                 MOVS            R1, R5
ALICE:1052B95E                 MOVS            R3, #0
ALICE:1052B960                 BL              srv_opps_write_file
ALICE:1052B964                 CMP             R0, #0
ALICE:1052B966                 BLT             locret_1052B970
ALICE:1052B968
ALICE:1052B968 loc_1052B968                            ; CODE XREF: srv_opps_normal_push_ind_handler+32↑j
ALICE:1052B968                 LDRB            R0, [R4]
ALICE:1052B96A                 MOVS            R1, #0
ALICE:1052B96C
ALICE:1052B96C loc_1052B96C                            ; CODE XREF: srv_opps_normal_push_ind_handler+1E↑j
ALICE:1052B96C                 BL              srv_opps_push_rsp
ALICE:1052B970
ALICE:1052B970 locret_1052B970                         ; CODE XREF: srv_opps_normal_push_ind_handler+C↑j
ALICE:1052B970                                         ; srv_opps_normal_push_ind_handler+10↑j ...
ALICE:1052B970                 POP             {R2-R6,PC}
ALICE:1052B970 ; End of function srv_opps_normal_push_ind_handler
ALICE:1052B970
ALICE:1052B970 ; ---------------------------------------------------------------------------
ALICE:1052B972                 ALIGN 4
ALICE:1052B974 off_1052B974    DCD srv_oppc_p          ; DATA XREF: srv_opps_normal_push_ind_handler+2↑r

decompiled to

int __fastcall srv_opps_normal_push_ind_handler(int result, int a2, int a3)
{
  int *v3; // r4
  int v4; // r1
  int v5; // r0
  int v6; // r1

  v3 = srv_opps_p + 3;
  v4 = *((unsigned __int8 *)srv_opps_p + 13);
  if ( v4 != 9 && v4 != 10 && v4 != 3 )
  {
    if ( v4 != 8 )
    {
      v5 = *(unsigned __int8 *)v3;
      v6 = 80;
      return srv_opps_push_rsp(v5, v6, a3);
    }
    if ( !*(_WORD *)(result + 624)
      || (result = srv_opps_write_file(v3[2], *(_DWORD *)(result + 620), *(unsigned __int16 *)(result + 624), 0),
          result >= 0) )
    {
      v5 = *(unsigned __int8 *)v3;
      v6 = 0;
      return srv_opps_push_rsp(v5, v6, a3);
    }
  }
  return result;
}

I also tried export the whole database's pseudocode to a C file, but still same result on that function.

Why it doesn't decompile?

Improve this question
1
  • 2
    This sounds like a good question for Hex-Rays support.
    – Rolf Rolles
    Jul 30 at 16:13

1 Answer 1

Reset to default
1

It's because of the segment name of your firmwares. In the first firmware the segment name is ROM, which means the segment is read only, but in your second firmware the name is ALICE, which makes no restrictions on writing data to the segment.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.