1

I was using Ghidra trying decompile a .sys driver. Kinda newbie, but getting some help. I see decompiler outputs a lot of "artifacts" (code weird or hard to understand). At least I have renamed some functions after see the functionality of them. Because at some point I was unable to get rid of many of those artifacts (usually by adjusting the right types in some variables) I decided to try another de-compiler: JEB Community Edition (from PNF Software). It seems that it outputs better de-compiled code than Ghidra, it detects a lot more types tha Ghidra too, but the now I hit the wall with the following. In Ghidra I have a function that I renamed like this:

int FUN_10001ea0(void)

{
  EnumerateAndProcessPCIDevices(ProcessMatchingPCIDevice);
  return 0;
}

ProcessMatchingPCIDevice (also renamed) seems to be a function too, because I double click that and it send me to the function. However, in JEB decompilation result is not the case. Look:

int sub_10001EA0() {
    sub_10001A40(&gvar_10001E10);
    return 0;
}

For some reason it just detects it as a global variable. Double click but it only shows declaration in Disassembly.

Is there any missing analysis or functionality in JEB that Ghidra does have?

8
  • Hi and welcome to RE.SE. gvar_ merely sounds like something that a tool would prepend to names of global variables. Given it's a variable, it's not local and there is only the address as additional context, this seems sensible. I don't think there's much more to it, really. Otherwise I may have misunderstood what you're asking. Side-note: it would probably have been better to show the original output from Ghidra (before your changes) for comparison.
    – 0xC0000022L
    Commented Sep 11, 2023 at 8:21
  • I don't have the original input (or the original de-compilation) anymore in Ghidra, but it was something like this: int FUN_10001ea0(void) { FUN_10001A40(INT_10001e10); return 0; } Commented Sep 11, 2023 at 9:39
  • @0xC0000022L Perhaps I didn't ask properly. In Ghidra I can simply navigate to the function used as a parameter, perhaps because it seems that is a pointer to function. JEB doesn't seem to do recognize that or I simply don't know how to do it Commented Sep 11, 2023 at 9:44
  • Wait, so you're saying ProcessMatchingPCIDevice is a function in your case? Yeah, I didn't understand it like that so far.
    – 0xC0000022L
    Commented Sep 11, 2023 at 20:23
  • 1
    @0xC0000022L In Ghidra detects it like a function, but not in JEB. I don't understand why. Commented Sep 12, 2023 at 3:28

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.