3

I asked exactly the same question here, but later I figure out this community and found out this helpful to ask it here as well.

I would like to have a decompiled pseudo-code in Ghidra like:

FUN_4c4363e8("Hello world");

This is what usually I see in IDA , but in Ghidra, by default I get such a code:

FUN_4c4363e8((char*)(DAT_4c447798));

Is there a way to force the decompiler to convert the DAT_4c447798 memory address to "Hello world" null-terminated string?

Thanks.

3
  • 1
    right click on the location > Data > Choose TerminatedCString
    – sudhackar
    Nov 6, 2023 at 14:55
  • @sudhackar Did not help. It still stays the same LABEL pointer and not a string in decompiled C pseudocode. Nov 7, 2023 at 4:41
  • Can you share the bytes that's supposed to be the string? possible to share binary?
    – sudhackar
    Nov 7, 2023 at 10:01

1 Answer 1

2

Probably this DAT_4c447798 is a pointer and it should point to the string.

Ghidra acts much better, if you specify that some memory areas are constant. In the menu check Window -> Memory map and remove ticks at W column for all areas where your code does not wrote to.

And of course, please provide more details in further questions.

1
  • Solved my problem. Thanks. I had a lot limitations to tell more than what I said in my question. Nov 11, 2023 at 4:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.