0

while i'm reversing a PE binary, i got some weird decompiler output. decomp

asm


return address is shown on decompiler view. I looked up on google, and i thought setting stack depth and editing a stack frame would help. but nothing has changed.

is there any way to improve decompiler output?

1 Answer 1

0

I see that you have tried the stack depth and stack frame, but have you tried the "Edit Function Purge..." option for the function being called? Adding the size of the return address to this value might clean up that portion of the decompilation output.

To see/edit that setting you can right-click on the function name in its definition (for some reason I don't see it when I try from a call site) in the Listing view.

screenshot-of-edit-function-purge-menu

3
  • Can you explain it more specifically? I edited the function purge value by 8. but return address of FUN_1400036f0 is still seen on decompiler output. maybe im doing something wrong...
    – msh
    Feb 2 at 12:13
  • I believe you would want to add 8 to whatever was there before for 64 bit systems, but there could be something else going on especially if you have made a lot of other tweaks trying to fix it. You could try a fresh load of the PE and just make the change there? It's hard to say without seeing the sample itself.
    – goatshriek
    Feb 2 at 21:40
  • Thx. Helped me alot
    – msh
    Feb 5 at 7:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.