0

I was reversing ( new to the reversing world of course) being using Ghidra for this. I get a C++ function AppChat::__Status::setDescription(ErrorCode param_1). Within this function, there's a variable puVar1 declared as undefined8 *. However, I need to change the data type of puVar1 to a different type like char to better format its usage in the code. I mean for example, the variable *pcVar3; which the decompiler defines as char is presenting the string as expected in the code. but the variable puVar is not.

Here is the relevant code:

void AppChat::__Status::setDescription(ErrorCode param_1)

{
  undefined8 *puVar1;
  undefined8 *in_x8;
  undefined8 uVar2;
  char *pcVar3;
  undefined8 uVar4;
  undefined8 uVar5;
  
  switch(param_1) {
  case 0x26ac:
    *(undefined *)in_x8 = 0x1a;
    *(undefined8 *)((long)in_x8 + 6) = 0x726f727265206e77;
    *(undefined8 *)((long)in_x8 + 1) = 0x206e776f6e6b6e55;
    *(undefined *)((long)in_x8 + 0xe) = 0;
    break;
  case 0x26ad:
    puVar1 = (undefined8 *)operator.new(0x40);
    in_x8[1] = 0x36;
    *in_x8 = 0x41;
    in_x8[2] = puVar1;
    *(undefined8 *)((long)puVar1 + 0x2e) = 0x746e65696c437461;
    puVar1[3] = 0x54202e6465727567;
    puVar1[2] = 0x69666e6f6320746f;
    puVar1[5] = 0x7461684320707574;
    puVar1[4] = 0x6573206f74207972;
    puVar1[1] = 0x6e207369206e6f69;
    *puVar1 = 0x746163696c707041;
    *(undefined *)((long)puVar1 + 0x36) = 0;
    break;
  case 0x26ae:
    *(undefined *)in_x8 = 0x1e;
    in_x8[1] = 0x74756f656d697420;
    *(undefined8 *)((long)in_x8 + 1) = 0x2074736575716552;
    *(undefined *)(in_x8 + 2) = 0;
    break;
  case 0x26af:
    puVar1 = (undefined8 *)operator.new(0x30);
    in_x8[2] = puVar1;
    *(undefined4 *)((long)puVar1 + 0x1f) = 0x74737269;
    in_x8[1] = 0x23;
    *in_x8 = 0x31;
    puVar1[1] = 0x70202c6465746365;
    *puVar1 = 0x6e6e6f6320746f4e;
    puVar1[3] = 0x6966207463656e6e;
    puVar1[2] = 0x6f6320657361656c;
    *(undefined *)((long)puVar1 + 0x23) = 0;
    break;
  case 0x26b0:
    puVar1 = (undefined8 *)operator.new(0x20);
    pcVar3 = "Network connection error";
    goto LAB_003191e8;
  case 0x26b1:
    puVar1 = (undefined8 *)operator.new(0x20);
    in_x8[2] = puVar1;
    in_x8[1] = 0x17;
    *in_x8 = 0x21;
    *(undefined8 *)((long)puVar1 + 0xf) = 0x656c696620656874;
    puVar1[1] = 0x74206e65706f2074;
    *puVar1 = 0x6f6e20646c756f43;
    *(undefined *)((long)puVar1 + 0x17) = 0;
    break;
  default:
    if (param_1 == 0x1f7) {
      *(undefined *)in_x8 = 0x26;
      *(undefined4 *)(in_x8 + 2) = 0x454c4241;
      *(undefined8 *)((long)in_x8 + 9) = 0x414c494156414e55;
      *(undefined8 *)((long)in_x8 + 1) = 0x2045434956524553;
      *(undefined *)((long)in_x8 + 0x14) = 0;
      return;
    }
    if (param_1 != 0x4b3) {
      *(undefined2 *)in_x8 = 0;
      return;
    }
    puVar1 = (undefined8 *)operator.new(0x20);
    pcVar3 = "The file size is too big";
LAB_003191e8:
    uVar2 = *(undefined8 *)((long)pcVar3 + 0x10);
    uVar5 = *(undefined8 *)((long)pcVar3 + 8);
    uVar4 = *(undefined8 *)pcVar3;
    in_x8[2] = puVar1;
    in_x8[1] = 0x18;
    *in_x8 = 0x21;
    puVar1[2] = uVar2;
    puVar1[1] = uVar5;
    *puVar1 = uVar4;
    *(undefined *)(puVar1 + 3) = 0;
  }
  return;
}

so far I tried to select the variable puVar1 in the ghidra decompiler then right clicked I choose retype variable and set data type as char * but it creates as new variable and changes the data held in pVar1 to pVar2 with undefined8

choosing retype variable option

enter image description here

so I am doing slightly something wrong as I believe. the variable pcVar3 holds the string data as readable like for example Network connection error. but the variable puVar1 is not held in a format such that the data can be read. like for example it holds 0x746163696c707041 and if changed to character it reads as tacilppA which is reverse order of the string as expected. this has to do with little endianness I am new to this reversing on the platform. so my question is how can I re adjust the variable as it seem in the code as char array? is data type change needed?

1 Answer 1

0

No, unfortunately, you cannot change the data type for some underlying reasons. There is a good explanation here from one of the developper (emteere):

The undefined datatypes are used to note an access of a size without knowing the real type, or the existence of a parameter without locking in the type. They are really placeholder types. The decompiler is free to propagate a type and replace the undefined with a good type for all undefined types. In addition, undefined types defined in memory can be replaced with a more specific type by algorithms.

If the decompiler were to use uint8_t, that could be incorrect as the type might be signed. It all depends on the access. The decompiler will try to replace the type with a correct type based on the access or use. Absent any other type information than a size, especially when accessing through an unknown pointer type, the decompiler will display undefined. If the pointer points to a structure or class, the decompiler is more likely to use uint, char, byte, etc... as the type for local variables and parameters.

There is a setting to disable type casts, which could help improve default display if you don't specify types for parameters which you could try as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.