0

I disassemble some code using IDA Pro and get the pseudo-code. It showed something like below. *((_DWORD *)a1 + 150) = 3; *(_DWORD *)(a1 + 604) = 1; I can't understand what is happening for this two code, anybody can explain?

1 Answer 1

3

This is pretty much standard C representation *((_DWORD *)a1 + 150) = 3; means a1 is a pointer to _DWORD and we dereference the 150th member of the array with base a1 Note that *(_DWORD *)(a1 + 604) = 1; the order of brackets is a bit different and assuming the type of a1 - I guess its dereferencing the 151st element since sizeof(_DWORD) is 4 and 604 = 151 x 4.

You can pretty much recreate this

void f(int * a) {
    a[150] = 3;
    a[151] = 1;
}

int main() {
    int x[256];
    f(x);
}

compile this - alternatively gcc.godbolt here

$ gcc -O1 -o test test.c

loading this in ida and decompiling

void __fastcall f(__int64 a1)
{
  *(_DWORD *)(a1 + 600) = 3;
  *(_DWORD *)(a1 + 604) = 1;
}

You can press Y after clicking on a1 and change the type of a1 to int * and get this

void __fastcall f(int *a1)
{
  a1[150] = 3;
  a1[151] = 1;
}

Note that this is not always true - a1 could be a pointer to a struct and the code could be changing a member.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.