I barely know any assembly and just started using IDA PRO a few months ago.
I understand the code that Hex-Rays generates pretty well and I think I know why Hex-Ray's fails to create a struct of this math but I want to make hex-ray's generate better code for structures without using the hardcoded memory address in the lea instruction to avoid doing tons of manual work to get it to compile since it's over thousand of lines of C code. and why is screws up, but I don't know how to fix it so Hex-Ray's evaluates the hard-coded memory address into a struct.
I couldn't use the T command on the assembly code which should offset that hardcoded memory address into the struct I created, since the hardcoded memory adress is computed with other another offset which is the struct maximum size.
I made a bunch of images below to try to show off the multiple problems I'm experiencing.
I know the problems are probably easy to solve but I lack the knowledge to figure it out not really any good resources for this either.
Here is some Hex-Ray's code how it looks right now.
if ( *v320 && ChatCounter64Max > 0 )
{
if ( !strcmp((364 * ChatCounter64Max + 0x431FC8), v320) && !strcmp((364 * ChatCounter64Max + 4398748), ChatText) )
return;
v320 = v377;
}
v321 = &ChatRelatedArray[ChatCounter64Max];
v322 = &ChatRelatedArray[ChatCounter64Max];
ChatCounter64Max = ((ChatCounter64Max + 1) % -64);
As you can see the ChatRelatedArray is the struct properly initializing a few lines below the if statement.
Here is showing the structure location and how it looks like
Here is how the bad locations look like, Those locations are not bad I just haven't figured out what they are used for they are probably some big array or struct.
Here is how it looks like in assembly the problems
Here is the assembly posted in Code not images.
.text:004186C7
.text:004186C7 loc_4186C7: ; CODE XREF: ChatProcessor+3E6Bj
.text:004186C7 mov al, [ebx]
.text:004186C9 mov edx, ChatCounter64Max
.text:004186CF test al, al
.text:004186D1 jz loc_418762
.text:004186D7 test edx, edx
.text:004186D9 jle loc_418762
.text:004186DF lea eax, [edx+edx*4]
.text:004186E2 mov esi, ebx
.text:004186E4 lea eax, [eax+eax*8]
.text:004186E7 lea edi, [edx+eax*2]
.text:004186EA shl edi, 2
.text:004186ED lea eax, unk_431FC8[edi]
.text:004186F3
.text:004186F3 loc_4186F3: ; CODE XREF: ChatProcessor+3EC1j
.text:004186F3 mov bl, [eax]
.text:004186F5 mov cl, bl
.text:004186F7 cmp bl, [esi]
.text:004186F9 jnz short loc_418717
.text:004186FB test cl, cl
.text:004186FD jz short loc_418713
.text:004186FF mov bl, [eax+1]
.text:00418702 mov cl, bl
.text:00418704 cmp bl, [esi+1]
.text:00418707 jnz short loc_418717
.text:00418709 add eax, 2
.text:0041870C add esi, 2
.text:0041870F test cl, cl
.text:00418711 jnz short loc_4186F3
.text:00418713
.text:00418713 loc_418713: ; CODE XREF: ChatProcessor+3EADj
.text:00418713 xor eax, eax
.text:00418715 jmp short loc_41871C
.text:00418717 ; ---------------------------------------------------------------------------
.text:00418717
.text:00418717 loc_418717: ; CODE XREF: ChatProcessor+3EA9j
.text:00418717 ; ChatProcessor+3EB7j
.text:00418717 sbb eax, eax
.text:00418719 sbb eax, 0FFFFFFFFh
.text:0041871C
.text:0041871C loc_41871C: ; CODE XREF: ChatProcessor+3EC5j
.text:0041871C test eax, eax
.text:0041871E jnz short loc_41875E
.text:00418720 mov esi, [esp+16078h+ChatText]
.text:00418727 lea eax, [edi+431E9Ch]
.text:0041872D
.text:0041872D loc_41872D: ; CODE XREF: ChatProcessor+3EFBj
.text:0041872D mov bl, [eax]
.text:0041872F mov cl, bl
.text:00418731 cmp bl, [esi]
.text:00418733 jnz short loc_418751
.text:00418735 test cl, cl
.text:00418737 jz short loc_41874D
.text:00418739 mov bl, [eax+1]
.text:0041873C mov cl, bl
.text:0041873E cmp bl, [esi+1]
.text:00418741 jnz short loc_418751
.text:00418743 add eax, 2
.text:00418746 add esi, 2
.text:00418749 test cl, cl
.text:0041874B jnz short loc_41872D
.text:0041874D
.text:0041874D loc_41874D: ; CODE XREF: ChatProcessor+3EE7j
.text:0041874D xor eax, eax
.text:0041874F jmp short loc_418756
.text:00418751 ; ---------------------------------------------------------------------------
.text:00418751
.text:00418751 loc_418751: ; CODE XREF: ChatProcessor+3EE3j
.text:00418751 ; ChatProcessor+3EF1j
.text:00418751 sbb eax, eax
.text:00418753 sbb eax, 0FFFFFFFFh
.text:00418756
.text:00418756 loc_418756: ; CODE XREF: ChatProcessor+3EFFj
.text:00418756 test eax, eax
.text:00418758 jz loc_418EAD ; jumptable 00418BB9 default case
.text:0041875E
.text:0041875E loc_41875E: ; CODE XREF: ChatProcessor+3ECEj
.text:0041875E mov ebx, [esp+16078h+var_16060]
.text:00418762
.text:00418762 loc_418762: ; CODE XREF: ChatProcessor+3E81j
.text:00418762 ; ChatProcessor+3E89j
.text:00418762 lea eax, [edx+edx*4]
.text:00418765 push 12Ch ; Count
.text:0041876A lea ecx, [eax+eax*8]
.text:0041876D lea eax, [edx+ecx*2]
.text:00418770 mov ecx, [esp+1607Ch+ChatText]
.text:00418777 push ecx ; Source
.text:00418778 lea edi, ChatRelatedArray.PlayerName2[eax*4]
.text:0041877F lea eax, [edx+1]
.text:00418782 cdq
.text:00418783 xor eax, edx
.text:00418785 push edi ; Dest
.text:00418786 sub eax, edx
.text:00418788 and eax, 3Fh
.text:0041878B xor eax, edx
.text:0041878D sub eax, edx
.text:0041878F mov ChatCounter64Max, eax
.text:00418794 call _strncpy
.text:00418799 add esp, 0Ch
.text:0041879C lea esi, [edi+12Ch]
.text:004187A2 push 20h ; Count
.text:004187A4 push ebx ; Source
.text:004187A5 push esi ; Dest
.text:004187A6 mov byte ptr [esi-1], 0
.text:004187AA call _strncpy
.text:004187AF add esp, 0Ch
.text:004187B2 add edi, 14Ch
.text:004187B8 mov byte ptr [esi+1Fh], 0
.text:004187BC push 20h ; Count
.text:004187BE push offset aEveryone ; "(Everyone)"
.text:004187C3 push edi ; Dest
.text:004187C4 call _strncpy
This is my other problem it doesn't seem to save even with evaluator / analyzer is off doesn't save to IDB database.
