2

I barely know any assembly and just started using IDA PRO a few months ago.

I understand the code that Hex-Rays generates pretty well and I think I know why Hex-Ray's fails to create a struct of this math but I want to make hex-ray's generate better code for structures without using the hardcoded memory address in the lea instruction to avoid doing tons of manual work to get it to compile since it's over thousand of lines of C code. and why is screws up, but I don't know how to fix it so Hex-Ray's evaluates the hard-coded memory address into a struct.

I couldn't use the T command on the assembly code which should offset that hardcoded memory address into the struct I created, since the hardcoded memory adress is computed with other another offset which is the struct maximum size.

I made a bunch of images below to try to show off the multiple problems I'm experiencing.

I know the problems are probably easy to solve but I lack the knowledge to figure it out not really any good resources for this either.

Here is some Hex-Ray's code how it looks right now.

if ( *v320 && ChatCounter64Max > 0 )
{
  if ( !strcmp((364 * ChatCounter64Max + 0x431FC8), v320) && !strcmp((364 * ChatCounter64Max + 4398748), ChatText) )
    return;
  v320 = v377;
}
v321 = &ChatRelatedArray[ChatCounter64Max];
v322 = &ChatRelatedArray[ChatCounter64Max];
ChatCounter64Max = ((ChatCounter64Max + 1) % -64);

As you can see the ChatRelatedArray is the struct properly initializing a few lines below the if statement.

hex-rays

Here is showing the structure location and how it looks like

struct

Here is how the bad locations look like, Those locations are not bad I just haven't figured out what they are used for they are probably some big array or struct.

bad locations

Here is how it looks like in assembly the problems

the problem assembly

Here is the assembly posted in Code not images.

.text:004186C7
.text:004186C7 loc_4186C7:                             ; CODE XREF: ChatProcessor+3E6Bj
.text:004186C7                 mov     al, [ebx]
.text:004186C9                 mov     edx, ChatCounter64Max
.text:004186CF                 test    al, al
.text:004186D1                 jz      loc_418762
.text:004186D7                 test    edx, edx
.text:004186D9                 jle     loc_418762
.text:004186DF                 lea     eax, [edx+edx*4]
.text:004186E2                 mov     esi, ebx
.text:004186E4                 lea     eax, [eax+eax*8]
.text:004186E7                 lea     edi, [edx+eax*2]
.text:004186EA                 shl     edi, 2
.text:004186ED                 lea     eax, unk_431FC8[edi]
.text:004186F3
.text:004186F3 loc_4186F3:                             ; CODE XREF: ChatProcessor+3EC1j
.text:004186F3                 mov     bl, [eax]
.text:004186F5                 mov     cl, bl
.text:004186F7                 cmp     bl, [esi]
.text:004186F9                 jnz     short loc_418717
.text:004186FB                 test    cl, cl
.text:004186FD                 jz      short loc_418713
.text:004186FF                 mov     bl, [eax+1]
.text:00418702                 mov     cl, bl
.text:00418704                 cmp     bl, [esi+1]
.text:00418707                 jnz     short loc_418717
.text:00418709                 add     eax, 2
.text:0041870C                 add     esi, 2
.text:0041870F                 test    cl, cl
.text:00418711                 jnz     short loc_4186F3
.text:00418713
.text:00418713 loc_418713:                             ; CODE XREF: ChatProcessor+3EADj
.text:00418713                 xor     eax, eax
.text:00418715                 jmp     short loc_41871C
.text:00418717 ; ---------------------------------------------------------------------------
.text:00418717
.text:00418717 loc_418717:                             ; CODE XREF: ChatProcessor+3EA9j
.text:00418717                                         ; ChatProcessor+3EB7j
.text:00418717                 sbb     eax, eax
.text:00418719                 sbb     eax, 0FFFFFFFFh
.text:0041871C
.text:0041871C loc_41871C:                             ; CODE XREF: ChatProcessor+3EC5j
.text:0041871C                 test    eax, eax
.text:0041871E                 jnz     short loc_41875E
.text:00418720                 mov     esi, [esp+16078h+ChatText]
.text:00418727                 lea     eax, [edi+431E9Ch]
.text:0041872D
.text:0041872D loc_41872D:                             ; CODE XREF: ChatProcessor+3EFBj
.text:0041872D                 mov     bl, [eax]
.text:0041872F                 mov     cl, bl
.text:00418731                 cmp     bl, [esi]
.text:00418733                 jnz     short loc_418751
.text:00418735                 test    cl, cl
.text:00418737                 jz      short loc_41874D
.text:00418739                 mov     bl, [eax+1]
.text:0041873C                 mov     cl, bl
.text:0041873E                 cmp     bl, [esi+1]
.text:00418741                 jnz     short loc_418751
.text:00418743                 add     eax, 2
.text:00418746                 add     esi, 2
.text:00418749                 test    cl, cl
.text:0041874B                 jnz     short loc_41872D
.text:0041874D
.text:0041874D loc_41874D:                             ; CODE XREF: ChatProcessor+3EE7j
.text:0041874D                 xor     eax, eax
.text:0041874F                 jmp     short loc_418756
.text:00418751 ; ---------------------------------------------------------------------------
.text:00418751
.text:00418751 loc_418751:                             ; CODE XREF: ChatProcessor+3EE3j
.text:00418751                                         ; ChatProcessor+3EF1j
.text:00418751                 sbb     eax, eax
.text:00418753                 sbb     eax, 0FFFFFFFFh
.text:00418756
.text:00418756 loc_418756:                             ; CODE XREF: ChatProcessor+3EFFj
.text:00418756                 test    eax, eax
.text:00418758                 jz      loc_418EAD      ; jumptable 00418BB9 default case
.text:0041875E
.text:0041875E loc_41875E:                             ; CODE XREF: ChatProcessor+3ECEj
.text:0041875E                 mov     ebx, [esp+16078h+var_16060]
.text:00418762
.text:00418762 loc_418762:                             ; CODE XREF: ChatProcessor+3E81j
.text:00418762                                         ; ChatProcessor+3E89j
.text:00418762                 lea     eax, [edx+edx*4]
.text:00418765                 push    12Ch            ; Count
.text:0041876A                 lea     ecx, [eax+eax*8]
.text:0041876D                 lea     eax, [edx+ecx*2]
.text:00418770                 mov     ecx, [esp+1607Ch+ChatText]
.text:00418777                 push    ecx             ; Source
.text:00418778                 lea     edi, ChatRelatedArray.PlayerName2[eax*4]
.text:0041877F                 lea     eax, [edx+1]
.text:00418782                 cdq
.text:00418783                 xor     eax, edx
.text:00418785                 push    edi             ; Dest
.text:00418786                 sub     eax, edx
.text:00418788                 and     eax, 3Fh
.text:0041878B                 xor     eax, edx
.text:0041878D                 sub     eax, edx
.text:0041878F                 mov     ChatCounter64Max, eax
.text:00418794                 call    _strncpy
.text:00418799                 add     esp, 0Ch
.text:0041879C                 lea     esi, [edi+12Ch]
.text:004187A2                 push    20h             ; Count
.text:004187A4                 push    ebx             ; Source
.text:004187A5                 push    esi             ; Dest
.text:004187A6                 mov     byte ptr [esi-1], 0
.text:004187AA                 call    _strncpy
.text:004187AF                 add     esp, 0Ch
.text:004187B2                 add     edi, 14Ch
.text:004187B8                 mov     byte ptr [esi+1Fh], 0
.text:004187BC                 push    20h             ; Count
.text:004187BE                 push    offset aEveryone ; "(Everyone)"
.text:004187C3                 push    edi             ; Dest
.text:004187C4                 call    _strncpy

This is my other problem it doesn't seem to save even with evaluator / analyzer is off doesn't save to IDB database.

my other problem ida

2

Can you do this in a 2 pass methodology?

First, generate whatever code HexRays is able to generate. Secondly, use your programming skill to write a program that will read the HexRays output file, recognise the fields you need calculated, do the calculation , replacing those fields, and then output the modified source.

Automation is your friend.

Otherwise, hey, manually doing fixups is what I like about disassembly. Learn to love it too.

  • Yes I want to find a automation script that creates structs for IDA PRO I know one should exist.. I found IDA Type REconstruction Plugin but it's only for C++ class structs my application is written in C – SSpoke Apr 15 '14 at 8:11
  • Yes I love figuring out how the structs are made by looking at the memset lengths and new operator values. the reset is all guess work. Could you help me out from IDA... maybe my version is a bit old.. care to hook me up with a newer built? haha worth a shot. – SSpoke Apr 15 '14 at 8:13
  • IDA 6.1.0 is the one I see using the btdigg.org search engine. I guess if you want the latest and greatest you will have to dig your hands deeply into your pockets. – Paddywhacker Apr 15 '14 at 9:26
  • You talk of a script. I guess you could use a scripting language, but if I knew how to do it manually then I could write a C program, a filter, to input one text file and output the other. – Paddywhacker Apr 15 '14 at 9:28
  • 1
    Ouch. Links from TPB are somewhat curated, the BTDIGG search results are totally wild. Use with care. – Paddywhacker Apr 15 '14 at 10:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.