1

I am reversing a binary which seems to have all the symbols exported which helps. What I have seen is a pile of variables and functions which all start with the letter 'v', for example v101. I have been playing around with the decompiler from IDA and noticed that its pseudo code generally uses the same form having variables starting with the letter 'v'. I know this may seem silly to ask but I am looking at a binary which is actually just IDA pro pseudo code compiled?

A snippet of pseudo code generated:

int v3480()
{
  __int32 v0; // r0@1

  v0 = time(0);
  srand48(v0);

  // TODO Object initialisation!!
  v877 = &v3688;
  v1277 = &v7299;
  v1634 = &v5690;
  v2042 = &v7024;

  v873 = &v3688;
  v872 = (char *)&v3688 + 1;
  v1274 = &v7299;
  v485 = &unk_40B69FF5;

  v1631 = &v5690;
  v1629 = (char *)&v5690 + 1;

  v2037 = &v7024;
  v2038 = (char *)&v7024 + 1;

  v5661 = -1;
  v2325 = -1;
  v1259 = -1;
  v4048 = -1;
  v5509 = &v5497;
  v3845 = &unk_40B69EEC;
  v3522 = &v4191;
  v7253 = &unk_40B69EE4;
  v2081 = &v3009;
  v5828 = &unk_40B69EDC;
  v7014 = &v2061;
  v3636 = &unk_40B69ED4;
  v217 = &v6520;
  v218 = &v6524;
  v219 = &v6525;
  v221 = &v6523;
  v1455 = &v6523;
  unk_40B69EF4 = &v6524;
  v7297 = &dword_40A071D0;
  v5530 = &dword_40A071D0;
  if ( dword_40A071D0 )
  {
    v6935();
  }
  else
  {
    memcpy(v219, &v5764, 0xE3958u);
    dword_40A071D0 = 1;
  }
  return 0;
}
  • that sounds more like obfuscation, if all variables are like 'v'+NUMBER. – Willem Hengeveld May 28 '14 at 16:50
  • I suppose you should post part of the code so that the people who know what IDA's pseudo-code looks like can help. Otherwise, I don't think anybody can predict anything :D – yaspr May 28 '14 at 17:35
1

You're looking at pseudocode reconstructed from the binary. After compilation all variable names disappeared, so IDA generates new generic ones.

It looks like that all v* variables are local (allocated on the stack)

  • Yes I know that but what I am seeing is that I have lots of functions in the original binary which have exported names starting with the character 'v' as well. – allbabel May 28 '14 at 18:19
  • What I am trying to say is that these names exist before generating psuedo code – allbabel May 29 '14 at 5:53
  • do you have debug information in this file ? i – w s May 29 '14 at 6:43
  • Can you post the function pseudocode somewhere ? – w s May 29 '14 at 6:46
  • Its above in the question – allbabel Jun 1 '14 at 7:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.