1

I am reversing a binary which seems to have all the symbols exported which helps. What I have seen is a pile of variables and functions which all start with the letter 'v', for example v101. I have been playing around with the decompiler from IDA and noticed that its pseudo code generally uses the same form having variables starting with the letter 'v'. I know this may seem silly to ask but I am looking at a binary which is actually just IDA pro pseudo code compiled?

A snippet of pseudo code generated:

int v3480()
{
  __int32 v0; // r0@1

  v0 = time(0);
  srand48(v0);

  // TODO Object initialisation!!
  v877 = &v3688;
  v1277 = &v7299;
  v1634 = &v5690;
  v2042 = &v7024;

  v873 = &v3688;
  v872 = (char *)&v3688 + 1;
  v1274 = &v7299;
  v485 = &unk_40B69FF5;

  v1631 = &v5690;
  v1629 = (char *)&v5690 + 1;

  v2037 = &v7024;
  v2038 = (char *)&v7024 + 1;

  v5661 = -1;
  v2325 = -1;
  v1259 = -1;
  v4048 = -1;
  v5509 = &v5497;
  v3845 = &unk_40B69EEC;
  v3522 = &v4191;
  v7253 = &unk_40B69EE4;
  v2081 = &v3009;
  v5828 = &unk_40B69EDC;
  v7014 = &v2061;
  v3636 = &unk_40B69ED4;
  v217 = &v6520;
  v218 = &v6524;
  v219 = &v6525;
  v221 = &v6523;
  v1455 = &v6523;
  unk_40B69EF4 = &v6524;
  v7297 = &dword_40A071D0;
  v5530 = &dword_40A071D0;
  if ( dword_40A071D0 )
  {
    v6935();
  }
  else
  {
    memcpy(v219, &v5764, 0xE3958u);
    dword_40A071D0 = 1;
  }
  return 0;
}
2
  • that sounds more like obfuscation, if all variables are like 'v'+NUMBER. May 28, 2014 at 16:50
  • I suppose you should post part of the code so that the people who know what IDA's pseudo-code looks like can help. Otherwise, I don't think anybody can predict anything :D
    – yaspr
    May 28, 2014 at 17:35

1 Answer 1

1

You're looking at pseudocode reconstructed from the binary. After compilation all variable names disappeared, so IDA generates new generic ones.

It looks like that all v* variables are local (allocated on the stack)

10
  • Yes I know that but what I am seeing is that I have lots of functions in the original binary which have exported names starting with the character 'v' as well.
    – allbabel
    May 28, 2014 at 18:19
  • What I am trying to say is that these names exist before generating psuedo code
    – allbabel
    May 29, 2014 at 5:53
  • do you have debug information in this file ? i
    – w s
    May 29, 2014 at 6:43
  • Can you post the function pseudocode somewhere ?
    – w s
    May 29, 2014 at 6:46
  • Its above in the question
    – allbabel
    Jun 1, 2014 at 7:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.