Hot answers tagged

4

Double click the variable name in the disassembly, or press ctrl-k, to open the stack frame window. You can change your variable types there.


3

If you run across an API call that you're unfamiliar with, check the MSDN page. Parameter 2 is "The function or variable name, or the function's ordinal value." Looking at your offset only one of those things is a function name, WNetEnumCachedPasswords. You can verify this as the comment in your post said, by counting 12 (0xc) bytes from aPstorec_dllwne. db ...


3

Because this is a relatively basic functionality, there's not builtin way to call that command from IDAPython. You could do some Qt trickery to fake that GUI menu being clicked by the user, but that seems too much effort. To me it seems as if the easiest and cleanest solution here is to simply call idaapi.get_many_bytes to get the buffer of data you're ...


2

It looks like that it is array of structures, where v3 is an index and 0xfff is used to avoid overflow. I'd suggest that the array was originally defined with size 0x1000. The size of a structure should be 4 dwords.


2

An array is an example of a data item. Like all items in IDA (the other item type is instruction), it has a starting address (head) and size. You can retrieve the whole item's size using the function get_item_size() (legacy name ItemSize()). To figure out the number of items in an array, you can divide the whole array's size by the size of one element. But ...


1

According to the given code here, I don't think its possible to recover the third dimension. _array$ = 8 _x$ = 12 _y$ = 16 _z$ = 20 _f PROC mov eax, DWORD PTR _x$[esp-4] mov edx, DWORD PTR _y$[esp-4] mov ecx, eax shl ecx, 4 ; ecx = x*16 sub ecx, eax ; ecx = x*16 - x lea eax, DWORD PTR [edx+ecx*4] ; eax = y+(15*x)*4 ...


1

If old pseudocode looks like this int __cdecl main(int argc, const char **argv, const char **envp) { signed int i; int v5; __int64 v6; v6 = 5208208757389214273LL; v5 = 0; for ( i = 0; i <= 7; ++i ) v5 += *((char *)&v6 + i); return 0; } Select v6 and press Y (Set lvar type in right click context). Change from __int64 v6 to char ...


1

I'm not sure I understand the problem, but if you want to transform a1 to pointer type just pass cursor on the function prototype, press Y and edit the type of the function argument to, for example, int * or whatever pointer type you need. That's a type of the function you'll get: double dzSell( int* a1, double a2, int a3, int a4, int a5)


1

It looks like Hexrays does not support this. Following the instructions for variable-length arrays (https://www.hex-rays.com/products/ida/support/tutorials/varstr/index.shtml) shows that it does work for IDA disassembly and Set Type (hotkey Y), but not in the decompiler output (Hexrays). Example source: typedef struct { int a; int b; char c[0]; } ...


Only top voted, non community-wiki answers of a minimum length are eligible