Hot answers tagged

4

The issue here is not strings, it's the fact that Hex-Rays didn't guess the right calling convention for sub_4022E0. Notice that the disassembly listing moves values into both ecx and edx before the call, whereas the decompilation for that call shows only one argument? Hex-Rays thinks there's only one argument -- maybe even only one stack argument -- whereas ...


1

ntohs basically converts a netshort to hostshort >>> import socket >>> print (hex(socket.ntohs(0x1337))) 0x3713 >>> print (hex(socket.ntohs(0x3713))) 0x1337 >>> it will write back 0x3713-0x2 = 0x3711 or 0x1337 - 0x2 = 0x1335 in the address pointed by remaining if it is > 1u and return back an address a pointer to ...


1

That's extremely common. Sometimes Hex-Rays recognizes these patterns, sometimes it doesn't. Get used to recognizing them visually, writing a comment if necessary, and moving on.


Only top voted, non community-wiki answers of a minimum length are eligible