Hot answers tagged


The issue here is not strings, it's the fact that Hex-Rays didn't guess the right calling convention for sub_4022E0. Notice that the disassembly listing moves values into both ecx and edx before the call, whereas the decompilation for that call shows only one argument? Hex-Rays thinks there's only one argument -- maybe even only one stack argument -- whereas ...


That's extremely common. Sometimes Hex-Rays recognizes these patterns, sometimes it doesn't. Get used to recognizing them visually, writing a comment if necessary, and moving on.

Only top voted, non community-wiki answers of a minimum length are eligible