5
The issue here is not strings, it's the fact that Hex-Rays didn't guess the right calling convention for sub_4022E0. Notice that the disassembly listing moves values into both ecx and edx before the call, whereas the decompilation for that call shows only one argument? Hex-Rays thinks there's only one argument -- maybe even only one stack argument -- whereas ...
3
For IDA/Hex-Rays:
In the Loaded Type Libraries window (View->Open subviews->Type libraries), load ntddk_win10 (or whatever Windows version you want, back to Windows XP and Windows Server 2003).
In the Structures window (View->Open subviews->Structures), import KUSER_SHARED_DATA. You can simply write the name of the type in the dialog box and ...
3
Please see Batch Operation
In the decompiler’s manual.
2
You can take the instructions, assemble them into hex values, for example by using: Online disassembler.
Then you get the byte representation:
\x55\x48\x89\xE5\x89\x7D\xFC\x89\x75\xF8\x8B\x55\xFC\x8B\x45\xF8\x01\xD0\x5D\xC3
With this, you can patch bytes in the binary, and then use the normal decompile functionality in Ghidra/Ida on the patched area.
2
as i commented i used windbg to dump those structures
sample code used for walk through
#include <iostream> //01
#include <list> //02
#include <vector> //03
#include <map> ...
2
ghidra
addr = toAddr(0x7ffe0000)
currentProgram.memory.createUninitializedBlock("KUSER_SHARED_PAGE",addr,0x1000,0)
createData(addr,getDataTypes("KUSER_SHARED_DATA")[0])
result
undefined8 main(void)
{
wprintf((__crt_locale_pointers *)L"Version: %lu.%lu.%lu\n",
(ulonglong)KUSER_SHARED_DATA_7ffe0000.NtMajorVersion,
...
2
I don't know off the top of my head if there's an option you can set for that, but that's the type of thing that's utterly trivial to write a Hex-Rays plugin for. I bet that would be less than 25 lines of code. If you can send a link to a binary, I'll write a script to demonstrate. Assuming you're writing IDAPython (the details would only be slightly ...
1
Try marking the variable as volatile
1
Hard to say without the binary or at least the full function but possibly it happens because of cvtsi2sd.
According to the documentation, the instruction treats the input as “signed doubleword integer”. (Doubleword is 32-bit on Intel)
1
ntohs basically converts a netshort to hostshort
>>> import socket
>>> print (hex(socket.ntohs(0x1337)))
0x3713
>>> print (hex(socket.ntohs(0x3713)))
0x1337
>>>
it will write back
0x3713-0x2 = 0x3711 or 0x1337 - 0x2 = 0x1335
in the address pointed by remaining if it is > 1u
and return back an address a pointer to ...
1
In hexrays.hpp, citem_t is the base class for both cinsn_t ("instructions", such as for loops, if statements, etc.) and cexpr_t ("expressions", such as addition, memory dereference, function calls, etc.) citem_t has a field ea_t ea;. That field stores the address of the corresponding line in the assembly language (unless it's BADADDR, in ...
1
you created those structures or you pulled it from somewhere ?
basically these are template classes and not structures
where did you get the size of 0x1c for std::string
it is 0x18
0x10 for buffer or Pointer (static small string or malloced() bigstring )
0x4 for Actualsize or_Mysize
0x4 for Reservedsize or _Myres
like
typedef struct _FOO {
union _Bx {
char ...
1
here is the sample code that will show both the constructs if there is an atomic exchange requirement you use the api or intrinsc provided
else simply assign
source
#include <stdio.h>
#include <windows.h>
#include <intrin.h>
long tmp[10] = {NULL};
long *m_someMemoryPool[10] ={NULL};
int main (void) {
tmp[0] = 0xbee5deed;
long foo ...
1
You can actually compile this with NASM depends on your preferred architecture, example command is below (I used linux):
nasm -f elf64 -o ./sample.asm ./sample.o
ld -o ./sample ./sample.o
global _start
section .text
_start:
push rbp
mov rbp, rsp
mov DWORD [rbp-4], edi
mov DWORD [rbp-8], esi
mov edx, DWORD [rbp-4]...
1
2012MBP13.smc is an incomplete firmware. If you look at the address ranges in your smc payload, it starts with 00000000 (vectors table) and then jumps to 00006800, meaning ranges 00000800 to 00006000 are missing. These ranges include the bootloader and updater. So when trying to analyze the code, it's likely missing portions. Systems from 2013 Retina to 2017 ...
1
That's extremely common. Sometimes Hex-Rays recognizes these patterns, sometimes it doesn't. Get used to recognizing them visually, writing a comment if necessary, and moving on.
1
(Since I can't add comments due reputation)
I ported IDAPython version of Referee to IDA 7.x (works on 7.5 good so far)
Repository is here
Only top voted, non community-wiki answers of a minimum length are eligible
