Hot answers tagged

5

I don't know the exact length of string. But, few things to note here are as follows: Ghidra and IDA has a minimum bound on size of string to recover correct type (ghidra has a limit - or lower bound of 5). This is necessary to avoid any false positives or conflicting types. And recover correct types without marking a pointer as a string. Check out this ...


4

The issue here is not strings, it's the fact that Hex-Rays didn't guess the right calling convention for sub_4022E0. Notice that the disassembly listing moves values into both ecx and edx before the call, whereas the decompilation for that call shows only one argument? Hex-Rays thinks there's only one argument -- maybe even only one stack argument -- whereas ...


2

can you clarify if the error you are getting is related to message that says this may be caused by another thread holding the LoaderLock ? if that is the case then it means you allocate memory etc just after windbg/cdb broke on System Breakpoint if you are doing .dvalloc when you are on System Breakpoint then HttpRequestA might cause the block go to the ...


1

Warning: hack! with the first IDB open, copy the idbname.til to another place run tilib -#- idbname.til copy it to IDA's til/pc (or matching processor) directory. in the second IDB, add the type library from the Type Libraries list. types are now available even though they're not shown in Local Types. You can, for example, "Add standard structure",...


1

To add to Igor's excellent reply. Unfortunately IDA Pro up until now does not handle TMS320C6 properly. TI DSP common pattern for the calls is to load up call address into 32 bit register and do the register branching (it has direct branching with immediate offsets as well but compiler seems to use it only for local branches within the function). IDA seems ...


1

That's extremely common. Sometimes Hex-Rays recognizes these patterns, sometimes it doesn't. Get used to recognizing them visually, writing a comment if necessary, and moving on.


Only top voted, non community-wiki answers of a minimum length are eligible