Hot answers tagged

13

In C, and many other low-level programming languages the term NULL is equivalent to 0. The C standard requires NULL to be #defined to an "implementation defined value", however all implementations have chosen (for obvious reasons) to use 0 for that purpose. For that reason if you'll attempt to "See definition" for NULL, many IDEs will ...


13

Although these terms are being used interchangeably, there is an intrinsic difference between disassembler and decompiler definitions traditionally. Let's first consider common steps involved in converting low level code to high level human readable code. This is similar to compilation where you convert high level code to low level machine code or an ...


7

From everything I've read pseudo code can't be edited in realtime but can be edited as assembly This is not entirely correct. Quite the opposite even: Decompilers cannot be perfect (the compilation step looses too much information). Hence they need some help by a human (the reverse engineer). Giving this help is, at least in my opinion, the most important ...


7

I don't know the exact length of string. But, few things to note here are as follows: Ghidra and IDA has a minimum bound on size of string to recover correct type (ghidra has a limit - or lower bound of 5). This is necessary to avoid any false positives or conflicting types. And recover correct types without marking a pointer as a string. Check out this ...


6

From Ghidra.re: Sometimes you will see warnings in the decompiler view stating that there are too many branches to recover a jumptable. One reason for this is that there actually is a jump table, but the decompiler can’t determine bounds on the switch variable For your example, this is saying there may a jump table (which is really just an array of ...


6

When looking at Windows API calls or disassembly of C/C++ code, NULL Is always 0, in Visual Studio this is defined in vcruntime.h #ifndef NULL #ifdef __cplusplus #define NULL 0 #else #define NULL ((void *)0) #endif #endif However if you are looking at higher level languages NULL will not necessarily be zero, for example within ....


6

ISO C and C++ allow implementations to use a non-zero bit-pattern as the object representation for a null pointer, despite requiring that a literal 0 or (void*)0 in the source (in a pointer context) is evaluated as a null pointer, equivalent to NULL. Reasoning based on source definitions like #define NULL 0 is not sufficient in C or C++. But fortunately for ...


5

This general pattern of exclusive-access instructions is usually seen when atomic variables are modified. C++ Example (C++11 or later) #include <atomic> void release( std::atomic<int>& refcount ) { refcount--; } You can see here on godbolt that GCC's ARM64 compilation of the above produces your assembly code. C Example (C11) #...


5

There is no problem, the comment is simply informational. The TMS320C6 is a DSP and like many DSPs the architecture is optimized for fast data processing. In particular, it has a very deep pipeline and the branches have not one or two, but up to five delay slots. You can see that after the B .S2X A3 instruction there are five other instructions before the ...


5

esp register is the stack pointer and it points to the head of the stack, which is the lowest address in the binary. #1 Initial stack frame: |local var 1| <- esp (lowest address) |local var 2| |-----------| |-----------| |-----------| |local var n| <- ebp After the push instructions the stack will look at: #2 Stack frame just before the call: |a| <...


5

The issue here is not strings, it's the fact that Hex-Rays didn't guess the right calling convention for sub_4022E0. Notice that the disassembly listing moves values into both ecx and edx before the call, whereas the decompilation for that call shows only one argument? Hex-Rays thinks there's only one argument -- maybe even only one stack argument -- whereas ...


4

As of 2020, Ghidra should be considered as a major contender. It is challenging IDA Pro in many areas. The integrated decompiler is one of its greatest assets. The support for debugging was added recently on the official repository. It will be added to the next official build. Ref


4

Okay, so let's start by converting the first four instructions to rough pseudocode. I'll include the instructions as comments so you can see what each one does. r5 = r4; // mov r5, r4 - Set R5 to equal the value in R4 r5 >>= 14; // shr r5, #14 - Shift R5 14 bits to the right r5 <<= 1; // shl r5, #1 - Shift ...


4

the last byte of API/library call instructions is always 0x0A It's because calls needs to have method (ref) as a parameter and methods are defined in the table that has an id of 0x0A. Having bytes of the call like this 280600000A let's go one by one. 0x28 - is the value for opcode 'call' and it takes one operand. the rest of the opcode is the metadata ...


4

What you're asking for is not compatible with the way debugging works on x86. It has limited debugging facilities; you can set hardware breakpoints on read or write access to up to four memory locations, and you can set software or hardware breakpoints when executing particular address. There's nothing in the x86 debug interface that allows you to tell the ...


4

BinnDiff and Diaphora could be helpful for what you want.


4

IDA Pro dropped support for the .clr theme format in favour of CSS themes upon the release of the 7.3 update. In order to port older .clr themes to the current format you can use a Python script that Hex-Rays provide here. e.g. port_clr72_to_css.py -i {theme}.clr > {theme}.css to produce a CSS formatted theme which can be placed in the relevant directory ...


4

You can't, not as a standard command that's currently available through the user interface, anyway. Force new variable only works for stack locations. Perhaps a future version of Hex-Rays will allow the user to force new register variables.


4

If you were given a piece of source code written in a language you had never seen before, you would want to study the syntax and rules of the language so that you could understand what the piece of code is doing. A compiler transforms a high-level human friendly language (C for example) into in binary instructions that a CPU can run directly. These binary ...


4

ALT-D, then Float. (Or Double, or Packed Real.)


4

Disclaimer: I'm going to expose my workflow when I see similar things. I'm not telling you that this is the best one or the faster, and I'm sure you have a lot of other way to deal with this. But this should give you an insight on how you can do this. As your question is really wide and does not contain any details (malware name, hash, or what 'failed to ...


3

Please see Batch Operation In the decompiler’s manual.


3

First of all, I want to clarify some of the concepts about "API calls." I will explain these concepts, mainly thinking of WinAPI and PE files. I'm not claiming these definitions are correct for all systems. Operating system programming interfaces I assume you are referring to OS API libraries as API. OS API is consists of different interfaces that ...


3

You might have a look here It says: off_ data, contains offset value


3

For most languages -- especially ones that are compiled directly into machine code -- the answer to whether knowing the compiler makes it easier to decompile them is "no". I wrote a post a while ago explaining the difficulties that machine code decompilers face; none of them are made easier by knowing the compiler. However, your question doesn't ...


3

The other answer is wrong; it's totally possible (assuming the IDB already has a type for the structure in question, and that type has been applied to arguments/variables in Hex-Rays). In IDA 7.4 and above (I think; might have been 7.3), right-click the variable and press "Jump to xref globally", as follows: You'll get a popup with all global x-...


3

I don't think you can do that directly in IDA, although Hex-Rays does it. For example, in the PE header IMAGE_DATA_DIRECTORY DataDirectory[16] array, the names of the individual elements are specified by #define constants such as IMAGE_DIRECTORY_ENTRY_EXPORT. Here we see an access to the element at index 0: It would be nice to see the symbolic name for the ...


3

It seems these types are custom to the program you’re analyzing and probably come from the debug information (e.g. DWARF). The standard types from stdint.hare usually typedefs and not structs.


3

can you clarify if the error you are getting is related to message that says this may be caused by another thread holding the LoaderLock ? if that is the case then it means you allocate memory etc just after windbg/cdb broke on System Breakpoint if you are doing .dvalloc when you are on System Breakpoint then HttpRequestA might cause the block go to the ...


3

It's not calling itself; you're overlooking the * dereferences at the beginning of the call expression. As in: result = (**(__int64 (__fastcall ***)(volatile signed __int32 *))lambda)(lambda); Notice the two ** inside of the first parenthesis? It's dereferencing the address held in the variable named lambda, which the assembly makes clear: .text:...


Only top voted, non community-wiki answers of a minimum length are eligible