7 votes
Accepted

IDA PRO repairing stack variables / local variables hex-rays with arrays and proper types / structures any scripts/plugins?

I'm not sure that it is possible to answer this question without seeing all the function because correctness of local variable type recovery can be done only by understanding of the context where ...
user avatar
  • 7,720
6 votes
Accepted

64-bit integers on 32-bit machines

1: See the Immediates section on this 64 bit assembly reference. Immediate values inside instructions remain 32 bits and their value is sign extended to 64 bits There just isn't an instruction to ...
user avatar
5 votes
Accepted

Ghidra interpreting stack pointers wrongly

TL;DR: This is not an error from Ghidra. The values are just a naming convention, and the real instructions are correctly disassembled. Ghidra assigns variable names based on the function entry point,...
user avatar
5 votes
Accepted

Check if binary was compiled with security checks (/GS)

you can check the IMAGE_LOAD_CONFIG_DIRECTORY structure, it has a field for the pointer to SecurityCookie's value in the image. In very old binaries, this structure might be not used, or ...
user avatar
  • 34.7k
5 votes
Accepted

How to make stack variables into an array in IDA Pro

Double click the variable name in the disassembly, or press ctrl-k, to open the stack frame window. You can change your variable types there.
user avatar
4 votes

Variable liveness analysis on binaries

I don't think that it is possible. Let's assume the following C code: int f1(int p1, int p2) { int l1, l2, l3; /* some code */ l1 = l1 + l2; // here is our virtual address return l1; ...
user avatar
  • 7,720
4 votes
Accepted

Trouble understanding change in number when popped from FPU to CPU Stack

4275451536 is greater than 2^31 (2147483648) but less than 2 ^32 (4294967296) so it is represented as 2^31 + ( 2 ^31 * ((4275451536 - 2 ^31 ) / 2^31) ie 2^31 * 1.990912266075611114501953125 ...
user avatar
  • 14.9k
3 votes
Accepted

How are members of a Structure Type positioned on the stack?

The second member, called buf (at location 4) is not a char. The type of that member is defined at 0x3451, and this is an array type. Its elements are each of the type defined at 0x2d04, which is a ...
user avatar
3 votes
Accepted

Stack frame boundary

So the space between esp and var1 is going to be free without any use ? that's what I want to know. That stack space is used for the function's local variables (also known as "stack variables"). ...
user avatar
3 votes
Accepted

Who does construct the stack on process creation in Windows?

Visit these two webpages for information about stack and stack frames what is meaning of the initial stack between EBP and ESP? EBP and ESP are used in conjunction to create a stack frame. To ...
user avatar
  • 5,850
3 votes
Accepted

Memory allocation on the stack

In your case because int is 4 bytes and you want 20 element int a[20] // --> 20 * 4 = 0x50 so it is very normal for i and i_2 The other thing is that your compiler didn't push printf arguments ...
user avatar
  • 281
3 votes
Accepted

How to examine/edit stack memory contents using radare2 in debug mode?

To examine in radare2 you can think as 'print values' and you can use: px show hexdump pxl display N lines (rows) of hexdump pxr[j] show words with ...
user avatar
  • 476
2 votes

Variable's position on stack

I'd change the variable right when it's created and stored into its position. For example, if one function calls another, that other function returns the variable, and the first function stores it ...
user avatar
2 votes
Accepted

Stack variable information removed in IDA pro (free version)?

IDA declares local variables as var_XXX at the start of function In the paste below var_108 is declared as dword ptr -108h So 0x10c - 108 = 4 If You hit K ida would show you .text:0040115C ...
user avatar
  • 14.9k
2 votes

Unknown variable from asm code

Finally I've found an answer. After parsing result lies into $rbp-0xdo (gdb) x/8w ((int*)($rbp-0xd0)) 0x7fffffffdf90: 0x00000000 0x00001111 0x00002222 0x00003333 0x7fffffffdfa0: ...
user avatar
  • 238
2 votes

IDA Hex-Rays: How to SAFELY fix incorrect function declarations?

The decompiler decided that ecx is used by sub_431C00 because of push ecx at the beginning of the function which fills the stack slot later used by the variable phkResult, so it may look as if the ...
user avatar
  • 34.7k
2 votes
Accepted

IDA Hex-Rays: How to SAFELY fix incorrect function declarations?

Welcome to RE.SE! How to understand what the problem is? When the function is decompiled, IDA checks for its dependencies via dataflow analysis. Basically, it asks which values have to be defined ...
user avatar
  • 2,826
2 votes

There is any way to see the subroutine local variables values and who actually access them?

If you have a debugger with access to symbols, then you can run to the start of the function, and then place watches on the symbol names. In the absence of a debugger, if you can hook the function ...
user avatar
  • 4,511
2 votes
Accepted

In IDA 5, is there a way to rename a stack variable mid-function

As far as I know this is not even possible in IDA 6.9 yet, and definitely not possible in IDA 5. When encountering such cases (which are quite frequent with certain compilers), I often find it the ...
user avatar
  • 11.4k
2 votes

How does this local var get assigned?

probably the Buffer variable is accessed indirectly by one of the called functions and var_22C is actually part of the buffer.
user avatar
  • 34.7k
2 votes

ASM Debuggers that visualize the stack (beginner friendly)

I assume you are using *nix based systems since you mentioned gdb. If you just want to print the stack/registers when you hit a break point, you can use command to set up some print statements. See ...
user avatar
1 vote

troublesome stack frame setup

After reading up on "shadow stack space" as suggested by @blabb it looks like this is an unoptimized build, so the 2 parameters RDX and RCX are being saved in the caller's scratch space, ...
user avatar
  • 111
1 vote
Accepted

Find out the name of constants and var in IDA pro

Generally speaking, this is not possible with any reverse engineering tool. If the programmer created custom #define statements to associate numbers with symbolic names, this information will be ...
user avatar
  • 7,814
1 vote

ASM Debuggers that visualize the stack (beginner friendly)

Borland's Turbo Debugger also has a text-window-based UI, with the stack in its own window and showing which values in which locations. It doesn't tell you what those values represent, but at least ...
user avatar
  • 4,511
1 vote

IDA/Hexrays: local variable allocation has failed; how to fix this?

First, local variable allocation failures do not necessarily mean that the decompilation is incorrect. They can happen naturally when using forced variables, for example. I'd proceed trying to analyze ...
user avatar
  • 7,814
1 vote

How does this local var get assigned?

As far as I can see this mov al, [ebp+var_22C] command works with 8 bit data (according to name al), and there is a possibility that this var_22C variable is assigned as a part of bigger entity, ...
user avatar
  • 7,720
1 vote

Obtaining memory locations of local variables

Let's start first with finding local variables. Binary files contain multiple sections used for a plethora of purposes. The section of interest in your case is the .bss. In this sections, you're ...
user avatar
  • 2,603
1 vote

Passing arrays to a function call (Buffer Overflow)

What you're actually doing there is passing pointers to the array, not the array itself. If you look at the declarations: char * const argv[] = {"cat", "/etc/target/file"}; char * const envp[]...
user avatar
1 vote

Who does construct the stack on process creation in Windows?

RtlCreateUserStack() creates the stack on thread creation (And every process has the main thread). Or more generally: The Windows PE loader. What is the PE loader? That thing that creates a process ...
user avatar
  • 260

Only top scored, non community-wiki answers of a minimum length are eligible