8 votes
Accepted

Ghidra interpreting stack pointers wrongly

TL;DR: This is not an error from Ghidra. The values are just a naming convention, and the real instructions are correctly disassembled. Ghidra assigns variable names based on the function entry point,...
user1156544's user avatar
3 votes
Accepted

How are members of a Structure Type positioned on the stack?

The second member, called buf (at location 4) is not a char. The type of that member is defined at 0x3451, and this is an array type. Its elements are each of the type defined at 0x2d04, which is a ...
Michael Karcher's user avatar
3 votes
Accepted

How to examine/edit stack memory contents using radare2 in debug mode?

To examine in radare2 you can think as 'print values' and you can use: px show hexdump pxl display N lines (rows) of hexdump pxr[j] show words with ...
Ricardo's user avatar
  • 476
2 votes

IDA Hex-Rays: How to SAFELY fix incorrect function declarations?

The decompiler decided that ecx is used by sub_431C00 because of push ecx at the beginning of the function which fills the stack slot later used by the variable phkResult, so it may look as if the ...
Igor Skochinsky's user avatar
  • 36.5k
2 votes
Accepted

IDA Hex-Rays: How to SAFELY fix incorrect function declarations?

Welcome to RE.SE! How to understand what the problem is? When the function is decompiled, IDA checks for its dependencies via dataflow analysis. Basically, it asks which values have to be defined ...
Nordwald's user avatar
  • 2,896
2 votes

There is any way to see the subroutine local variables values and who actually access them?

If you have a debugger with access to symbols, then you can run to the start of the function, and then place watches on the symbol names. In the absence of a debugger, if you can hook the function ...
peter ferrie's user avatar
  • 4,699
2 votes
Accepted

In IDA 5, is there a way to rename a stack variable mid-function

As far as I know this is not even possible in IDA 6.9 yet, and definitely not possible in IDA 5. When encountering such cases (which are quite frequent with certain compilers), I often find it the ...
NirIzr's user avatar
  • 11.8k
2 votes

How does this local var get assigned?

probably the Buffer variable is accessed indirectly by one of the called functions and var_22C is actually part of the buffer.
Igor Skochinsky's user avatar
  • 36.5k
2 votes
Accepted

Stack variable information removed in IDA pro (free version)?

IDA declares local variables as var_XXX at the start of function In the paste below var_108 is declared as dword ptr -108h So 0x10c - 108 = 4 If You hit K ida would show you .text:0040115C ...
blabb's user avatar
  • 16.3k
2 votes

Unknown variable from asm code

Finally I've found an answer. After parsing result lies into $rbp-0xdo (gdb) x/8w ((int*)($rbp-0xd0)) 0x7fffffffdf90: 0x00000000 0x00001111 0x00002222 0x00003333 0x7fffffffdfa0: ...
desu's user avatar
  • 238
2 votes

ASM Debuggers that visualize the stack (beginner friendly)

I assume you are using *nix based systems since you mentioned gdb. If you just want to print the stack/registers when you hit a break point, you can use command to set up some print statements. See ...
Shane Reilly's user avatar
2 votes
Accepted

Renaming a local stack variable with IDAPython

I managed to write a function that is doing what I was looking for... sharing my code below: def rename_stack_variable(func_addr, var_name, new_var_name): func = idaapi.get_func(func_addr) ...
rotem.salinas's user avatar
1 vote

troublesome stack frame setup

After reading up on "shadow stack space" as suggested by @blabb it looks like this is an unoptimized build, so the 2 parameters RDX and RCX are being saved in the caller's scratch space, ...
Chris H's user avatar
  • 111
1 vote
Accepted

Find out the name of constants and var in IDA pro

Generally speaking, this is not possible with any reverse engineering tool. If the programmer created custom #define statements to associate numbers with symbolic names, this information will be ...
Rolf Rolles's user avatar
  • 9,198
1 vote

ASM Debuggers that visualize the stack (beginner friendly)

Borland's Turbo Debugger also has a text-window-based UI, with the stack in its own window and showing which values in which locations. It doesn't tell you what those values represent, but at least ...
peter ferrie's user avatar
  • 4,699
1 vote

IDA/Hexrays: local variable allocation has failed; how to fix this?

First, local variable allocation failures do not necessarily mean that the decompilation is incorrect. They can happen naturally when using forced variables, for example. I'd proceed trying to analyze ...
Rolf Rolles's user avatar
  • 9,198
1 vote

Obtaining memory locations of local variables

Let's start first with finding local variables. Binary files contain multiple sections used for a plethora of purposes. The section of interest in your case is the .bss. In this sections, you're ...
yaspr's user avatar
  • 2,663
1 vote

How does this local var get assigned?

As far as I can see this mov al, [ebp+var_22C] command works with 8 bit data (according to name al), and there is a possibility that this var_22C variable is assigned as a part of bigger entity, ...
w s's user avatar
  • 8,448

Only top scored, non community-wiki answers of a minimum length are eligible