7
votes
Accepted
IDA PRO repairing stack variables / local variables hex-rays with arrays and proper types / structures any scripts/plugins?
I'm not sure that it is possible to answer this question without seeing all the function because correctness of local variable type recovery can be done only by understanding of the context where ...
- 7,720
6
votes
Accepted
64-bit integers on 32-bit machines
1:
See the Immediates section on this 64 bit assembly reference.
Immediate values inside instructions remain 32 bits and their value is sign extended to 64 bits
There just isn't an instruction to ...
- 12.7k
5
votes
Accepted
Ghidra interpreting stack pointers wrongly
TL;DR:
This is not an error from Ghidra. The values are just a naming convention, and the real instructions are correctly disassembled.
Ghidra assigns variable names based on the function entry point,...
- 259
5
votes
Accepted
Check if binary was compiled with security checks (/GS)
you can check the IMAGE_LOAD_CONFIG_DIRECTORY structure, it has a field for the pointer to SecurityCookie's value in the image.
In very old binaries, this structure might be not used, or ...
- 34.7k
5
votes
Accepted
How to make stack variables into an array in IDA Pro
Double click the variable name in the disassembly, or press ctrl-k, to open the stack frame window. You can change your variable types there.
- 12.7k
4
votes
Variable liveness analysis on binaries
I don't think that it is possible.
Let's assume the following C code:
int f1(int p1, int p2)
{
int l1, l2, l3;
/* some code */
l1 = l1 + l2; // here is our virtual address
return l1;
...
- 7,720
4
votes
Accepted
Trouble understanding change in number when popped from FPU to CPU Stack
4275451536 is greater than 2^31 (2147483648) but less than 2 ^32 (4294967296)
so it is represented as 2^31 + ( 2 ^31 * ((4275451536 - 2 ^31 ) / 2^31)
ie 2^31 * 1.990912266075611114501953125
...
- 14.9k
3
votes
Accepted
How are members of a Structure Type positioned on the stack?
The second member, called buf (at location 4) is not a char. The type of that member is defined at 0x3451, and this is an array type. Its elements are each of the type defined at 0x2d04, which is a ...
- 806
3
votes
Accepted
Stack frame boundary
So the space between esp and var1 is going to be free without any use
? that's what I want to know.
That stack space is used for the function's local variables (also known as "stack variables").
...
- 20.4k
3
votes
Accepted
Who does construct the stack on process creation in Windows?
Visit these two webpages for information about stack and stack frames
what is meaning of the initial stack between EBP and ESP?
EBP and ESP are used in conjunction to create a stack frame. To ...
- 5,850
3
votes
Accepted
Memory allocation on the stack
In your case because int is 4 bytes and you want 20 element
int a[20] // --> 20 * 4 = 0x50
so it is very normal for i and i_2
The other thing is that your compiler didn't push printf arguments ...
- 281
3
votes
Accepted
How to examine/edit stack memory contents using radare2 in debug mode?
To examine in radare2 you can think as 'print values' and you can use:
px show hexdump
pxl display N lines (rows) of hexdump
pxr[j] show words with ...
- 476
2
votes
Variable's position on stack
I'd change the variable right when it's created and stored into its position. For example, if one function calls another, that other function returns the variable, and the first function stores it ...
- 12.7k
2
votes
Accepted
Stack variable information removed in IDA pro (free version)?
IDA declares local variables as var_XXX at the start of function
In the paste below var_108 is declared as dword ptr -108h
So 0x10c - 108 = 4
If You hit K
ida would show you
.text:0040115C ...
- 14.9k
2
votes
Unknown variable from asm code
Finally I've found an answer.
After parsing result lies into $rbp-0xdo
(gdb) x/8w ((int*)($rbp-0xd0))
0x7fffffffdf90: 0x00000000 0x00001111 0x00002222 0x00003333
0x7fffffffdfa0: ...
- 238
2
votes
IDA Hex-Rays: How to SAFELY fix incorrect function declarations?
The decompiler decided that ecx is used by sub_431C00 because of push ecx at the beginning of the function which fills the stack slot later used by the variable phkResult, so it may look as if the ...
- 34.7k
2
votes
Accepted
IDA Hex-Rays: How to SAFELY fix incorrect function declarations?
Welcome to RE.SE!
How to understand what the problem is?
When the function is decompiled, IDA checks for its dependencies via dataflow analysis. Basically, it asks which values have to be defined ...
- 2,826
2
votes
There is any way to see the subroutine local variables values and who actually access them?
If you have a debugger with access to symbols, then you can run to the start of the function, and then place watches on the symbol names.
In the absence of a debugger, if you can hook the function ...
- 4,511
2
votes
Accepted
In IDA 5, is there a way to rename a stack variable mid-function
As far as I know this is not even possible in IDA 6.9 yet, and definitely not possible in IDA 5.
When encountering such cases (which are quite frequent with certain compilers), I often find it the ...
- 11.4k
2
votes
How does this local var get assigned?
probably the Buffer variable is accessed indirectly by one of the called functions and var_22C is actually part of the buffer.
- 34.7k
2
votes
ASM Debuggers that visualize the stack (beginner friendly)
I assume you are using *nix based systems since you mentioned gdb. If you just want to print the stack/registers when you hit a break point, you can use command to set up some print statements. See ...
- 386
1
vote
troublesome stack frame setup
After reading up on "shadow stack space" as suggested by @blabb it looks like this is an unoptimized build, so the 2 parameters RDX and RCX are being saved in the caller's scratch space, ...
- 111
1
vote
Accepted
Find out the name of constants and var in IDA pro
Generally speaking, this is not possible with any reverse engineering tool. If the programmer created custom #define statements to associate numbers with symbolic names, this information will be ...
- 7,814
1
vote
ASM Debuggers that visualize the stack (beginner friendly)
Borland's Turbo Debugger also has a text-window-based UI, with the stack in its own window and showing which values in which locations. It doesn't tell you what those values represent, but at least ...
- 4,511
1
vote
IDA/Hexrays: local variable allocation has failed; how to fix this?
First, local variable allocation failures do not necessarily mean that the decompilation is incorrect. They can happen naturally when using forced variables, for example. I'd proceed trying to analyze ...
- 7,814
1
vote
How does this local var get assigned?
As far as I can see this mov al, [ebp+var_22C] command works with 8 bit data (according to name al), and there is a possibility that this var_22C variable is assigned as a part of bigger entity, ...
- 7,720
1
vote
Obtaining memory locations of local variables
Let's start first with finding local variables. Binary files contain multiple sections used for a plethora of purposes. The section of interest in your case is the .bss. In this sections, you're ...
- 2,603
1
vote
Passing arrays to a function call (Buffer Overflow)
What you're actually doing there is passing pointers to the array, not the array itself. If you look at the declarations:
char * const argv[] = {"cat", "/etc/target/file"};
char * const envp[]...
- 341
1
vote
Who does construct the stack on process creation in Windows?
RtlCreateUserStack() creates the stack on thread creation (And every process has the main thread). Or more generally: The Windows PE loader.
What is the PE loader? That thing that creates a process ...
- 260
Only top scored, non community-wiki answers of a minimum length are eligible