What's in a name?
 nummish <nummish 0x90 org> |
Wednesday, April 9 2008 12:54.46 CDT |
Most of the RE work I've done in the past was on windows where cdecl is implemented for
function(arg1,arg2)
as:
push arg2
push arg1
call function
But lately I've been working with gcc compiled binaries that allocate the stack space before hand and implement cdecl as:
mov [esp+4], arg2
mov [esp], arg1
call function
Apparently this is referred to as SUB/MOV method (thx Ero!) and is default for gcc. When IDA disassembles binaries using this method, it looks somewhat weird:
mov [esp+3C218h+var_3C214], arg2
mov [esp+3C218h+var_3C218], arg1
call function
My initial reaction to this was to write a script that would jump to each function that called other functions and rename the first (last?) couple variables to something a little more sane to enhance the readability. This was a bad idea. What ended up happening is that in some functions the stack offset changed part way through the function, causing the names to be off about half the time.
The solution? OpAlt(). The Edit->Operand type->Manual.../Alt-F1. This does not propagate like a standard variable renaming does, it just changes the one instance of that operand. This will cause a little bit more work when scripting, but the results are somewhat more accurate. Renaming the variable in the frame is still ok, but only if you check that the stack offset for all outgoing calls are the same. (hint: GetSpd())
Comments
 RolfRolles |
Posted: Wednesday, April 9 2008 15:17.20 CDT |
| Another option is to convert those operands to the form [esp+XXh] (you can do this manually by pressing 'k' with your cursor over the operand, not sure off the top of my head how to do this with IDC/the SDK), create a structure like struct FuncArgs { DWORD arg_0; DWORD arg_4; ... };, and then turn the operands into references into that structure. | |