OpenRCE

📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Flag: Tornado! Hurricane!

Created: Wednesday, April 9 2008 12:54.46 CDT

Printer Friendly ...

What's in a name?

Author: nummish

# Views: 2159

Most of the RE work I've done in the past was on windows where cdecl is implemented for

function(arg1,arg2)

as:

push arg2
push arg1
call function

But lately I've been working with gcc compiled binaries that allocate the stack space before hand and implement cdecl as:

mov [esp+4], arg2
mov [esp], arg1
call function

Apparently this is referred to as SUB/MOV method (thx Ero!) and is default for gcc. When IDA disassembles binaries using this method, it looks somewhat weird:

mov     [esp+3C218h+var_3C214], arg2
mov     [esp+3C218h+var_3C218], arg1
call    function

My initial reaction to this was to write a script that would jump to each function that called other functions and rename the first (last?) couple variables to something a little more sane to enhance the readability. This was a bad idea. What ended up happening is that in some functions the stack offset changed part way through the function, causing the names to be off about half the time.

The solution? OpAlt(). The Edit->Operand type->Manual.../Alt-F1. This does not propagate like a standard variable renaming does,  it just changes the one instance of that operand. This will cause a little bit more work when scripting, but the results are somewhat more accurate. Renaming the variable in the frame is still ok, but only if you check that the stack offset for all outgoing calls are the same. (hint: GetSpd())

Blog Comments

RolfRolles	Posted: Wednesday, April 9 2008 15:17.20 CDT
Another option is to convert those operands to the form [esp+XXh] (you can do this manually by pressing 'k' with your cursor over the operand, not sure off the top of my head how to do this with IDC/the SDK), create a structure like struct FuncArgs { DWORD arg_0; DWORD arg_4; ... };, and then turn the operands into references into that structure.

There are 31,328 total registered users.

Recently Created Topics
[help] Unpacking VMP...	Mar/12
Reverse Engineering ...	Jul/06
let 'IDAPython' impo...	Sep/24
set 'IDAPython' as t...	Sep/24
GuessType return une...	Sep/20
About retrieving the...	Sep/07
How to find specific...	Aug/15
How to get data depe...	Jul/07
Identify RVA data in...	May/06
Question about memor...	Dec/12

Recent Forum Posts
Finding the procedur...	rolEYder
Question about debbu...	rolEYder
Identify RVA data in...	sohlow
let 'IDAPython' impo...	sohlow
How to find specific...	hackgreti
Problem with ollydbg	sh3dow
How can I write olly...	sh3dow
New LoadMAP plugin v...	mefisto...
Intel pin in loaded ...	djnemo
OOP_RE tool available?	Bl4ckm4n

Recent Blog Entries
	halsten	Mar/14
Breaking IonCUBE VM
	oleavr	Oct/24
Anatomy of a code tracer
	hasherezade	Sep/24
IAT Patcher - new tool for ...
	oleavr	Aug/27
CryptoShark: code tracer ba...
	oleavr	Jun/25
Build a debugger in 5 minutes
More ...

Recent Blog Comments
	nieo on:	Mar/22
IAT Patcher - new tool for ...
	djnemo on:	Nov/17
Kernel debugger vs user mod...
	acel on:	Nov/14
Kernel debugger vs user mod...
	pedram on:	Dec/21
frida.github.io: scriptable...
	capadleman on:	Jun/19
Using NtCreateThreadEx for ...
More ...

Imagery

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit