avast / avast/retdec

Detection of data structures using the example of structs from C/C++.

Open
#219 2 comments 0 reactions 0 assignees View on GitHub
bug C-bin2llvmir P-output
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

I've been playing around with pure C in connection with the GCC today. I did the whole thing on Ubuntu, because using retdec is really easy.

I used the following example:

```
typedef struct Item item;
struct Item {
int i;
int j;
void (*fooprint)(item*);
};

void fooprint(item *it){
printf("%d\n",it->i);
}

int main()
{
item * myitem2;
myitem2 = malloc(sizeof(item));
myitem2->i=50;
myitem2->j=100;
myitem2->fooprint = fooprint;

myitem2->fooprint(myitem2);

printf("Hello world\n");
return (0);
}
```

When compiling, I used the -O0 switch to avoid optimizations. Unfortunately, the result doesn't even remind us of the source, although it was super easy to knit. What struck me most of all is that structures are not recognized at all.

From this code:

```
myitem2->i=50;
myitem2->j=100;
myitem2->fooprint = fooprint;

myitem2->fooprint(myitem2);
```

it will be in the return result.

```
*(int32_t *)v4 = 50;
*(int32_t *)(v4 + 4) = 100;
int32_t v5 = g2 - 0x19ef; // bp+682
*(int32_t *)(v4 + 8) = v5;
__pseudo_call(v5);
```
So something can't be right.

By the way, which is also funny. The "hello world" function of the printf function no longer exists in the result at all.....

Edited: I've been experimenting a little bit. The problem seems to be fundamentally more complex structures. While here for example the decompiler "Snowman" recognizes this, I have no success to get back the structures I programmed in the program. It almost seems to me that these have not been taken into consideration yet. Snowman" recognizes so many structures and avoids those integer hands including offset.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the supplied C struct example and compare its compiled output with RetDec's generated result, especially the field stores, function-pointer call, and missing printf code. Trace the structure-recovery and decompilation entry points responsible for this output; done means the resulting decompilation represents the programmed structure rather than only integer offsets.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, cpp
Domain
compilers, reverse-engineering
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.