Decompilation incorrectly uses pointer instead of the value it points to
- Dominant language
- C++
- Stars
- 8.6k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
Running RetDec built from https://github.com/avast-tl/retdec/commit/d57764abb7e45de61a22e45df298161b280316e1. I'm looking at a function that starts like this in the `.dsm` file:
```
0x10049390: 55 push ebp
0x10049391: 8b ec mov ebp, esp
0x10049393: 83 ec 14 sub esp, 0x14
0x10049396: 53 push ebx
0x10049397: 56 push esi
0x10049398: 8b 71 04 mov esi, dword ptr [ecx + 4]
0x1004939b: 8b da mov ebx, edx
0x1004939d: 57 push edi
0x1004939e: 8b 39 mov edi, dword ptr [ecx]
0x100493a0: 3b fe cmp edi, esi
0x100493a2: 0f 84 81 00 00 00 je 0x10049429
```
In the `.c` file I get the following:
```
int32_t function_10049390(int32_t a1, int32_t a2) {
// 0x10049390
int32_t v1; // bp-24
int32_t v2 = &v1; // 0x10049393
int32_t v3 = g4; // 0x10049396
int32_t v4 = g8; // bp-32
int32_t str = g5; // 0x10049398
int32_t v5 = *(int32_t *)(str + 4); // 0x10049398
g8 = v5;
int32_t v6 = g7; // 0x1004939b
int32_t v7 = g6; // bp-36
g6 = str;
if (v5 == str) {
```
So `ecx` is turned into `g5`, `edi` into `str` and `esi` into `v5` - so far it all makes sense. However, unlike indicated in the C program, `edi` and `ecx` are *not* the same. Rather, `ecx` points to a structure with two pointers, string start and string end. This appears to be some optimization gone wrong. I would rather expect the following here:
```
int32_t v5 = *(int32_t *)(g5 + 4); // 0x10049398
int32_t str = *(int32_t *)g5; // 0x1004939e
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Reproduce the report with RetDec at commit d57764abb7e45de61a22e45df298161b280316e1, using the shown .dsm function and comparing its generated .c output. Trace how the ecx-based structure fields become edi and esi, then verify that the generated C dereferences both structure members and matches the assembly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100