avast / avast/retdec

Decompilation incorrectly uses pointer instead of the value it points to

Open
#384 8 comments 0 reactions 0 assignees View on GitHub
bug C-bin2llvmir P-output
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

Running RetDec built from https://github.com/avast-tl/retdec/commit/d57764abb7e45de61a22e45df298161b280316e1. I'm looking at a function that starts like this in the `.dsm` file:

```
0x10049390: 55 push ebp
0x10049391: 8b ec mov ebp, esp
0x10049393: 83 ec 14 sub esp, 0x14
0x10049396: 53 push ebx
0x10049397: 56 push esi
0x10049398: 8b 71 04 mov esi, dword ptr [ecx + 4]
0x1004939b: 8b da mov ebx, edx
0x1004939d: 57 push edi
0x1004939e: 8b 39 mov edi, dword ptr [ecx]
0x100493a0: 3b fe cmp edi, esi
0x100493a2: 0f 84 81 00 00 00 je 0x10049429
```

In the `.c` file I get the following:

```
int32_t function_10049390(int32_t a1, int32_t a2) {
// 0x10049390
int32_t v1; // bp-24
int32_t v2 = &v1; // 0x10049393
int32_t v3 = g4; // 0x10049396
int32_t v4 = g8; // bp-32
int32_t str = g5; // 0x10049398
int32_t v5 = *(int32_t *)(str + 4); // 0x10049398
g8 = v5;
int32_t v6 = g7; // 0x1004939b
int32_t v7 = g6; // bp-36
g6 = str;
if (v5 == str) {
```

So `ecx` is turned into `g5`, `edi` into `str` and `esi` into `v5` - so far it all makes sense. However, unlike indicated in the C program, `edi` and `ecx` are *not* the same. Rather, `ecx` points to a structure with two pointers, string start and string end. This appears to be some optimization gone wrong. I would rather expect the following here:

```
int32_t v5 = *(int32_t *)(g5 + 4); // 0x10049398
int32_t str = *(int32_t *)g5; // 0x1004939e
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the report with RetDec at commit d57764abb7e45de61a22e45df298161b280316e1, using the shown .dsm function and comparing its generated .c output. Trace how the ecx-based structure fields become edi and esi, then verify that the generated C dereferences both structure members and matches the assembly.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.