avast / avast/retdec

Incorrect decompilation

Open
#486 3 comments 0 reactions 1 assignee Claimed by @PeterMatula View on GitHub
bug P-output
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

[98acc7530cf84c731ff1f42de12b6c21b1ac3778.zip](https://github.com/avast-tl/retdec/files/2831439/98acc7530cf84c731ff1f42de12b6c21b1ac3778.zip)

Decompiling the uploaded file _(password is: 'infected' and as obviously be warned that the file itself is malicious)_ gives the following decompilation:

```
//
// This file was generated by the Retargetable Decompiler
// Website: https://retdec.com
// Copyright (c) 2019 Retargetable Decompiler
//

#include

// ------------------------ Structures ------------------------

struct HINSTANCE__ {
int32_t e0;
};

// ------------------- Function Prototypes --------------------

int32_t _WinMain_40_16(struct HINSTANCE__ * hInstance, struct HINSTANCE__ * hPrevInstance, char * lpCmdLine, int32_t nShowCmd);

// ------------------------ Functions -------------------------

// Address range: 0x40147c - 0x40148e
int32_t _WinMain_40_16(struct HINSTANCE__ * hInstance, struct HINSTANCE__ * hPrevInstance, char * lpCmdLine, int32_t nShowCmd) {
// 0x40147c
return 0;
}

// --------------------- Meta-Information ---------------------

// Detected compiler/packer: upx
// Detected functions: 1
// Decompilation date: 2019-02-05 09:00:08
```

The IDA disassembly shows the following code:
![image](https://user-images.githubusercontent.com/8837736/52263291-0c6a3700-292f-11e9-96e5-8b5c0f99cfb7.png)

Even if the jump and other not interesting instructions are optimized away by RetDec, my opinion is that important call instruction shouldn't be skipped.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.