avast / avast/retdec

Unicode string in PE is processed incorrectly

Open
#937 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

I wrote some code sample as below to display Unicode string in VS2019 under windows;
'
printf("请输入字符串:");
'
the .dsm file show the string correctly.

![1](https://user-images.githubusercontent.com/64534606/111967489-12352d80-8b33-11eb-9bb3-23fcc7ca13a9.png)

but in .ll, the decompiled code is wrong, the Unicode string is translated to i64.
![2](https://user-images.githubusercontent.com/64534606/111967758-62ac8b00-8b33-11eb-9eae-1d5fc420f2db.png)

we expected it is translated to below
**unnamed_addr constant [16 x i8] c"\c7\eb\ca\e4\c8\eb\d7\d6 \b7\fb\b4\ae\a3\ba\00\00"**

PE file attatched in below:

[Project2.zip](https://github.com/avast/retdec/files/6180924/Project2.zip)

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the report with the attached Project2.zip on Windows and compare the generated .dsm and .ll outputs for the Unicode string. Done means the decompiled LLVM output preserves the string as the expected byte-array constant rather than translating it to i64.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.