avast / avast/retdec

How to make sense of this decompiled output with struct pointer

Open
#953 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

Consider the following trivial binary tree search:

```
struct Node
{
int value;
Node *lchild;
Node *rchild;
};

Node *search(int value, Node *start)
{
if (start == nullptr)
{
return nullptr;
}
if (start->value == value)
{
return start;
}
Node *node;
node = search(value, start->lchild);
if (node != nullptr)
{
return node;
}
node = search(value, start->rchild);
if (node != nullptr)
{
return node;
}
return nullptr;
}
```

I first compile using GCC 8.1.0 on windows:

```
g++ -fPIC -shared .\simple.cc -o libsimple.dll
```

Then I run the retdec decompiler:

```
retdec-decompiler.py .\libsimple.dll
```

In the output, here is the relevant section:

```
// Address range: 0x6eac13b0 - 0x6eac1431
// Demangled: search(int, Node*)
int64_t _Z6searchiP4Node(int32_t a1, int64_t * a2) {
// 0x6eac13b0
if (a2 == NULL) {
// 0x6eac142b
return 0;
}
int64_t result = (int64_t)a2;
int64_t v1; // 0x6eac13b0
if ((int32_t)v1 == a1) {
// 0x6eac142b
return result;
}
int64_t v2 = _Z6searchiP4Node(a1, (int64_t *)*(int64_t *)(result + 8)); // 0x6eac13ec
int64_t result2 = v2; // 0x6eac13fa
if (v2 == 0) {
// 0x6eac1402
result2 = _Z6searchiP4Node(a1, (int64_t *)*(int64_t *)(result + 16));
}
// 0x6eac142b
return result2;
}
```

Everything makes sense, except for this block of code:

```
int64_t result = (int64_t)a2;
int64_t v1; // 0x6eac13b0
if ((int32_t)v1 == a1) {
// 0x6eac142b
return result;
}
```

I think this section should correspond to `if (start->value == value) { return start; }` in the original source code, but I can't understand how `(int32_t)v1 == a1` maps to `start->value == value`.

Can anyone explain? Thanks in advance!

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the example from simple.cc using GCC 8.1.0 on Windows and retdec-decompiler.py, then inspect the generated search(int, Node*) output around 0x6eac13b0–0x6eac1431. Compare the output with the supplied source and determine whether the unexplained v1 value is a decompiler defect; the issue is resolved by an explained or corrected result.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.