question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Structure Decompilation

See original GitHub issue

When decompiling a class function (__thiscall) and a virtual base’s member is accessed it gets represented as accessing the _vptr field with a negative index. ex: *(undefined4 *)(this->_vptr[-1].~H + &this->field_0xc) = 2;

disassembly output:

MOV        RAX,qword ptr [RAX]  ; RAX = address of vftable
SUB        RAX,0x18 ; RAX = address of offset_to_E
MOV        RAX,qword ptr [RAX] ; load 0x10 (offset_to_E) into RAX
MOV        RDX, RAX ; move offset_to_E into RDX
MOV        RAX,qword ptr [RBP + local_20] ; move H *this back into RAX
ADD        RAX,__type ; add offset_to_E to this
MOV        dword ptr [RAX + 0xc],0x2 ; super_E.e_data = 2

Is there a way that I can override the offset of the structure component being accessed here? I know through RTTI analysis that the offset at [-1] produces offset_to_E. I would like to give the decompiler the appropriate information so that it just produces: this->super_E.e_data = 2;

Issue Analytics

  • State:closed
  • Created 4 years ago
  • Comments:5 (4 by maintainers)

github_iconTop GitHub Comments

1reaction
saruman9commented, Feb 5, 2020

I think, that fixing of issue #573 can help you resolve the issue.

1reaction
paulsappscommented, Oct 4, 2019
Read more comments on GitHub >

github_iconTop Results From Across the Web

Native x86 Decompilation using Semantics-Preserving ...
We propose a new structural analysis algorithm that addresses two shortcomings of existing structural analysis algorithms: (1) they can cause incorrect.
Read more >
Structuring Decompiled Graphs Cristina Cifuentes ...
During decompilation, a generic set of high-level control structures needs to be defined first in order to decompose a program ' s control...
Read more >
Decompiler - Wikipedia
A decompiler is a computer program that translates an executable file to a high-level source file which can be recompiled successfully.
Read more >
Native x86 Decompilation Using Semantics ... - USENIX
Native x86 Decompilation Using Semantics-Preserving Structural Analysis and Iterative Control-Flow Structuring. Authors: Edward J. Schwartz, Carnegie Mellon ...
Read more >
Making a Decompiler from Nothing — A Postmortem - Medium
Decompilation is the art of abstraction, taking simple parts and ... This way we can recursively decompile the “bigger” structures and, ...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found