About the problems of stack tracking

%eax is preserved. However the value is changed and so the return value of the function (in %eax) is defined:

main:
        pushl   %eax
        movl    $42, (%esp)
        popl    %eax
        ret
A correct decompilation (as done by holdec) is
// addr = 080483a0.0
// signature= func(main, ret=[<0, int(undef, 4),null,reg[eax]>], para=[], varargs=false)
??? main(???)
{
  return 42;
}
While this provides tiny test program is a problem for some decompiler the following slightly changed program (also returning 42) is not:
main:
        pushl   %ebx
        movl    $42, %eax
        popl    %ebx
        ret
Another test of the stack tracking is to assume that a parameter is passed in %ebx which should be returned (in %eax). This can be done directly:
main:
        movl    %ebx, %eax
        ret
or via the stack
main:
        pushl   %ebx
        popl    %eax
        ret
As expected not all decompiler pass this small test. Holdec (if given the information about the parameter in %ebx) will decompile it to
// addr = 080483a0.0
// signature= func(main, ret=[<0, int(undef, 4),,unknown>], para=[<0, int(undef, 4),parameter1,reg[ebx]>], varargs=false)
??? main(???)
{
  return parameter1;
}
]]>

This entry was posted in decompiler, holdec and tagged . Bookmark the permalink.

Leave a Reply

Your email address will not be published. Required fields are marked *