{"id":60,"date":"2012-02-26T13:13:56","date_gmt":"2012-02-26T12:13:56","guid":{"rendered":"http:\/\/kronotai.com\/wordpress\/?p=60"},"modified":"2012-02-26T13:13:56","modified_gmt":"2012-02-26T12:13:56","slug":"about-the-problems-of-stack-tracking","status":"publish","type":"post","link":"https:\/\/kronotai.com\/wordpress\/2012\/02\/26\/about-the-problems-of-stack-tracking\/","title":{"rendered":"About the problems of stack tracking"},"content":{"rendered":"<p>\t\t\t\t<![CDATA[The stack is a central and important element for a decompiler. A function will get its own parameters from the caller via the stack, it allows to save registers which the caller expected to be unchanged (preserved), it also provides space for the local variables if there is not enough space in the registers , and last but not least it allows to pass parameters to other functions. When I say stack tracking I mean that the decompiler should known which values are at which offsets. These tracked values can be used to replace explicit accesses (like a load) or implicit accesses (calling a function) with the correct values. The access can be done via the stack pointer or a frame pointer.\nIn the following example the enclosing push\/pop suggest that the register <code>%eax<\/code> is preserved. However the value is changed and so the return value of the function (in <code>%eax<\/code>) is defined:\n\n\n<pre lang=\"asm\">\nmain:\n        pushl   %eax\n        movl    $42, (%esp)\n        popl    %eax\n        ret\n<\/pre>\n\n\nA correct decompilation (as done by holdec) is\n\n\n<pre lang=\"c\">\n\/\/ addr = 080483a0.0\n\/\/ signature= func(main, ret=[<0, int(undef, 4),null,reg[eax]>], para=[], varargs=false)\n??? main(???)\n{\n  return 42;\n}\n<\/pre>\n\n\nWhile this provides tiny test program is a problem for some decompiler the following slightly changed program (also returning 42) is not:\n\n\n<pre lang=\"asm\">\nmain:\n        pushl   %ebx\n        movl    $42, %eax\n        popl    %ebx\n        ret\n<\/pre>\n\n\nAnother test of the stack tracking is to assume that a parameter is passed in <code>%ebx<\/code> which should be returned (in <code>%eax<\/code>). This can be done directly:\n\n\n<pre lang=\"asm\">\nmain:\n        movl    %ebx, %eax\n        ret\n<\/pre>\n\n\nor via the stack\n\n\n<pre lang=\"asm\">\nmain:\n        pushl   %ebx\n        popl    %eax\n        ret\n<\/pre>\n\n\nAs expected not all decompiler pass this small test. Holdec (if given the information about the parameter in <code>%ebx<\/code>) will decompile it to\n\n\n<pre lang=\"c\">\n\/\/ addr = 080483a0.0\n\/\/ signature= func(main, ret=[<0, int(undef, 4),,unknown>], para=[<0, int(undef, 4),parameter1,reg[ebx]>], varargs=false)\n??? main(???)\n{\n  return parameter1;\n}\n<\/pre>\n\n\n]]>\t\t<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\t\t\t\t<![CDATA[]]>\t\t <a href=\"https:\/\/kronotai.com\/wordpress\/2012\/02\/26\/about-the-problems-of-stack-tracking\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2,4],"tags":[40],"class_list":["post-60","post","type-post","status-publish","format-standard","hentry","category-decompiler","category-holdec","tag-stack"],"_links":{"self":[{"href":"https:\/\/kronotai.com\/wordpress\/wp-json\/wp\/v2\/posts\/60","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kronotai.com\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kronotai.com\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kronotai.com\/wordpress\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/kronotai.com\/wordpress\/wp-json\/wp\/v2\/comments?post=60"}],"version-history":[{"count":0,"href":"https:\/\/kronotai.com\/wordpress\/wp-json\/wp\/v2\/posts\/60\/revisions"}],"wp:attachment":[{"href":"https:\/\/kronotai.com\/wordpress\/wp-json\/wp\/v2\/media?parent=60"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kronotai.com\/wordpress\/wp-json\/wp\/v2\/categories?post=60"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kronotai.com\/wordpress\/wp-json\/wp\/v2\/tags?post=60"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}