花了兩年逆_向 hexrays(反_編_譯), 想徵求同好一起討論研究
曾經處理過 hexrays x86 6.8 mac & windows
以下提供幾個函數
char __fastcall vdui_t_get_current_item(vdui_t *a1, input_device_t a2)
{
vdui_t *v2; // esi@1
ctree_item_t *v3; // eax@1
char *v4; // eax@1
TCustomControl *v5; // eax@1
ctree_item_t *v6; // ebp@1
int v7; // ebx@2
simpleline_place_t *v8; // eax@2
unsigned int v9; // ecx@3
TCustomControl *v10; // eax@3
callui_t v11; // eax@3
char result; // al@3
ctree_item_t *ptail; // [sp+10h] [bp-Ch]@1
ctree_item_t *pitem; // [sp+14h] [bp-8h]@1
v2 = a1;
v3 = &a1->item;
pitem = v3;
v3->citype = (cursor_item_type_t)0;
v4 = (char *)&a1->tail;
ptail = (ctree_item_t *)v4;
*(_DWORD *)v4 = 0;
v5 = a1->ct;
v6 = &a1->head;
a1->head.citype = VDI_NONE;
if ( v5
&& (v7 = a2 != 0, (v8 = (simpleline_place_t *)callui(ui_get_curplace, v5, v7, &a1->cpos.x, &a1->cpos.y).i) != 0) )
{
v9 = v8->n;
v10 = v2->ct;
v2->cpos.lnnum = v9;
v11 = callui(ui_get_custom_viewer_curline, v10, v7);
result = cfunc_t_get_line_item(
v2->cfunc,
v11.cptr,
v2->cpos.x,
v2->cpos.lnnum >= v2->cfunc->hdrlines,
v6,
pitem,
ptail);
}
else
{
result = 0;
}
return result;
}
char __fastcall vdui_t_ui_rename_lvar(vdui_t *a1, lvar_t *a2)
{
lvar_t *v2; // esi@1
vdui_t *v3; // ebx@1
char *v4; // eax@1
char *v5; // ebp@5
const char *v6; // eax@6
int v7; // eax@11
char *v8; // edi@13
char *v9; // esi@13
signed int v10; // esi@20
lvar_t *v11; // edi@24
int v12; // eax@25
member_t *v13; // esi@26
func_t *v14; // eax@27
struc_t *v15; // eax@27
struc_t *v16; // edi@27
func_t *v17; // eax@28
bool v18; // zf@30
char v19; // al@32
signed int v20; // esi@34
int v21; // edi@34
char result; // al@41
bool v23; // [sp+2Fh] [bp-209h]@9
lvar_t *v; // [sp+30h] [bp-208h]@1
char defval[512]; // [sp+34h] [bp-204h]@3
int v26; // [sp+234h] [bp-4h]@21
v2 = a2;
v3 = a1;
v = a2;
v4 = null_string;
if ( a2->name.body.n )
v4 = a2->name.body.array;
qstrncpy(defval, v4, 0x200u);
while ( 1 )
{
v5 = vaskstr(HIST_IDENT, defval, "Please enter variable name");
if ( !v5 )
return 0;
v6 = null_string;
if ( v2->name.body.n )
v6 = v2->name.body.array;
if ( !strcmp(v6, v5) )
return 0;
v23 = *v5 == 0;
if ( *v5 && check_reserved_word(v3->mba, v5, cn_all) )
{
v7 = askbuttons(
1,
"AUTOHIDE REGISTRY\n"
"Sorry, name '%s' is already present in the database.\n"
"Do you want to add a numerical suffix to it?",
v5);
if ( !v7 )
goto LABEL_4;
if ( v7 == -1 )
return 0;
v8 = qstpncpy(defval, v5, 0x200u);
v9 = v8;
if ( v8 > defval )
{
while ( isdigit((unsigned __int8)*(v9 - 1)) )
{
if ( --v9 <= defval )
goto LABEL_20;
}
if ( v9 > defval && *(v9 - 1) == '_' )
{
v8 = v9 - 1;
*(v9 - 1) = 0;
}
}
LABEL_20:
v10 = 1;
do
{
qsnprintf(v8, (char *)&v26 - v8, "_%d", v10);
if ( !check_reserved_word(v3->mba, defval, cn_all) )
break;
++v10;
}
while ( v10 < 1000 );
v5 = defval;
}
v11 = v;
if ( lvar_locator_t_170866B0(v3, (lvar_locator_t *)&v->location) )
{
v12 = lvar_t_get_value(v);
if ( v12 >= 0 )
{
v13 = mbl_array_t_get_member(v3->mba, v12, 0);
if ( v13 )
{
v14 = get_func(v3->mba->defea);
v15 = get_frame(v14);
v3->flags |= VDUI_LOCKED;
v16 = v15;
if ( v23 )
{
v17 = get_func(v3->mba->defea);
build_stkvar_name(defval, 0x200u, v17, v13->soff);
v5 = defval;
}
set_member_name(v16, v13->soff, v5);
v3->flags &= ~VDUI_LOCKED;
goto LABEL_39;
}
}
goto LABEL_40;
}
v18 = v23 == 0;
if ( v23 )
{
if ( (LOWORD(v->flags) >> 8) & 1 || (v18 = lvar_t_is_func_arg(v) == 0, v19 = 'v', !v18) )
v19 = 'a';
v20 = 1;
v21 = v19;
while ( 1 )
{
qsnprintf(defval, 0x200u, "%c%d", v21, v20);
if ( !check_reserved_word(v3->mba, defval, cn_all) )
break;
if ( ++v20 >= 100 )
goto LABEL_39;
}
v5 = defval;
LABEL_39:
v11 = v;
LABEL_40:
v18 = v23 == 0;
}
result = vdui_t_rename_lvar(v3, v11, v5, v18);
if ( result )
return result;
vwarning("AUTOHIDE NONE\nSorry, can not rename the variable");
qstrncpy(defval, v5, 0x200u);
LABEL_4:
v2 = v;
}
}
cmt_type_t __fastcall vdui_t_calc_cmt_type(vdui_t *a1, unsigned int a2, cmt_type_t a3)
{
cfunc_t *v3; // eax@1
cmt_type_t result; // eax@2
int v5; // esi@3
ctree_item_t v6; // [sp+4h] [bp-18h]@3
ctree_item_t v7; // [sp+10h] [bp-Ch]@3
v3 = a1->cfunc;
if ( a2 < v3->sv.n )
{
v5 = a3;
cfunc_t_get_line_item(
v3,
v3->sv.array[a2].line.body.array,
0,
a1->cpos.lnnum >= v3->hdrlines,
(ctree_item_t *)((a3 & 0x1E) != 0 ? (unsigned int)&v7 : 0),
0,
(ctree_item_t *)((a3 & 1) != 0 ? (unsigned int)&v6 : 0));
if ( v7.citype != VDI_FUNC )
v5 = a3 & ~CMT_FUNC;
if ( v7.citype != VDI_TAIL )
v5 &= ~6u;
if ( v7.citype != VDI_LVAR )
v5 &= ~CMT_LVAR;
if ( v6.citype != VDI_TAIL || v6.loc.ea == -1 )
v5 &= ~CMT_TAIL;
result = (cmt_type_t)v5;
}
else
{
result = (cmt_type_t)0;
}
return result;
}
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
