ghidra icon indicating copy to clipboard operation
ghidra copied to clipboard

Struct members shown in disassembly but not in decompiler

Open joxeankoret opened this issue 1 year ago • 1 comments
trafficstars

Describe the bug

Struct members assigned to a local variable are correctly shown in the disassembly but they are not show in the decompilation, and they look odd, as show in the attached screenshot.

To Reproduce

  1. Open DXCaptureReplay.dll from Windows 10, load the PDB, analyse it, etc...
  2. Go to CheckForWindowClosureImpl.
  3. Change lpMessage local variable type to MSG.
  4. Assignments to strut members won't be shown properly in the decompiler while they will properly appear in the disassembly.

Expected behavior Seeing the same member names in the disassembly and the decompiler.

Screenshots irudia

Environment (please complete the following information):

  • OS: Ubuntu Linux 22.04.3 LT
  • Java Version: 17.0.9
  • Ghidra Version: 11.0
  • Ghidra Origin: Github

joxeankoret avatar Jan 12 '24 16:01 joxeankoret

PS: The "best" outcome here, however, would be to just collapse the 3 ZEXT816() calls into a single memset(lpMessage, '\0', sizeof(MSG)) instruction.

joxeankoret avatar Jan 15 '24 15:01 joxeankoret

The disassembly markup does not consider the access size which does not align with actual component sizes. It simply identifies the location where the write occurs.

ghidra1 avatar Jun 05 '24 21:06 ghidra1

The decompiler will not show as structure member access since the accesses do not match-up properly with components. The writes are compiler generated for simplified/rapid clearing of structure data.

ghidra1 avatar Jun 24 '24 17:06 ghidra1