NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
51.95k stars 5.9k forks source link

Issue related with parameters #4304

Open Muqi-Zou opened 2 years ago

Muqi-Zou commented 2 years ago

Here are two interesting foundings, for both cases, the what pcode listing shows is different from what the c code decompile shows: For function "_ssh_buffer_pac" in "libssh.so", which is decompiled from source code here. The decompiled code is like:

ulong _ssh_buffer_pack(undefined4 param_1,undefined4 param_2,undefined4 param_3,undefined4 param_4,
                      undefined4 param_5,undefined4 param_6,undefined4 param_7,undefined4 param_8,
                      char *param_9,char *param_10,ulong param_11,undefined8 param_12,
                      undefined8 param_13,undefined8 param_14)
...
     if (param_11 < 0x101) {

where the source code is like:

int _ssh_buffer_pack(struct ssh_buffer_struct *buffer,
                     const char *format,
                     size_t argc,
                     ...){
...
    if (argc > 256) {

There is no difference whether using option "Decompiler Parameter ID" for the above case, And I notice for param_11, there is a difference between pcode and decompile c code: image

The second function is "apply_relative_time" in "touch", where the source code is here the decompiled code has two parameters:

bool apply_relative_time(long param_1,int param_2)
...

the source code has three parameters:

static bool
apply_relative_time (parser_control *pc, relative_time rel, int factor)
....

But what is more interesting is there are 11 parameters being recognized in pcode, but the they were shown as "in_stackxxxx" in decompiled code image And clicking the "in_stackxxxx" shows "param_3" in pcode: image

Muqi-Zou commented 2 years ago

Two binaries are attached here: binaries.zip