rizinorg / cutter

Free and Open Source Reverse Engineering Platform powered by rizin
https://cutter.re
GNU General Public License v3.0
15.92k stars 1.15k forks source link

Decompiler function signatures don't match to analysed ones. #3338

Closed ROMAINPC closed 6 months ago

ROMAINPC commented 6 months ago

Environment information

Describe the bug

In the decompiler view all functions have void arguments. However, the comments in the disassembly view clearly shows the correct signature of the function. Consequently decompiled code is really hard to read. I am a beginner with Cutter may be am I missing a setting.

To Reproduce

Steps to reproduce the behavior:

  1. Open a binary file (x86_64)
  2. Analyse it (auto mode)
  3. Open main() function in decompiler view

Expected behavior

Code signature will be int32_t main (void) and code will look like

    rax = s;
    fgets (rax, 0x40, *(stdin));
    rax = s;
    rdi = rax;
    eax = my_other_func();

Instead of : (in Ghidra for example)

  fgets(local_48, 0x40, stdin);
  iVar1 = my_other_func(local_48);
ROMAINPC commented 6 months ago

I spent several hours on this problem and it is by posting the issue that I found a solution!

For beginners like me : Force use of Ghidra decompiler with the Decompiler: option at bottom right of the window. Switch from jsdec to Ghidra.