Referring to this code, used to add a comment:
https://github.com/fireeye/FIDL/blob/e6ceb000cda43b450717eb171309c02dee06dd4f/FIDL/decompiler_utils.py#L2126-L2135
When I saw this, I thought to myself, surely there is a better way!
According to the IDA CPP header,
/// Invisible COLOR_ADDR tags in the output text are used to refer to ctree items and variables
struct ctree_anchor_t
{
uval_t value;
#define ANCHOR_INDEX 0x1FFFFFFF
#define ANCHOR_MASK 0xC0000000
#define ANCHOR_CITEM 0x00000000 ///< c-tree item
#define ANCHOR_LVAR 0x40000000 ///< declaration of local variable
#define ANCHOR_ITP 0x80000000 ///< item type preciser
#define ANCHOR_BLKCMT 0x20000000 ///< block comment (for ctree items)
...
item_preciser_t get_itp(void)
bool is_valid_anchor(void)
bool is_citem_anchor(void)
bool is_itp_anchor(void)
...
};
… these other types of anchors are embedded in the string, and the citem_t anchor just happens to be all 0's. I do (think I) see them in a few places, such as this local variable anchor here:
�(0000000040000007��void *v7��� ;� // ��[xsp+48h] [xbp-8h]��
But I don't see them at all on some other lines where I would at least expect to see an ANCHOR_ITP for an ITP_SEMI item preciser, like this:
�(0000000000000031 �(0000000000000033��objc_release���(0000000000000032� (� �(0000000000000034��v1��� )� � ;� �(0000000000000031
which corresponds to this line:
So, what gives? Why these anchors only on some lines?