Skip to content
This repository was archived by the owner on Jun 12, 2024. It is now read-only.
This repository was archived by the owner on Jun 12, 2024. It is now read-only.

Is there not a way to find the ITP anchor for a given line? #18

@NSExceptional

Description

@NSExceptional

Referring to this code, used to add a comment:

https://github.com/fireeye/FIDL/blob/e6ceb000cda43b450717eb171309c02dee06dd4f/FIDL/decompiler_utils.py#L2126-L2135

When I saw this, I thought to myself, surely there is a better way!

According to the IDA CPP header,

 /// Invisible COLOR_ADDR tags in the output text are used to refer to ctree items and variables
 struct ctree_anchor_t
 {
    uval_t value;
    #define ANCHOR_INDEX 0x1FFFFFFF
    #define ANCHOR_MASK 0xC0000000
    #define ANCHOR_CITEM 0x00000000 ///< c-tree item
    #define ANCHOR_LVAR 0x40000000 ///< declaration of local variable
    #define ANCHOR_ITP 0x80000000 ///< item type preciser
    #define ANCHOR_BLKCMT 0x20000000 ///< block comment (for ctree items)
    ...
    item_preciser_t get_itp(void)
    bool is_valid_anchor(void)
    bool is_citem_anchor(void)
    bool is_itp_anchor(void)
    ...
 };

… these other types of anchors are embedded in the string, and the citem_t anchor just happens to be all 0's. I do (think I) see them in a few places, such as this local variable anchor here:

  �(0000000040000007��void *v7���	;�	 // ��[xsp+48h] [xbp-8h]��

But I don't see them at all on some other lines where I would at least expect to see an ANCHOR_ITP for an ITP_SEMI item preciser, like this:

�(0000000000000031  �(0000000000000033��objc_release���(0000000000000032�	(�	�(0000000000000034��v1���	)�	�	;�	�(0000000000000031           

which corresponds to this line:

  objc_release(v1);

So, what gives? Why these anchors only on some lines?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions