Skip to content
This repository has been archived by the owner on Jun 12, 2024. It is now read-only.

Is there not a way to find the ITP anchor for a given line? #18

Open
NSExceptional opened this issue Jun 22, 2021 · 0 comments
Open

Is there not a way to find the ITP anchor for a given line? #18

NSExceptional opened this issue Jun 22, 2021 · 0 comments

Comments

@NSExceptional
Copy link

Referring to this code, used to add a comment:

https://github.com/fireeye/FIDL/blob/e6ceb000cda43b450717eb171309c02dee06dd4f/FIDL/decompiler_utils.py#L2126-L2135

When I saw this, I thought to myself, surely there is a better way!

According to the IDA CPP header,

 /// Invisible COLOR_ADDR tags in the output text are used to refer to ctree items and variables
 struct ctree_anchor_t
 {
    uval_t value;
    #define ANCHOR_INDEX 0x1FFFFFFF
    #define ANCHOR_MASK 0xC0000000
    #define ANCHOR_CITEM 0x00000000 ///< c-tree item
    #define ANCHOR_LVAR 0x40000000 ///< declaration of local variable
    #define ANCHOR_ITP 0x80000000 ///< item type preciser
    #define ANCHOR_BLKCMT 0x20000000 ///< block comment (for ctree items)
    ...
    item_preciser_t get_itp(void)
    bool is_valid_anchor(void)
    bool is_citem_anchor(void)
    bool is_itp_anchor(void)
    ...
 };

… these other types of anchors are embedded in the string, and the citem_t anchor just happens to be all 0's. I do (think I) see them in a few places, such as this local variable anchor here:

  �(0000000040000007��void *v7���	;�	 // ��[xsp+48h] [xbp-8h]��

But I don't see them at all on some other lines where I would at least expect to see an ANCHOR_ITP for an ITP_SEMI item preciser, like this:

�(0000000000000031  �(0000000000000033��objc_release���(0000000000000032�	(�	�(0000000000000034��v1���	)�	�	;�	�(0000000000000031           

which corresponds to this line:

  objc_release(v1);

So, what gives? Why these anchors only on some lines?

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant