5

Is it possible to force IDA to show "5 * 20" instead of "100" in the below disassembled and decompiled lines?

MOV     R1, #100  ->  MOV     R1, #(5 * 20)
LDR     R8, =var  |   LDR     R8, =var
STR     R1, [R8]  |   STR     R1, [R8]

Corresponding decompiled code:

var = 100;        ->  var = 5 * 20;
Peter Mortensen
  • 143
  • 6
E.A
  • 171
  • 1
  • 1
  • 13
  • 2
    @rce It's not a stupid question. As I read it, the question is about how to ask IDA to show an operand (in the disassembly) or an expression (in the decompilation) in an alternative fashion, as a form of annotation to aid in comprehension. This is not that much different from displaying a constant as an enum element. And as my answer illustrates, it is in fact possible to do this. Everybody else seems to have interpreted the question as being how to undo compiler optimizations instead of a question about how to annotate the database. – Rolf Rolles Apr 13 '23 at 01:40

2 Answers2

5

Right-click on the operand, click "Manual...", enter the string "5 * 20". Note that this only works in the disassembly listing, and that there is no comparable functionality in the decompilation.

Rolf Rolles
  • 9,198
  • 1
  • 23
  • 33
1

At the assembly level, IDA reconstructs the instructions as seen in memory.

Constant multiplication adds an overhead of at least one additional instruction (like MUL or MLA for ARM CPUs); when a compiler detects two constants being multiplied in source code, the result is usually calculated at compile time and used as a single constant in the compiled binary.

If the compiler optimized your code by replacing 5 * 20 with 100, there isn't any way for IDA to disassemble or decompile it differently. In such a case that information has been lost during compilation and only exists in the application's source code.

Assuming ARM architecture and a little-endian CPU like TI MSP430, the first instruction,

MOV R1, #100

would produce the following opcodes:

\x64\x10\xa0\xe3

If that is the case for you, you need to recompile the program with different compiler settings or use a different compiler to exclude compilation-time optimizations.

You can enable the view of opcodes in IDA with Options/General/Disassembly → Number of opcode bytes (non-graph).

Peter Mortensen
  • 143
  • 6
mimak
  • 579
  • 1
  • 3
  • 15
  • 1
    but there should be no reason why the reverse engineer shouldn't be able to tell IDA that it was 5*20 – user253751 Apr 11 '23 at 22:04
  • ida or you after you lost your source looking at the disassembly 10 years later wouldnt be able to tell if 100 was 1+99 or 200-100 Or 1000/10 or 1010 or 520 – blabb Apr 12 '23 at 03:30
  • 2
    @blabb While you likely don't know whether it was 5 * 20 in the source code, you very much can determine during reverse engineering that 5 * 20 helps understanding the disassembly, and prefer to have it printed that way. The "manual operand" feature is meant for exactly this case. On the most common assemblers, IDA is even able to verify that your manually entered operand expression matches the value found in the machine code. Features like this make IDA an Interactive Dis-Assembler and IMHO are a significant reason why IDA use is so wide-spread. – Michael Karcher Apr 12 '23 at 05:36
  • @MichaelKarcher you mean if there is a hardcoded 0x100 then you can discern its origin back to its components using the disassembly – blabb Apr 12 '23 at 05:46
  • 1
    @blabb Yes exactly, if there is a hard-coded 100 in disassembly then a reverse engineer can (maybe must) resolve it to "1 + 99", "4 * 25", "(23 * 2) + 11 + 43", and so on. As an example consider a situation that the variable "var" with immediate value 100 is compared with another variable that holds a temperature sensor value in disassembly. From its datasheet you know sensor is reporting the read temperature in "4X °C" format. Now the mysterious value "100" became the friendly "4 * 25" which means the original code was comparing the sensor value with 25 °C. – E.A Apr 12 '23 at 10:51
  • 3
    @blabb it's impossible to know what the original source had for the constant from the disassembly, but it doesn't really matter. If 5*20 makes the code more legible and understandable it's better to decompile it to that regardless of what the original source code had. It may even be an improvement over the original source code. – Rick Apr 12 '23 at 11:50
  • @blabb As E.A and Rick already stated: I don't know whether it was 520 in the original code (I'm not a mentalist or something like that), but I can find out that the disassembly is more easily understood if it reads 520. And the really great thing is: I can get IDA to show it that way, instead of having to add a comment "BTW: This is 5*20" – Michael Karcher Apr 12 '23 at 21:50
  • Display/equating is not what i meant that should be possible and preferable too when it was asked why cant ida do it it appeared to be unoptimising and recovering a lost artifact and not about displaying a manual effort rolf answered and commented right about interpretation – blabb Apr 13 '23 at 03:05