FIDL
FIDL copied to clipboard
Is there not a way to find the ITP anchor for a given line?
Referring to this code, used to add a comment:
https://github.com/fireeye/FIDL/blob/e6ceb000cda43b450717eb171309c02dee06dd4f/FIDL/decompiler_utils.py#L2126-L2135
When I saw this, I thought to myself, surely there is a better way!
According to the IDA CPP header,
/// Invisible COLOR_ADDR tags in the output text are used to refer to ctree items and variables
struct ctree_anchor_t
{
uval_t value;
#define ANCHOR_INDEX 0x1FFFFFFF
#define ANCHOR_MASK 0xC0000000
#define ANCHOR_CITEM 0x00000000 ///< c-tree item
#define ANCHOR_LVAR 0x40000000 ///< declaration of local variable
#define ANCHOR_ITP 0x80000000 ///< item type preciser
#define ANCHOR_BLKCMT 0x20000000 ///< block comment (for ctree items)
...
item_preciser_t get_itp(void)
bool is_valid_anchor(void)
bool is_citem_anchor(void)
bool is_itp_anchor(void)
...
};
… these other types of anchors are embedded in the string, and the citem_t anchor just happens to be all 0's. I do (think I) see them in a few places, such as this local variable anchor here:
(0000000040000007void *v7 ; // [xsp+48h] [xbp-8h]
But I don't see them at all on some other lines where I would at least expect to see an ANCHOR_ITP for an ITP_SEMI item preciser, like this:
(0000000000000031 (0000000000000033objc_release(0000000000000032 ( (0000000000000034v1 ) ; (0000000000000031
which corresponds to this line:
objc_release(v1);
So, what gives? Why these anchors only on some lines?