FIDL icon indicating copy to clipboard operation
FIDL copied to clipboard

Is there not a way to find the ITP anchor for a given line?

Open NSExceptional opened this issue 4 years ago • 0 comments

Referring to this code, used to add a comment:

https://github.com/fireeye/FIDL/blob/e6ceb000cda43b450717eb171309c02dee06dd4f/FIDL/decompiler_utils.py#L2126-L2135

When I saw this, I thought to myself, surely there is a better way!

According to the IDA CPP header,

 /// Invisible COLOR_ADDR tags in the output text are used to refer to ctree items and variables
 struct ctree_anchor_t
 {
    uval_t value;
    #define ANCHOR_INDEX 0x1FFFFFFF
    #define ANCHOR_MASK 0xC0000000
    #define ANCHOR_CITEM 0x00000000 ///< c-tree item
    #define ANCHOR_LVAR 0x40000000 ///< declaration of local variable
    #define ANCHOR_ITP 0x80000000 ///< item type preciser
    #define ANCHOR_BLKCMT 0x20000000 ///< block comment (for ctree items)
    ...
    item_preciser_t get_itp(void)
    bool is_valid_anchor(void)
    bool is_citem_anchor(void)
    bool is_itp_anchor(void)
    ...
 };

… these other types of anchors are embedded in the string, and the citem_t anchor just happens to be all 0's. I do (think I) see them in a few places, such as this local variable anchor here:

  (0000000040000007void *v7	;	 // [xsp+48h] [xbp-8h]

But I don't see them at all on some other lines where I would at least expect to see an ANCHOR_ITP for an ITP_SEMI item preciser, like this:

(0000000000000031  (0000000000000033objc_release(0000000000000032	(	(0000000000000034v1	)		;	(0000000000000031           

which corresponds to this line:

  objc_release(v1);

So, what gives? Why these anchors only on some lines?

NSExceptional avatar Jun 22 '21 22:06 NSExceptional