1

There's this Ghidra decompiled C code.

I understand that local_60 is a quad word, but I don't understand indexing it

What does local_60._3_1_ refer to here?

  local_60 = 0x6c46575935676a5a;
  local_28 = 0x7945474e3563544f;
  printf("Enter access code: ");
  __isoc99_scanf(&DAT_0010201c,&DAT_001040c0);
  if ((((DAT_001040c0 == 'f') && (DAT_001040c1 == 'b')) && (DAT_001040c2 == local_60._3_1_)) &&
     ((DAT_001040c3 == '6' && (DAT_001040c4 == local_28._2_1_)))) {
Paku
  • 455
  • 1
  • 4
  • 15

1 Answers1

3

You can usually click on the part of decompiled C code and highlight what part of original assembly produced it, this could help you understand what ghidra means by _3_1_ and _2_1_.

From my experience, the _X_Y_ syntax usually means that the code tries to "index" into an integer like an array, by taking a value of a single byte out of 8 into account. In addition to that, if you inspect byte values from the two constants 0x6c46575935676a5a and 0x7945474e3563544f you may notice that all the bytes are proper ASCII characters. These two things would suggest that local_60 and local_28 should instead be char[8] instead of integers. You should be able to right-click on the variable declarations and change their type manually, which may make code more readable by changing syntax into array indexing and array initialization.

msaw328
  • 1,459
  • 10
  • 18