Igor’s Tip of the Week #160: Hiding casts in the decompiler

In order to faithfully represent the behavior of the code and to conform to the rules of the C language, the decompiler may need to add casts in the pseudocode. A few examples:

• a variable has been detected to be unsigned but participates in a signed comparison:
  
  


• An argument being passed to a function does not match the prototype:
  
  
  
  
  
  


• A narrow value (less that register size) is being loaded from or stored to memory:
  
  


• Actual arguments being passed to a …

argument code decompiler language malware analysis may order pseudocode rules variable week