Igor’s Tip of the Week #176: Handling stack reuse in the decompiler

Previously, we discussed a situation where the decompiler wrongly used a combined stack slot for two separate variables. We could solve it because each variable had a distinct stack location, so editing the stack frame to split them worked.

However, modern optimizing compilers can actually reuse the same stack location for different variables active at different times (e.g. in different scopes). Consider this example:

int __fastcall getval(char a1)
{
  int v2; // [esp+0h] [ebp-4h] BYREF
if ( a1 )

{ …

can compilers decompiler editing handling location malware analysis reuse stack variable week