Overlapped variables

In some cases the decompiler cannot produce nice output because the variable allocation fails. It happens because the input contains overlapped variables (or the decompiler mistakenly lumps together memory reads and writes). Overlapped variables are displayed in red so they conspicuously visible. Let us consider some typical situations.

• There are read/write accesses that involve two or more variables

  For example, consider the following output:
  __int64 v1; // qax@2 OVERLAPPED int v2; // ecx@2 OVERLAPPED __int64 result; // qax@4 if ( *(_BYTE *)(a1 + 5) & 1 ) { HIDWORD(v1) = *(_DWORD *)(a1 + 7); v2 = *(_DWORD *)(a1 + 11); } else { HIDWORD(v1) = 0; v2 = 0; } v1 = *(__int64 *)((char *)&v1 + 4); // ODD ASSIGNMENT!
  The last assignment to v1 reads beyond v1 boundaries. In fact, it also reads v2. See the assembly code:
  test byte ptr [eax+5], 1 jz short loc_409521 mov edx, [eax+7] mov ecx, [eax+0Bh] jmp short loc_409525 loc_409521: xor edx, edx xor ecx, ecx loc_409525: mov eax, edx mov edx, ecx
  Unfortunately the decompiler cannot handle this case and reports overlapped variables.

• There is an array function argument

  Arrays cannot be passed to functions by value, so this will lead to a warning. Just get rid of such an array (embed it into a structure type, for example)

• There are too many function arguments

  The decompiler can handle up to 64 function arguments. It is very unlikely to encounter a function with a bigger number of arguments. If so, just embed some of them into a structure passed by value.

• Check the stack variables and fix them if necessary. A wrongly variable can easily lead to a lvar allocation failure.
• Define a big structure that covers the entire stack frame or part of it. Such a big variable will essentially turn off variables lumping (if you are familiar with compiler jargon, the decompiler builds a web of lvars during lvar allocation and some web elements become too big, this is why variable allocation fails). Instead, all references will be done using the structure fields.
• Check the function argument area of the stack frame and fix any wrong variables. For example, this area should not containt any arrays (arrays cannot be passed by value in C). It is ok to pass structures by value, the decompiler accepts it.