I decompiled a file in ghidra and I sawed a lot of CONCAT+RandomNumber in decompiled file!
what does they mean ?
Let me cite the Ghidra Help (F1) first:
CONCAT31(x,y)
- Concatenation operator -PIECE
The digit '3' indicates the size of the input operand 'x' in bytes. The digit '1' indicates the size of the input operand 'y' in bytes. The parameters 'x' and 'y' hold the values being concatenated.CONCAT31(0xaabbcc,0xdd) = 0xaabbccdd
Concatenate the bytes in 'x' with the bytes in 'y'. 'x' becomes the most significant bytes, and 'y' the least significant bytes, in the result. So all these "functions" prefixed with
CONCAT
belong to a set of internal decompiler functions used by Ghidra to express things that normally not simply expressed in the C-like high level representation.
CONCAT
in particular could be modeled as a left shift of the first argument by the size of the second argument and then logical and-ing the two parameters. But for humans it's much easier to think of it as "put the two things next to each other".
The numbers following CONCAT
only matter if the passed arguments are not the expected sizes and are probably mainly there to make things more explicit. Concretely, you shouldn't read CONCAT15
as "concat fifteen" but as "concat one five": The first argument is expected to have a size of one byte while the second has a size of five, totaling to an amount of six bytes: CONCAT15(0x12, 0x3456789012)
is the same as 0x123456789012
.
P.S.: CONCAT412
almost certainly means concating 4
and 12
bytes, not 41
and 2
.