Detecting unmodified registers in decompilations

IDA General
1

Let’s say there are two subsequent __fastcall function calls (x86 Windows 10), and the first function doesn’t ever change the value of ECX. In the decompilation of the second call, even though ECX hasn’t been modified, it doesn’t recognize that it is the same variable as the one previously passed. Idk if there is a trick to make the decompiler recognize this, but I think it would be a nice feature to add if it doesn’t exist already. A system that allows you to manually mark unmodified registers would be cool too in the case of external calls being made that prevent auto analysis from identifying unmodified registers. Mapping variables USUALLY fixes this, sometimes not

Heres an example of what I mean:

v40 = sub_6CBC(
            &a2a,
            MemInfo.MemInfo.AllocationBase,
            HIDWORD(MemInfo.MemInfo.AllocationBase),
            MemInfo.RegionCount,
            ModuleDirHash,
            ModuleNameHash,
            ConsecCmtdRegionSzLow,
            v29,
            DllIndex);
v69 = v40;
if ( v64 && v40 )
  v69 = sub_6CBC(
          a2a_2, // EQUAL TO &a2a (ECX is unchanged in sub_6CBC)
          MemInfo.MemInfo.AllocationBase,
          HIDWORD(MemInfo.MemInfo.AllocationBase),
          RegionCount,
          MemInfo.PathInfo.ModuleDirHash,
          MemInfo.PathInfo.ModuleNameHash,
          ConsecCmtdRegionSzLow,
          a3b,
          DllIndex);
2

You can use the __spoils<> modifier in the first function’s prototype and list only the actually modified registers. For more info see Igor’s tip of the week #51: Custom calling conventions.