Tootfinder

Sometimes, #Ghidra gets really creative.
Tons of parameters and 7x pointer derefs... whaaaat... 😹

#TIL about #Ghidra:
It might be that the decompile view shows you
```
void foo(void)
{
/* ... */
}
```
and yet, you see in another function calling it smth like
```
iVar1 = foo();
```
- leaving you puzzled.
It looks like a bug!
In…

If you have a pointer to a pointer to a struct, you define that struct and assign the type to it, then you also need to adjust the intermediate pointer in #Ghidra and vroom vroom, you finally get to see the struct and its member just fine in the decompile view.
See also:

Unable to use type for symbol · Issue #2946 · NationalSecurityAgency/ghidra
I'm trying to Retype Variable (Ctrl+L) but it does nothing and outputs the message on top. What is the correct way to change the type of the strcap variable to ulonglong? I've tried to reset the ty...