You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
By using the contents of a library file, Function names and binary that makes up the function can be utilised to enhance the decompilation process. IDA has a tech called FLIRT which does this.
In the standard compilation process library files are linked into the exe copying the relevant parts into the bin, you cannot do a straight search for the library binary as optimisers cut out bits that are not used, and the linker process will change some bytes values as they are addresses.
It will require for an application to create signature files which will in effect scan the library file to produce list of the function names, and the binary pattern that makes up the app. this will be saved away as a signature file. this app will have to process COFF, ELF and MACHO, but I would recommend that you need to understand instruction sets here.
Then within Reko, as part of the decompilation process, after the functions have been identified a search will be required to see if a pattern match exists, but it will have to take into account some byte values have changed due to the change of address values. It will require that the disassemblers identify which instructs contain a operand which is an address, in this case the operand values will be ignored.
To do this the best way is to load all the signature files into a tree like structure, then as a function is check, if the operand is identified as an address the process will jump down the size of the operand, then check for the next byte match. This will continue until either the function being examine has no more bytes to check, if at this point the tree has a leaf which contains a function name, the function been examined is renamed.
The text was updated successfully, but these errors were encountered:
I have created the COFF, ELF, and archive processing, so that Signatures can be created. I have also added the code into the decompiler so that the signature files can be used against the binary being processed.
By using the contents of a library file, Function names and binary that makes up the function can be utilised to enhance the decompilation process. IDA has a tech called FLIRT which does this.
In the standard compilation process library files are linked into the exe copying the relevant parts into the bin, you cannot do a straight search for the library binary as optimisers cut out bits that are not used, and the linker process will change some bytes values as they are addresses.
It will require for an application to create signature files which will in effect scan the library file to produce list of the function names, and the binary pattern that makes up the app. this will be saved away as a signature file. this app will have to process COFF, ELF and MACHO, but I would recommend that you need to understand instruction sets here.
Then within Reko, as part of the decompilation process, after the functions have been identified a search will be required to see if a pattern match exists, but it will have to take into account some byte values have changed due to the change of address values. It will require that the disassemblers identify which instructs contain a operand which is an address, in this case the operand values will be ignored.
To do this the best way is to load all the signature files into a tree like structure, then as a function is check, if the operand is identified as an address the process will jump down the size of the operand, then check for the next byte match. This will continue until either the function being examine has no more bytes to check, if at this point the tree has a leaf which contains a function name, the function been examined is renamed.
The text was updated successfully, but these errors were encountered: