4 ms·
The first one is solved using control flow disassembly (like what IDA does). Find the entry point and only disassemble code that is reached. If bytes are jumped
by colejohnson66 6y ago
The first one is solved using control flow disassembly (like what IDA does). Find the entry point and only disassemble code that is reached. If bytes are jumped over and never executed, don’t disassemble them. It takes much longer than naive disassembly, but it’ll get you the most accurate view of what’s happening.
Of course, jumping into the middle of an instruction will throw the control flow analysis out of whack.
- kuroguro 6y agoI think the proper technique was using conditional jumps (that always end up jumping) so the disasm thinks the next instruction should come right after it (in case the jump isn't taken). It then becomes undecidable which is the correct path. _edit_ Huh, you're right, IDA works around some basic examples I threw at it. Who knew. _edit_ Oh, I forgot to strip symbols... successfully managed to confuse IDA with a few tries :) https://gist.github.com/tostercx/899630ba3d01cb98fcf7faf8bf05ebd6 https://gist.github.com/tostercx/899630ba3d01cb98fcf7faf8bf0...