Timeline for Deal with obfuscated assembly
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 16, 2013 at 18:42 | comment | added | Mew | I tried IDA Pro. Its disassembly was, for this particular case, less corrent than the one made by objdump. But once debugging it fixed itself. Or I could fix it manually too. | |
| Oct 15, 2013 at 21:26 | comment | added | Jongware | IDA Pro actually uses both, IIRC. First off, it tries to evaluate from the program entry point (which would already produce a correct listing for the OP's code). Then it scans remaining data for what looks like function prologue, and only after that it rounds up stray bytes (of which there should not be much left). | |
| Oct 15, 2013 at 20:58 | comment | added | Jason Geffner | "Lousy" in regard to meeting the original poster's needs. He should be using a recursive descent disassembler such as IDA Pro. | |
| Oct 15, 2013 at 20:55 | comment | added | newgre | This has nothing to do with being "lousy". It simply uses a linear sweep disassembling strategy (as opposed to recursive traversal). Both strategies fail in certain situations / against different anti-disassembling techniques. | |
| Oct 15, 2013 at 20:50 | history | answered | Jason Geffner | CC BY-SA 3.0 |