0

I try to decompile a function that is obfuscated by having split up the controlflow into asmblocks scattered around the .text section and connected by "jmpq" jumps.

<func1>:
0:    insn..
1:    jmpq xx100
2:    callq sub
3:    jmpq  xx104
...
<nonfunc>:
..
xx100: insn...
xx101: jmpq 2
..
xx104: insn 
...

Is there a tool/plugin that can reassemble the function code by following the jmpq blocks and appending the chunks? I guess it is not that trivial because you also have to account for relative offsets and patch relocation sections, etc. .

5
  • If you are pressing <kbd>P</kbd> on the function start what do you see ? (Save the database before conducting this experiment)
    – w s
    Commented Aug 1, 2016 at 9:17
  • I dont have any action linked to the key "P" in IDA. What action should key "P" trigger? Commented Aug 1, 2016 at 22:21
  • It is create function. As far as I know it may handle such a functions in significant part of cases
    – w s
    Commented Aug 2, 2016 at 5:17
  • I am probably not helping - but this strikes me as a typical graph isomorphism question. Perhaps tools like Binnavi could help. Commented Aug 3, 2016 at 7:55
  • Tryping to write it myself: github.com/eiselekd/perlx8664 . Commented Aug 7, 2016 at 9:52

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.