0

I try to decompile a function that is obfuscated by having split up the controlflow into asmblocks scattered around the .text section and connected by "jmpq" jumps. 

<func1>:
0:    insn..
1:    jmpq xx100
2:    callq sub
3:    jmpq  xx104
...
<nonfunc>:
..
xx100: insn...
xx101: jmpq 2
..
xx104: insn 
...

Is there a tool/plugin that can reassemble the function code by following the jmpq blocks and appending the chunks? I guess it is not that trivial because you also have to account for relative offsets and patch relocation sections, etc. .

| improve this question | |
  • If you are pressing <kbd>P</kbd> on the function start what do you see ? (Save the database before conducting this experiment) – w s Aug 1 '16 at 9:17
  • I dont have any action linked to the key "P" in IDA. What action should key "P" trigger? – Konrad Eisele Aug 1 '16 at 22:21
  • It is create function. As far as I know it may handle such a functions in significant part of cases – w s Aug 2 '16 at 5:17
  • I am probably not helping - but this strikes me as a typical graph isomorphism question. Perhaps tools like Binnavi could help. – Vitaly Osipov Aug 3 '16 at 7:55
  • Tryping to write it myself: github.com/eiselekd/perlx8664 . – Konrad Eisele Aug 7 '16 at 9:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.