1

Suppose that eax contains a value only when the program is running.

How can a disassembler determine the address of expressions like: call eax using static analysis and Recursive Descent disassembly?

3

How can a disassembler determine the address of expressions like: call eax using static analysis and Recursive Descent disassembly?

They can't... The truth is that the recursive traversal algorithm just take into account the static calls (i.e. the calls that link to a static address in the binary).

An instruction such as call eax (a.k.a. dynamic call) can be resolved only by a dynamic analysis or a symbolic execution framework.

4
  • This is not true in many cases for MSVC or MinGW, where the address of the api is moved into a register before it calls the api. Obviously this is not always the case, but if it is you don't need anything fancy to do the analysis...
    – mrexodia
    May 9 '17 at 8:04
  • @mrexodia: Hum, I think we are not speaking about the same thing... MSVC and MinGW are compilers and I was speaking about disassemblers... Or, I might have missed something, then tell me what you mean. :-)
    – perror
    May 9 '17 at 8:11
  • I meant that certain compilers emit predictable disassembly that allow you to predict what function will be called for the "call eax" instruction without doing much fancy things.
    – mrexodia
    May 9 '17 at 8:17
  • Ah, I got it now! Yes, this is true, but it would require a specific heuristic on the disassembler side to take this into account. My point was that the recursive traversal algorithm cannot handle dynamic calls (and, I should maybe have added, as you suggest, "except in the case of few heuristics that can be added in specific contexts"). But, all of these heuristics can be defeated or fooled if I change slightly the way I am building the binary. So, you cannot really trust it at the end.
    – perror
    May 9 '17 at 8:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.