3

Let's say I have a very simple pattern I'm looking for. E.g. the following regex,

mov.*(eax|edx|ecx|esi|edi), \[(eax|edx|ecx|esi|edi)\+30h\]

Now, I'm also looking for references to this in which the register written to is called, since this represents an offset for a particular function pointer.

The problem is that I'm seeing thousands of matches with the binary I'm looking at. For all I know, the function pointer could also be passed to some other function down X layers and then called there. This obviously creates a significant layer of complexity.

Are there any tools that make it possible to search for matches using the above regex, but also look (up to a specific call depth and/or instruction count from the instruction matched) for calls to the actual register?

  • You mean that the immediate next instruction that uses that first register is call ... (the destination register)? – usr2564301 Jul 1 '18 at 8:55
  • Yes, sorry if that sounded vague. But not necessarily the immediate next instruction. – zeboidlund Jul 1 '18 at 21:27
3

sometimes the call may be performed without an intermediate load, e.g.

call dword ptr [esi+30h]

as for tracking the value loaded into the register, this is a data flow analysis problem and can’t be solved (except for trivial cases) using just pattern matching. you should look into data flow analysis theory, e.g. involving intermediate representation (IR) of instructions. I’m afraid it can’t be covered by just a single post.

2

If you often find yourself doing similar things, you may want to read about intermediate representations. In the context of reverse engineering, those are languages made to be derived from assembly and used as an abstraction layer that's easier to edit and search.

Obviously, you missed some of the potential "complications" in your regex/search patten:

  1. Offsets may be added in multiple instructions (Think about lea eax, [ecx+20h] ; mov eax, [eax+10h]).
  2. Instructions can be interleaved between unrelated instructions for pipeline optimisations.
  3. Unrelated instructions can override related registers, causing false positives.

And several other complications...

This is saying your question may seem innocent but in reality you touched a complex and difficult subject.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.