I've been thinking of reversing some firmware I have laying around. One characteristic of the firmware is that it is compiled using lots of pre-processor macros. Now, as I understand it, these are not included in the binary, so a decompiler cannot help with these. Is there any way to recover these? Is there a known technique for inferring their existance?
asked May 31, 2013 at 21:10
-
Although the answers seem to be authoritative in their "No", I don't see offhand why such a translation system couldn't be written to at least make an effort. At heart, think of this as text substitution going on which is sometimes reversible. If my macro does a substitution of "abc" -> "x" and "def" -> "x", then when I see "x" it might be "abc" or "def" or just "x". Bad. However in practice it works the other way where the bigger and more unique string is generally on the right-hand side. So I imagine that there might be some situations that could be detected.– rockyCommented Oct 25, 2017 at 6:29
-
When I wrote the post I was thinking more from a heuristic type of place, like if you saw a piece of code that seemed to be copied in a way consistent with the way the compiler handles a macro. In retrospect that would be pretty hard/impossible.– MrSynAckSterCommented Oct 25, 2017 at 8:58
Add a comment
|
2 Answers
No. Decompilers can include special pattern-matching heuristics layered on top of their other functionality to detect macros, but in general, macros are just pieces of code that get treated by the compiler the same way as other pieces of code. They might be subject to optimizations that transform their appearance, such as constant propagation, dead code elimination, common subexpression elimination, loop-invariant code motion, etc. which means they might not manifest themselves with an easy-to-solidify syntactic pattern that can be matched against. Your options are basically to write a post-pass for the decompiler (e.g. a Hex-Rays plugin) or to identify the macros manually.
answered May 31, 2013 at 21:32
-
1
No.
Macros are pieces of code that you have named.
At compilation time when the compiler encounters a macro it just replaces it with the code behind it, then continues the compilation.
