I wrote a simple IDA plugin that, after a function call, looks for mov MEM_LOCATION eax and adds a name for the memory where the return value is stored. I limit my search to only a few instructions after the function call and bail out if I see another call before the return value is stored. Is there a more rigorous way to track where the return value goes besides these heuristics?


In the static context, this is known as "data flow analysis". For example, Hex-Rays incorporates the return-location information for function calls into its representation of the function so as to determine into which other locations that data flows. You don't give a lot of detail on what you want to do with this information, but off the top of my head I'd say it could be worthwhile to investigate writing a Hex-Rays plugin.

  • I implemented my IDA plugin in Python. What algorithms would I use to implement dataflow analysis on the contents of EAX? Do I need to write something custom or are there tools available? I am interested in the static context because I am trying to add useful names before I start reversing. – user2142 Jun 12 '13 at 19:36

A more general name for that problem is Data Tainting. You mark some data as tainted, and then follow the taint propagation in the rest of the code. There is quite a lot of research going on about taint analysis, and there is quite a number of tools. Take a look at bitblaze (especially taint tracker edit: just figured it's no loner available and outdated...), it has a part for taint tracking.

If you'd need something more "lightweight" take a look at julio auto's and bsdaemon's VDT which is more exploit-development oriented, but might give you an idea how things work. VDT actually does something very similar to what you do, but it does it in reverse. Given an execution trace, you can do a backward search from some value to see how it got initialized, where it was used, and what code it influenced.

For more academic approach , check out "All You Ever Wanted to Know About Dynamic Taint Analysis and Forward Symbolic Execution".

All this is about dynamic analysis, tho some simpler stuff can be implemented statically. I can't think of any example/tool off the top of my head right now. I'm sure somebody will come up with more tools and ideas.

  • This is a really great answer, thanks. I ended up accepting the answer on the static technique because that is the context in which I was having a problem. – user2142 Jun 13 '13 at 23:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.