3

Finding the start of a function is sometimes obvious - for example if some part of the code has a call foo then foo must be a function.

But what about finding the end of a function? I realize tools like Radare and Ghidra do this, but it seems like they must be using heuristics because some things that "look like" the end of a function aren't. For example (in pseudo-asm):

foo:
  sub r1,r2
  jge something
  ret
something:
  add r1,r2
  ret

I would say this is one function that happens to have two different exit points, but how would a RE tool figure this out?

3
  • 1
    Decompilers perform structural analysis usually by constructing control flow graph and then the program's AST. I can recommend No More Gotos paper which shows the steps a decompiler takes to recover structured code (and how you can apply optimizations to the process), DREAM's codebase is also open source
    – mimak
    Commented May 15, 2023 at 12:34
  • 1
    Thanks for sharing that paper, I'm reading it now. The gist seems to match something I've been thinking about for a while - that if you can successfully decompile obfuscated code just enough to apply some optimizations, you should be able to generate something much less obfuscated. Commented May 15, 2023 at 23:18
  • check first 3 pages of this great resource - dl.acm.org/doi/pdf/10.1145/3033019.3033028
    – R4444
    Commented May 16, 2023 at 23:34

1 Answer 1

2

There's no definitive way to tell what instructions correspond to a single function, i.e. what exactly represents a function when looking only at the set of instructions. Compilers are free to optimize the high level code in any way they like. For reference, you can see the answer provided here.

Luckily, compilers usually output predictable patterns, so Ghidra, Radare and other disassemblers first locate what they believe is a function by pattern matching and analysis of other functions, then analyze the control flow of the instructions to establish the control flow graph of the function and determine which branches the function has, where it "ends" etc.

There is also some good information here: https://stackoverflow.com/questions/41622226/assembly-function-recognition

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.