I learned the disassembly challenges from this link. The following six challenges are listed in that article:
- Data embedded in the code regions
- Variable instruction size
- Indirect branch instructions
- Functions without explicit CALL sites within the executable's code segment
- Position independent code (PIC) sequences
- Hand crafted assembly code.
However, I am thinking about the following disassembly method which seems to solve the above challenges. Assuming we have an executable to be disassembled, an input set that can has 100% coverage of the code, and an emulator (e.g. QEMU). Then, we can instrument the emulator to output each instruction executed by the emulated CPU and the corresponding memory address. After that, we can translate each instruction to assembly instruction, and the whole program is now disassembled.
Could you please tell me why this idea will not/will work?