📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  Function Identification

Topic created on: February 17, 2009 16:49 CST by s0ban .

Hello,

I am currently writing a debugging tool for Windows, which incorporates some limited disassembly features (for viewing quick pieces of code). My current goal (where I am trying to brainstorm now) is to identify "function blocks" in the code - so I can put labels wherever a function appears to begin.

I think (from my limited knowledge) that the best way to do this is to identify common code sequences which begin and end functions (the tool will do stream disassembly on fragments of code, not "whole-file" disassembly, due to the design of the tool). However, I wonder if there are any other methods to do this.

Could anyone please give me some suggestions, or point me to some resources where I can learn more about this topic?

Thanks,


s0ban

  Sellmi     February 18, 2009 02:24.50 CST
>common code sequences
sorry but this will never ever work.
The best way is to build a queue of addresses where you like to start to disassemble and a datastructure of places which you have already visited.
now you fill the queue with addresses like entrypoint exported functions (dll) or of functions you have from a mapfile etc.
then you start to disassemble and every time you see a call or a jump add the target address into the queue.
when you see a ret /call exit / jmp / stop to disassemble and fetch a new address from the queue until the queue is empty.

this is the basic way to write a dissasebler.
and then you will face tons of problems

-switch tables
-indirect calls (call eax)
-callbacks (push callback )
-c++
..

and at this point you will understand way IDA does real magic!

  RolfRolles     February 18, 2009 03:06.10 CST
Everything Sellmi said is correct (this is called "recursive traversal disassembly"), but IDA does in fact additionally scan the code section for common function prologue byte patterns (called "linear sweep disassembly").  See processor_t::codestart in idp.hpp.

  Sellmi     February 18, 2009 03:44.52 CST
>but IDA does in fact additionally scan the code section for >common function prologue
for sure it does, because IDA is able to find dead code! But as you said "additionally".
There are a lot of steps to improve your results, but you should design your disassembler in a way that you can add such "heuristic plugins" as callbacks which are get called after your analysis queue is empty.

  s0ban   February 18, 2009 16:20.35 CST
Hi,

Thanks for your quick reply.

I think I will try the approach mentioned by Sellmi by building a list of "targets" where the information required is available, and "guessing" with common function prologues where this information is not available.

I will have a look at idp.hpp when I get home, and see what good ideas I can use from there, or if I can improve my design =)

Thanks,


s0ban.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit