Author Topic: The inherent problem with deciphering disassembled code...  (Read 1808 times)

0 Members and 1 Guest are viewing this topic.

Offline slateraptorTopic starter

  • Frequent Contributor
  • **
  • Posts: 833
  • Country: us
The inherent problem with deciphering disassembled code...
« on: November 26, 2011, 07:13:18 pm »
...is that the disassembler is often incapable of determining whether binary data is executable or raw. It simply parses assuming the former, flags invalid op codes when it encounters raw vector data, convolutes and snowballs everything afterwards, and dooms you to scratching your head for hours on end trying to figure WTF went wrong with the script you wrote to extract a subset of the binary data being analyzed when it works perfectly.

I feel like I've encountered my first real-world exemplification of the halting problem. :-\

P.S. A simple heuristic that eliminates deterministic branches would make life so much easier. I just might have given myself a computer science side project. :-\
« Last Edit: November 26, 2011, 07:24:42 pm by slateraptor »
 

alm

  • Guest
Re: The inherent problem with deciphering disassembled code...
« Reply #1 on: November 26, 2011, 07:34:17 pm »
For architectures where opcodes don't have a fixed length, alignment is also an issue. If you start decoding somewhere in the middle of an instruction, everything from that point on will be garbage. This is why good disassemblers like IDA allow you to mark the start/end of code or data  blocks. Starting at a known entry point and working your way through the jumps is one way to deal with it.
 

Offline Mechatrommer

  • Super Contributor
  • ***
  • Posts: 11537
  • Country: my
  • reassessing directives...
Re: The inherent problem with deciphering disassembled code...
« Reply #2 on: November 26, 2011, 10:21:06 pm »
I feel like I've encountered my first real-world exemplification of the halting problem. :-\
congratulation! soon you'll know, decoding things needs some "intelligence".
Nature: Evolution and the Illusion of Randomness (Stephen L. Talbott): Its now indisputable that... organisms “expertise” contextualizes its genome, and its nonsense to say that these powers are under the control of the genome being contextualized - Barbara McClintock
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf