Analysis types

A good decompiled should implement an analysis of rates. Here, the way they used the records or memory regions result in restrictions on the type of locations. For example, an instruction and implies that the operand is an integer, the programs do not use these operations on floating point values (except in special code library) or pointers. An instruction and results in 3 restrictions, both operands can be integers, an integer or a pointer to another (in this case, the third constraint arises in the order of when the two operands are different types).
Several expressions can be recognized at a high level, knowing the structures or arrangements. Anyway, it is difficult to distinguish many of the possibilities for freedom of the machine or also because some high-level languages such as C allow pointer arithmetic and casting.
The previous section could result in the following example code in high level
struct T1 ebx
struct (T1
v0004 int
int v0008
int v000C
)
ebx-> – v000C ebx-> ebx-v0004> v0008

Get more:

Comments are closed.

Archives