Recovery of jump table case statements from binary code

摘要: One of the fundamental problems with analysis binary (executable) code is that recognizing, in a machine-independent way, target addresses n-conditional branches implemented via jump table. Without these addresses, decoding machine instructions for given procedure incomplete, as well any on procedure. We present technique recovering tables and their compiler independent way. The based slicing expression substitution. assembly contains an indexed transformed into normal form which allows us to determine where table located what information it (e.g. offsets from or absolute addresses). has been tested SPARC Pentium generated by C, C++, Fortran Pascal compilers. Our tests show up 90% more text segment can be found using this technique.