DYNAMIC CALL TRACKING METHOD BASED ON CPU INTERRUPT INSTRUCTIONS TO IMPROVE DISASSEMBLY QUALITY OF INDIRECT CALLS
First Claim
1. A method for disassembling compiled object code, the method comprising:
- disassembling a binary executable object to generate assembly language source code, wherein the assembly language source code includes one or more indirect function calls;
inserting an interrupt in the assembly language source code at each indirect function call;
executing the assembly language source code;
upon reaching the interrupt at each indirect function call while executing the assembly language source code, determining a register value stored in a register specified in the indirect function call; and
for each indirect function call, replacing, in the assembly language source code, the register specified in the indirect function call with a function name corresponding to the register value.
2 Assignments
0 Petitions
Accused Products
Abstract
Embodiments presented herein describe techniques to track and correct indirect function calls in disassembled object code. Assembly language source code is generated from a binary executable object. The assembly language source code may include indirect function calls. Memory addresses associated with the function calls are identified. A central processing unit (CPU) interrupt instruction is inserted in the disassembled source code at each indirect function call. The disassembled source code is executed. When the interrupt at each indirect function call is triggered, the function name of a function referenced by a register may be determined.
-
Citations
20 Claims
-
1. A method for disassembling compiled object code, the method comprising:
-
disassembling a binary executable object to generate assembly language source code, wherein the assembly language source code includes one or more indirect function calls; inserting an interrupt in the assembly language source code at each indirect function call; executing the assembly language source code; upon reaching the interrupt at each indirect function call while executing the assembly language source code, determining a register value stored in a register specified in the indirect function call; and for each indirect function call, replacing, in the assembly language source code, the register specified in the indirect function call with a function name corresponding to the register value. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. A computer-readable storage medium storing instructions, which, when executed on a processor, performs an operation for disassembling compiled object code, the operation comprising:
-
disassembling a binary executable object to generate assembly language source code, wherein the assembly language source code includes one or more indirect function calls; inserting an interrupt in the assembly language source code at each indirect function call; executing the assembly language source code; upon reaching the interrupt at each indirect function call while executing the assembly language source code, determining a register value stored in a register specified in the indirect function call; and for each indirect function call, replacing, in the assembly language source code, the register specified in the indirect function call with a function name corresponding to the register value. - View Dependent Claims (9, 10, 11, 12, 13, 14)
-
-
15. A system, comprising:
-
a processor; and a memory storing one or more application programs configured to perform an operation for disassembling compiled object code, the operation comprising; disassembling a binary executable object to generate assembly language source code, wherein the assembly language source code includes one or more indirect function calls, inserting an interrupt in the assembly language source code at each indirect function call, executing the assembly language source code, upon reaching the interrupt at each indirect function call while executing the assembly language source code, determining a register value stored in a register specified in the indirect function call, and for each indirect function call, replacing, in the assembly language source code, the register specified in the indirect function call with a function name corresponding to the register value. - View Dependent Claims (16, 17, 18, 19, 20)
-
Specification