shazow / whatsabi

Extract the ABI (and resolve proxies, and get other metadata) from Ethereum bytecode, even without source code.
https://shazow.github.io/whatsabi/
MIT License
1.04k stars 71 forks source link

disasm: Guess function arguments #9

Open shazow opened 1 year ago

shazow commented 1 year ago

... without just looking up the sighash on a 4byte database. 😅

I don't have a great idea of how to do this without symbolic execution. I'd like to keep whatsabi to static analysis in O(nlogn) runtime per number of instructions.

My gut feel is that the process to approach this:

  1. Try to guess the total expected calldata size, or even number of arguments
  2. Might help if we can figure out the bytecode boundaries for each function? (are JUMPI table to JUMPDEST mappings contiguous?)
  3. Figure out the expected byte size of each argument, if any?

I think that's as far as we can get without tracking a non-fixed stack depth.

Related project: https://github.com/ethb3rlin/find-a-team/issues/32