uxmal / reko

Reko is a binary decompiler.
https://uxmal.github.io/reko
GNU General Public License v2.0
2.17k stars 253 forks source link

Should support overlapping instructions #917

Open rfalke opened 4 years ago

rfalke commented 4 years ago

Background: https://reverseengineering.stackexchange.com/questions/1531/what-is-overlapping-instructions-obfuscation

Subject: https://github.com/rfalke/decompiler-subjects/blob/master/from_holdec/overlapping_instructions/ia32_elf/subject.exe

In this subject the method add_one() is the most basic case. But reko detects wrongly void as return type.

Another method is return_constant() which reko decompiles as:

void return_constant()
{
    while (true)
        ;
}

but should be a simple ...{ return -1163082564;} or ... {return 0xbaacc4bc;}.

rfalke commented 1 year ago

Still relevant in 0.11.4.0-931ca7d.