Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

help on adding Switch Case support? #6

Closed
hyperchem opened this issue Aug 22, 2020 · 1 comment
Closed

help on adding Switch Case support? #6

hyperchem opened this issue Aug 22, 2020 · 1 comment

Comments

@hyperchem
Copy link

I tried to unvirtualized the entry code of a protected binary. It seems the very first basic_block of entry code is classified into "switch case pattern", which is not supported in current version.
An example of "switch case pattern" is as following:
{(-0xe9d521f90e+qword[(0x4b62016+&&base)]#0x3dbddf3?)}
the meaning of this expression is read a qword from 0x4b62016+imagebase, add a imm -0xe9d521f90, and results in another imm, which is the finally branch destination.
In this very first basic_block, the number of destination is only one, which is not a real switch case.
I want to add support for this situation. Could give me some guidance for adding some code for this?

@can1357
Copy link
Owner

can1357 commented Aug 22, 2020

Use -opt:const, this is just ultra obfuscation.

@can1357 can1357 closed this as completed Aug 22, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants