Snowman should use a more sophisticated disassembly technique than linear

[jrmuizel]

ARM decompilation currently seems to suffer quite a bit from confusing code and data and this should help there.

There are lots of options for a better technique

• mcsema has something better but I don't know much about it.
• ByteWeight http://security.ece.cmu.edu/byteweight/ seems to be what BAP is switching or is at least is a good candidate.
• Dagger uses MCObjectDisassembler (a recursive traversal disassembler) from LLVM which made it upstream but was removed. In my experience it did not work very well.
• I haven't looked at what radare uses.

[yegord]

I agree. I would try something like:

1. Scan through the executable section, try to disassemble N instructions in a row (you can also use various hints, e.g., symbols and the executable's entry point, for the starting points).
2. If disassembly succeeds, run recursive traversal from the address of the first instruction.

The traversal I have already implemented once, although never got to actually using it: 7f1e836. The traversal constructs control-flow graph on the fly and uses DataflowAnalyzer to perform abstract interpretation, so, it should be able to tell you the jump destinations, in particular, switches from/to THUMB mode.

One can take the above code as a starting point and do some experiments with it.

[nihilus]

Well couldnt this already piggyback on IDA? However a purely free ARM decompiler is welcomed.

[yegord]

IDA already knows the ranges of addresses belonging to a function. Not sure, although, if it includes data into these ranges. If it does not, the IDA plug-in should not have problems with interpreting data as code. If it does, maybe we need to find where the instructions exactly are (IDA has getFlags() function for this), and update IdaFrontend::functionAddresses() to report only ranges of addresses containing executable code.

But this does not dismiss the need in a better discovery of the code.

[yegord]

seems to suffer quite a bit from confusing code

Can you provide an example?

[hlide]

are you speaking about stuff like ROP gadget ?

[yegord]

Related: #14 (comment)

[yegord]

Related: #51

[nihilus]

Moreover #59 is an actual way to achieve this.

[yegord]

No, it's not.