avast / avast/retdec

Unable to decompile push ret as jmp

Open
#148 1 comment 0 reactions 0 assignees View on GitHub
C-bin2llvmir enhancement P-output
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

It looks like RetDec cannot decompile push+ret as a jump or call. Do I need some command line options to enable it? A sample code is attached.

BTW, I guess this is not really decompilation as compilers usually do not generate push ret sequence. But it is useful to analyze obfuscated code.

```
# gcc -g push-ret.S -m32 -o push-ret

.section .data
.STR0:
.string "print"

.section .text
.globl myprint
myprint:
pushl %ebp
movl %esp, %ebp
pushl $.STR0
call puts
subl $4, %esp
leave
ret

.globl main
main:
pushl %ebp
movl %esp, %ebp
#call myprint
pushl $retaddr
pushl $myprint
ret
retaddr:
xorl %eax, %eax
leave
ret

```

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the behavior from the inline push-ret.S sample using the shown gcc -g push-ret.S -m32 -o push-ret command. Trace how RetDec handles the pushl $retaddr, pushl $myprint, ret sequence and compare the resulting decompilation with the intended control flow. Done means the sample's indirect jump or call behavior is represented correctly.

Written by the indexing model from the issue text.

Assessment

Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.