avast / avast/retdec

Suggestion from web: switch not detected

Open
#178 0 comments 0 reactions 0 assignees View on GitHub
enhancement P-output T-format-raw
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

[Binary](https://github.com/avast-tl/retdec/files/1703014/fd4130ed44c468d41f3b31f9e998929a.zip) sent to us by user through https://retdec.com/.

**Run command:**
```
./retdec-decompiler.sh fd4130ed44c468d41f3b31f9e998929a --mode raw --format pe --arch x86 --raw-endian little --raw-entry-point 0x1194D5E0
```

**The original message:**
_It appears the decompiler does not recognize a switch statement (compiler unknown - raw binary). Each case is decompiled into a separate function. Here is a code fragment:_
```
...
jmp dword ptr [ecx*4+1194D608]
mov eax,[eax+18] // comment added: this is at address 1194D608
pop esi
ret
mov eax,[eax+28]
pop esi
ret
movsx eax,word ptr [eax+3A]
pop esi
ret
movsx eax,word ptr [eax+46]
pop esi
ret
movsx eax,word ptr [eax+52]
pop esi
ret
movsx eax,word ptr [eax+5E]
pop esi
ret
...
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by running retdec-decompiler.sh with the supplied binary and command, then inspect the generated output around the reported indirect jump and case functions. Compare the result with the shown jump-table fragment; done means the switch cases are represented as one switch rather than separate functions.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.