Improved algorithm for identification of switch tables in executable code

Proceedings of the XXth Conference of Open Innovations Association FRUCT

Andrei Gedich¹  Artur Lazdin¹ 

[1] Saint-Petersburg National Research University of Information Technologies, Mechanics and Optics, Saint-Petersburg, Russia;

关键词: disassembly;    decompilation;    executable code;    switch table;    jump table;    switch-case;    case statement;    multiway branch;   

DOI  :  10.1109/FRUCT.2015.7117969

来源: DOAJ

【 摘 要 】

This paper introduces novel approach for identification of switch tables in executable code. Compared to existing solutions based on SSA intermediate representation and different propagation techniques, developed algorithm is more accurate and has greater flexibility. Set of iterative algorithms based on Pearson, weighted Pearson and Spearman correlation coefficients is introduced in this paper. Simple noise value filtering and improved segmentation algorithm are described.

【 授权许可】

Unknown