Recovery of Jump Table Case Statements from Binary Code

One of the fundamental problems with the static analysis of binary (executable) code is that7 of recognizing, in a machine-independent way, the target addresses of n-conditional branches implemented via a jump table. Without these addresses, the decoding of the machine instructions9 for a given procedure is incomplete, leading to imprecise analysis of the code. In this paper we present a technique for recovering jump tables and their target addresses in a11 machine and compiler independent way. The technique is based on slicing and copy propagation. The assembly code of a procedure that contains an indexed jump is transformed into a normal13 form which allows us to determine where the jump table is located and what information it contains (e.g. o sets from the table or absolute addresses).15 The presented technique has been implemented and tested on SPARC and Pentium code generated by C; C++, Fortran and Pascal compilers. Our tests show that up to 89% more of17 the code in a text segm...

• Type: Conference
• Year: 1999
• Where: IWPC
• Authors: Cristina Cifuentes, Mike Van Emmerik
• Keywords: Code, IWPC 1999, Jump Table, Software Engineering, Target Addresses