tailieunhanh - reversing secrets of reverse engineering phần 9

Một lần nữa, một SHELL32 API có lẽ sẽ không bao giờ thực hiện cuộc gọi trực tiếp vào hạt nhân, vì vậy bạn chỉ bị mắc kẹt với một số chức năng lâu dài và bạn đã không có ý tưởng những gì nó là. Bạn phải sử dụng chỉ số của chức năng một lần nữa để tìm ra API Defender đang kêu gọi. | Decompilation 467 locations. The resulting information from this type of analysis can be used for a number of different things in the decompilation process. It is required for eliminating the concept of registers and operations performed on individual registers and also for introducing the concept of variables and long expressions that are made up of several machine-level instructions. Data-flow analysis is also where conditional codes are eliminated. Conditional codes are easily decompiled when dealing with simple comparisons but they can also be used in other less obvious ways. Let s look at a trivial example where you must use data-flow analysis in order for the decompiler to truly understand what the code is doing. Think of function return values. It is customary for IA-32 code to use the EAX register for passing return values from a procedure to its caller but a decompiler cannot necessarily count on that. Different compilers might use different conventions especially when functions are defined as static and the compiler controls all points of entry into the specific function. In such a case the compiler might decide to use some other register for passing the return value. How does a decompiler know which register is used for passing back return values and which registers are used for passing parameters into a procedure This is exactly the type of problem addressed by data-flow analysis. Data-flow analysis is performed by defining a special notation that simplifies this process. This notation must conveniently represent the concept of defining a register which means that it is loaded with a new value and using a register which simply means its value is read. Ideally such a representation should also simplify the process of identifying various points in the code where a register is defined in parallel in two different branches in the control flow graph. The next section describes SSA which is a commonly used notation for implementing data-flow analysis in both