Breaking decompiler 101

0xkylm

Whoami

Student @ 2600

VR @ FuzzingLabs

Hypervisor, compilation and maldev enthusiast

 

 

 

Agenda

  • Breaking ghidra

  • breaking ida heuristics

  • Breaking at symbols lvl

 

Breaking Ghidra

Rex, are prefix use in x86 to tell the cpu the next opcode is a x64, but what if we use 2,3 or 10 Rex ?

Not all instructions require a REX prefix. The prefix is necessary only if an instruction references one of the extended registers or uses a 64-bit operand. If a REX prefix is used when it has no meaning, it is
ignored.

Breaking Ghidra

Buuuuuuut Ghidra and other compiler don't work like a cpu and sometimes bugs can occured

Breaking ida

Breaking symbols resolution

Questions ?

Breaking decompiler 101

By 0xkylm

Breaking decompiler 101

  • 36