Emmerik. Recovery of jump table case statements from binary code

One of the fundamental problems with the analy-sis of binary (executable) code is that of recognizing, in a machine-independent way, the target addresses of n-conditional branches implemented via a jump table. Without these addresses, the decoding of the machine instructions for a given procedure is incomplete, as well as any analysis on that procedure. In this paper we present a technique for recover-ing jump tables and their target addresses in a ma-chine and compiler independent way. The technique is based on slicing and expression substitution. The as-sembly code of a procedure that contains an indexed jump is transformed into a normal form which allows us to determine where the jump table is located and what information it contains (e.g. offsets from the ta-ble or absolute addresses). The presented technique has been tested on SPARC and Pentium code generated by C, C++, Fortran and Pascal compilers. Our tests show that up to 90 % more of the code in a text segment can be found by using this technique. The technique was developed as part of our retargetable binary translation framework; how-ever, it is also suitable for other binary-manipulation tools such as binary profilers, instrumentors and de-compilers