============================== Sample 1 ============================== ASM: ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;undefined f17_S_SIP_ID() ;local_10 undefined8 -10 ;local_20 undefined8 -20 ;local_28 undefined8 -28 ;local_2c undefined4 -2c ;local_38 undefined8 -38 ;local_40 undefined8 -40 PUSH RBP MOV RBP,RSP PUSH RBX SUB RSP,0x38 MOV EAX,EDI MOVQ RDI,XMM0 MOV R8,RAX MOV R9,RDX MOV R9,RDI MOV qword ptr [RBP + local_28+0x8],R8 MOV qword ptr [RBP + local_20+0x8],R9 MOV dword ptr [RBP + local_2c+0x8],ESI MOV qword ptr [RBP + local_38+0x8],RDX MOV qword ptr [RBP + local_40+0x8],RCX MOV RDX,qword ptr [RBP + local_38+0x8] MOV ESI,dword ptr [RBP + local_2c+0x8] MOV ECX,dword ptr [RBP + local_28+0x8] MOV RAX,qword ptr [RBP + local_20+0x8] MOV R8,qword ptr [RBP + local_40+0x8] MOV EDI,ECX MOVQ XMM0,RAX CALL R8 MOVQ RCX,XMM0 MOV RDX,RCX MOV RCX,RAX MOV RBX,RDX MOV RSI,RAX MOV RDI,RDX MOV EAX,ECX MOV RDX,RDI MOVQ XMM0,RDX MOV RBX,qword ptr [RBP + local_10+0x8] LEAVE RET ?? 0Fh Actual src: struct S_ID f17_S_SIP_ID(struct S_ID p0, int p1, void* p2, struct S_ID (*cb)(struct S_ID, int, void*)) { return cb(p0,p1,p2); } Predicted src: struct S_IF f17_S_S_IFS_IF(struct S_IF p0, int p1, int p2, struct S_IF (*cb)(struct S_IF, int, struct S_IF)) { return cb(p0,p1,p2); } ============================== Sample 2 ============================== ASM: ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;undefined stp_parameter_list_param() PUSH RBP MOV RBP,RDI PUSH RBX MOV RBX,RSI SUB RSP,0x8 CALL .plt:stp_list_get_length ;undefined stp_list_get_length() CDQE CMP RAX,RBX JBE LAB_00132548 MOV RDI,RBP MOV ESI,EBX CALL .plt:stp_list_get_item_by_index ;undefined stp_list_get_item_by_index() MOV RDI,RAX TEST RAX,RAX JZ LAB_00132548 ADD RSP,0x8 POP RBX POP RBP JMP .plt:stp_list_item_get_data ;undefined stp_list_item_get_data() ?? 0Fh ?? 1Fh ?? 00h LAB_00132548: ADD RSP,0x8 XOR EAX,EAX POP RBX POP RBP RET ?? 66h f Actual src: const stp_parameter_t * stp_parameter_list_param(stp_const_parameter_list_t list, size_t item) { const stp_list_t *ilist = (const stp_list_t *)list; stp_list_item_t *i = NULL; if (item >= stp_list_get_length(ilist)) return NULL; else { i = stp_list_get_item_by_index(ilist, item); if (i == NULL) return NULL; return (const stp_parameter_t *) stp_list_item_get_data(i); } } Predicted src: static const char * list_get_item_index(const struct list *list, const char *name) { struct list_list *list; struct list_list *list; struct list_list *list; list = list_get_list_data(list); if (!list) return NULL; list = list_get_item(list); list = list_get_item(list); if (list) return list; return list; } ============================== Sample 3 ============================== ASM: ;************************************************************************************************************************************************************ ;* CDVDInputStreamBluray::IsEOF() * ;************************************************************************************************************************************************************ ;undefined IsEOF(void) XOR EAX,EAX RET ?? 90h Actual src: bool CDVDInputStreamBluray::IsEOF() { return false; } Predicted src: bool CClass::IsStream() { return false; } ============================== Sample 4 ============================== ASM: ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;undefined _go_rsm_shutdown() SUB RSP,0x8 MOV EAX,dword ptr [.bss:debug] ;=?? TEST EAX,EAX JNZ LAB_001f2c10 LAB_001f2bee: MOV RDI,qword ptr [.bss:rsm] ;=?? CALL .plt.got:::g_hash_table_destroy ;undefined g_hash_table_destroy() MOV qword ptr [.bss:rsm],0x0 ;=?? ADD RSP,0x8 RET ?? 66h f ?? 0Fh ?? 1Fh ?? 44h D ?? 00h ?? 00h LAB_001f2c10: MOV RDI,qword ptr [.bss:rsm] ;=?? CALL .plt:::g_hash_table_size ;undefined g_hash_table_size() LEA RDI,[.rodata:s_Shutting_down_with_%d_resources_00261f70] ;= "Shutting down with %d resources\n" MOV ESI,EAX XOR EAX,EAX CALL .plt:::g_printerr ;undefined g_printerr() JMP LAB_001f2bee ?? 66h f Actual src: void _go_rsm_shutdown (void) { if (debug) g_printerr ("Shutting down with %d resources\n", g_hash_table_size (rsm)); g_hash_table_destroy (rsm); rsm = NULL; } Predicted src: static void _hash_size (void) { if (g_hash_table_size) g_hash_table_destroy (g_hash_table_size); g_hash_table_destroy (g_hash_table); } ============================== Sample 5 ============================== ASM: ;************************************************************************************************************************************************************ ;* s_CouldNotLoadFileMessage(XAP_Frame*, char const*, int) * ;************************************************************************************************************************************************************ ;undefined s_CouldNotLoadFileMessage(XAP_Frame * param_1, char * param_2, int param_3) ;param_1 XAP_Frame * RDI ;param_2 char * RSI ;param_3 int EDX ADD param_3,0x137 MOV R8,param_2 MOV param_2,0x3f5 CMP param_3,0xa JA LAB_0010ee9d LEA RAX,[.rodata:CSWTCH.122] MOV param_2,dword ptr [RAX + param_3*0x4]=>.rodata:CSWTCH.122 LAB_0010ee9d: XOR ECX,ECX XOR param_3,param_3 JMP .plt:LAB_0010b670 ?? 66h f Actual src: XAP_Dialog_MessageBox::tAnswer s_CouldNotLoadFileMessage(XAP_Frame * pFrame, const char * pNewFile, UT_Error errorCode) { XAP_String_Id String_id; switch (errorCode) { case -301: String_id = AP_STRING_ID_MSG_IE_FileNotFound; break; case -302: String_id = AP_STRING_ID_MSG_IE_NoMemory; break; case -303: String_id = AP_STRING_ID_MSG_IE_UnsupportedType; //AP_STRING_ID_MSG_IE_UnknownType; break; case -304: String_id = AP_STRING_ID_MSG_IE_BogusDocument; break; case -305: String_id = AP_STRING_ID_MSG_IE_CouldNotOpen; break; case -306: String_id = AP_STRING_ID_MSG_IE_CouldNotWrite; break; case -307: String_id = AP_STRING_ID_MSG_IE_FakeType; break; case -311: String_id = AP_STRING_ID_MSG_IE_UnsupportedType; break; default: String_id = AP_STRING_ID_MSG_ImportError; } return pFrame->showMessageBox(String_id, XAP_Dialog_MessageBox::b_O, XAP_Dialog_MessageBox::a_OK, pNewFile); } Predicted src: void XX_X509_X509(X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509_X509X509_X509X509_X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509X509