============================== Sample 1 ============================== ASM: ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;undefined myYield() LEA RSI,[.rodata:s_myYield_executed_00102000] ;= "myYield executed\n" MOV EDI,0x1 XOR EAX,EAX JMP .plt:LAB_00101030 ?? 66h f Actual src: static void myYield(JNIEnv* env, jclass cls) { printf("myYield executed\n"); } Predicted src: static void cb(void *data) { (void) data; (void) data; (void) data; } ============================== Sample 2 ============================== ASM: ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;undefined enic_vf_link_update() PUSH RBP LEA RCX,[.rodata:__func__.7] ;= "enic_vf_link_update" PUSH RBX LEA RDX,[.rodata:s_%s_>>_0011fc20] ;= "%s >>\n" MOV RBX,RDI MOV EDI,0x8 PUSH RAX LEA RAX,[.bss:enic_pmd_logtype] ;=?? MOV ESI,dword ptr [RAX]=>.bss:enic_pmd_logtype ;=?? XOR EAX,EAX CALL .plt:::rte_log ;undefined rte_log() MOV RAX,qword ptr [RBX + 0x38] MOV RAX,qword ptr [RAX + 0x60] MOV RBP,qword ptr [RAX + 0x6b8] MOV RDI,qword ptr [RBP + 0x88] CALL enic_link_update ;undefined enic_link_update() MOV RAX,qword ptr [RBP + 0x88] MOV RAX,qword ptr [RAX + 0x38] MOV RAX,qword ptr [RAX + 0x68] MOV RDX,qword ptr [RBX + 0x38] XCHG qword ptr [RDX + 0x68],RAX XOR EAX,EAX POP RDX POP RBX POP RBP RET ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;undefined enic_vf_representor_init() ;local_40 undefined8 -40 PUSH R15 Actual src: static int enic_vf_link_update(struct rte_eth_dev *eth_dev, int wait_to_complete __rte_unused) { struct enic_vf_representor *vf; struct rte_eth_link link; struct enic *pf; ENICPMD_FUNC_TRACE(); vf = eth_dev->data->dev_private; pf = vf->pf; /* * Link status and speed are same as PF. Update PF status and then * copy it to VF. */ enic_link_update(pf->rte_dev); rte_eth_linkstatus_get(pf->rte_dev, &link); rte_eth_linkstatus_set(eth_dev, &link); return 0; } Predicted src: static int link_link_update(struct rte_eth_dev *dev) { struct rte_eth_dev *eth_dev = dev->eth_dev; struct rte_eth_dev *dev = dev->eth_dev; struct rte_eth_dev *dev = dev->eth_dev; dev->dev_id = dev->dev_id; dev->dev_id = dev->dev_id; dev->dev_id = dev->dev_id; dev->dev_id = dev->dev_id; dev->dev_id = dev->dev_id; dev->dev_id = dev->dev_id; dev->dev_id = dev->dev_id; return 0; } ============================== Sample 3 ============================== ASM: ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;undefined update_cb() PUSH RBP MOV RBP,RDI CALL .plt:sn_item_v0_get_type ;undefined sn_item_v0_get_type() MOV RDI,RBP MOV RSI,RAX CALL .plt:::g_type_check_instance_cast ;undefined g_type_check_instance_cast() MOV dword ptr [RAX + 0xcc],0x0 MOV RDI,RAX CALL update ;undefined update() XOR EAX,EAX POP RBP RET ?? 66h f Actual src: static gboolean update_cb (gpointer user_data) { SnItemV0 *v0; v0 = SN_ITEM_V0 (user_data); v0->update_id = 0; update (v0); return G_SOURCE_REMOVE; } Predicted src: static gboolean update_item_cb (gpointer user_data) { update_item (user_data); return FALSE; } ============================== Sample 4 ============================== ASM: ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;undefined proto_register_irc() SUB RSP,0x8 LEA RDX,[.rodata:s_irc_03795c22+16] ;= "irc" LEA RSI,[.rodata:DAT_034f9416] ;= 49h I LEA RDI,[.rodata:s_Internet_Relay_Chat_038c6d1f] ;= "Internet Relay Chat" CALL .plt:proto_register_protocol ;undefined proto_register_protocol() MOV EDX,0xc LEA RSI,[.data:hf.2] MOV EDI,EAX MOV dword ptr [.data:proto_irc],EAX ;= FFFFFFFFh CALL .plt:proto_register_field_array ;undefined proto_register_field_array() MOV ESI,0x5 LEA RDI,[.data:ett.1] CALL .plt:proto_register_subtree_array ;undefined proto_register_subtree_arr... MOV EDI,dword ptr [.data:proto_irc] ;= FFFFFFFFh CALL .plt:expert_register_protocol ;undefined expert_register_protocol() LEA RSI,[.data:ei.0] MOV EDX,0x6 MOV RDI,RAX CALL .plt:expert_register_field_array ;undefined expert_register_field_array() LEA RSI,[.rodata:TAG_DELIMITER] ;= 0001h LEA RDI,[.bss:pbrk_tag_delimiter] ;=?? ADD RSP,0x8 JMP .plt:::ws_mempbrk_compile ;undefined ws_mempbrk_compile() ?? 66h f Actual src: void proto_register_irc(void) { static hf_register_info hf[] = { { &hf_irc_response, { "Response", "irc.response", FT_STRING, STR_ASCII, NULL, 0x0, "Line of response message", HFILL }}, { &hf_irc_request, { "Request", "irc.request", FT_STRING, STR_ASCII, NULL, 0x0, "Line of request message", HFILL }}, { &hf_irc_request_prefix, { "Prefix", "irc.request.prefix", FT_STRING, STR_ASCII, NULL, 0x0, "Request prefix", HFILL }}, { &hf_irc_request_command, { "Command", "irc.request.command", FT_STRING, STR_ASCII, NULL, 0x0, "Request command", HFILL }}, { &hf_irc_request_command_param, { "Parameter", "irc.request.command_parameter", FT_STRING, STR_ASCII, NULL, 0x0, "Request command parameter", HFILL }}, { &hf_irc_request_trailer, { "Trailer", "irc.request.trailer", FT_STRING, STR_ASCII, NULL, 0x0, "Request trailer", HFILL }}, { &hf_irc_response_prefix, { "Prefix", "irc.response.prefix", FT_STRING, STR_ASCII, NULL, 0x0, "Response prefix", HFILL }}, { &hf_irc_response_command, { "Command", "irc.response.command", FT_STRING, STR_ASCII, NULL, 0x0, "Response command", HFILL }}, { &hf_irc_response_num_command, { "Command", "irc.response.num_command", FT_UINT16, BASE_DEC, NULL, 0x0, "Response (numeric) command", HFILL }}, { &hf_irc_response_command_param, { "Parameter", "irc.response.command_parameter", FT_STRING, STR_ASCII, NULL, 0x0, "Response command parameter", HFILL }}, { &hf_irc_response_trailer, { "Trailer", "irc.response.trailer", FT_STRING, STR_ASCII, NULL, 0x0, "Response trailer", HFILL }}, { &hf_irc_ctcp, { "CTCP Data", "irc.ctcp", FT_STRING, STR_ASCII, NULL, 0x0, "Placeholder to dissect CTCP data", HFILL }} }; static gint *ett[] = { &ett_irc, &ett_irc_request, &ett_irc_request_command, &ett_irc_response, &ett_irc_response_command }; static ei_register_info ei[] = { { &ei_irc_missing_end_delimiter, { "irc.missing_end_delimiter", PI_MALFORMED, PI_ERROR, "Missing ending tag delimiter (0x01)", EXPFILL }}, { &ei_irc_tag_data_invalid, { "irc.tag_data_invalid", PI_PROTOCOL, PI_WARN, "Tag data outside of NOTICE or PRIVMSG command", EXPFILL }}, { &ei_irc_prefix_missing_ending_space, { "irc.prefix_missing_ending_space", PI_MALFORMED, PI_ERROR, "Prefix missing ending ", EXPFILL }}, { &ei_irc_request_command, { "irc.request.command.missing", PI_MALFORMED, PI_ERROR, "Request has no command", EXPFILL }}, { &ei_irc_numeric_request_command, { "irc.request.command.numeric", PI_PROTOCOL, PI_WARN, "Numeric command not allowed in request", EXPFILL }}, { &ei_irc_response_command, { "irc.response.command.missing", PI_MALFORMED, PI_ERROR, "Response has no command", EXPFILL }}, }; expert_module_t* expert_irc; proto_irc = proto_register_protocol("Internet Relay Chat", "IRC", "irc"); proto_register_field_array(proto_irc, hf, array_length(hf)); proto_register_subtree_array(ett, array_length(ett)); expert_irc = expert_register_protocol(proto_irc); expert_register_field_array(expert_irc, ei, array_length(ei)); /* compile patterns */ ws_mempbrk_compile(&pbrk_tag_delimiter, TAG_DELIMITER); } Predicted src: void proto_register_register_info(void) { static hf_register_info hf[] = { { &hf_hf_register_info hf, { &hf_hf_hf_hf, { &hf_hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf_hf, { &hf_hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf_hf, { &hf_hf_hf_hf, { &hf_hf_hf, { &hf_hf_hf_hf, { &hf_hf_hf_hf, { &hf_hf_hf_hf, { &hf_hf_hf_hf, { &hf_hf_hf_hf, { &hf_hf_hf_hf, { &hf_hf_hf_hf, { &hf_hf_hf_hf, { &hf_hf_hf_hf, { &hf_hf_hf_hf_hf, { &hf_hf_hf_hf, { &hf_hf_hf_hf_hf, { &hf_hf_hf_hf, { &hf_hf_hf_hf, { &hf_hf_hf_hf_hf, { &hf_hf_hf_hf_hf, { &hf_hf_hf_hf, { &hf_hf_hf_hf_hf_hf, { &hf_hf_hf_hf, { &hf_hf_hf_hf_hf, { &hf_hf_hf_hf_hf, { &hf_hf_hf_hf_hf, { &hf_hf_hf_hf_hf, { &hf_hf_hf_hf_hf, { &hf_hf_hf_hf_hf_hf, { &hf_hf_hf_hf_hf, { &hf_hf_hf_hf_hf, { &hf_hf_hf_hf_hf_hf, { &hf_hf_hf_hf_hf_hf, { &hf_hf_hf_hf_hf_hf, { &hf_hf_hf_hf_hf_hf, { &hf_hf_hf_hf ============================== Sample 5 ============================== ASM: ;************************************************************************************************************************************************************ ;* ClpSolve::setSpecialOption(int, int, int) * ;************************************************************************************************************************************************************ ;undefined setSpecialOption(ClpSolve * this, int param_1, int param_2, int param_3) ;this ClpSolve * RDI ;param_1 int ESI ;param_2 int EDX ;param_3 int ECX MOVSXD param_1,param_1 MOV dword ptr [this + param_1*0x4 + 0xc],param_2 MOV dword ptr [this + param_1*0x4 + 0x28],param_3 RET ?? 0Fh Actual src: void ClpSolve::setSpecialOption(int which, int value, int extraInfo) { options_[which] = value; extraInfo_[which] = extraInfo; } Predicted src: void setOptionOption(int value, int value) { value = value; value = value; }