============================== Sample 1 ============================== ASM: ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;undefined dpiStmt__check() PUSH R12 MOV RCX,RDX MOV R12,RDX MOV RDX,RSI PUSH RBP MOV ESI,0xfa3 MOV RBP,RDI SUB RSP,0x8 CALL .plt:dpiGen__startPublicFn ;undefined dpiGen__startPublicFn() TEST EAX,EAX JS LAB_0011ce70 CMP qword ptr [RBP + 0x28],0x0 JZ LAB_0011ce50 MOV RAX,qword ptr [RBP + 0x30] TEST RAX,RAX JZ LAB_0011ce08 CMP qword ptr [RAX + 0x28],0x0 JZ LAB_0011ce50 LAB_0011ce08: MOV RDI,qword ptr [RBP + 0x18] MOV RSI,R12 CALL .plt:dpiConn__checkConnected ;undefined dpiConn__checkConnected() TEST EAX,EAX JS LAB_0011ce70 XOR EAX,EAX CMP word ptr [RBP + 0x88],0x0 JZ LAB_0011ce30 LAB_0011ce24: ADD RSP,0x8 POP RBP POP R12 RET ?? 0Fh ?? 1Fh ?? 40h @ ?? 00h LAB_0011ce30: MOV RSI,R12 MOV RDI,RBP CALL .plt:dpiStmt__init ;undefined dpiStmt__init() ADD RSP,0x8 SAR EAX,0x1f POP RBP POP R12 RET ?? 66h f ?? 2Eh . ?? 0Fh ?? 1Fh ?? 84h ?? 00h ?? 00h ?? 00h ?? 00h ?? 00h LAB_0011ce50: ADD RSP,0x8 MOV RDI,R12 MOV EDX,0x40e XOR EAX,EAX POP RBP LEA RSI,[.rodata:s_check_closed_0013b679] ;= "check closed" POP R12 JMP .plt:dpiError__set ;undefined dpiError__set(undefined pa... ?? 0Fh ?? 1Fh ?? 00h LAB_0011ce70: MOV EAX,0xffffffff JMP LAB_0011ce24 ?? 66h f Actual src: static int dpiStmt__check(dpiStmt *stmt, const char *fnName, dpiError *error) { if (dpiGen__startPublicFn(stmt, DPI_HTYPE_STMT, fnName, error) < 0) return DPI_FAILURE; if (!stmt->handle || (stmt->parentStmt &&!stmt->parentStmt->handle)) return dpiError__set(error, "check closed", DPI_ERR_STMT_CLOSED); if (dpiConn__checkConnected(stmt->conn, error) < 0) return DPI_FAILURE; if (stmt->statementType == 0 && dpiStmt__init(stmt, error) < 0) return DPI_FAILURE; return DPI_SUCCESS; } Predicted src: int check__init(check_t *check, const char *name, const char *value) { check_check_t *check = NULL; check_check_t *check = NULL; check = check__check(check, name, &check); if (check == NULL) return -1; check = check__init(check, name, value); check->check = check->check; check->check = check->check; check->check = check->check; check->check = check->check; check->check = check->check; check->check = check->check; check->check = check->check; check->check = check->check; check->check = check->check; check->check = check->check; check->check = check->check; check->check = check->check; check->check = check->check; check->check = check->check; return 0; } ============================== Sample 2 ============================== ASM: ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;undefined gp_arrow_button_constructed() PUSH RBP MOV RBP,RDI MOV RDI,qword ptr [.bss:gp_arrow_button_parent_class] ;=?? MOV ESI,0x50 CALL .plt:::g_type_check_class_cast ;undefined g_type_check_class_cast() MOV RDI,RBP CALL qword ptr [RAX + 0x48] CALL .plt:::gtk_widget_get_type ;undefined gtk_widget_get_type() MOV RDI,RBP MOV RSI,RAX CALL .plt:::g_type_check_instance_cast ;undefined g_type_check_instance_cast() MOV RDI,RAX CALL .plt:::gtk_widget_get_accessible ;undefined gtk_widget_get_accessible() LEA RSI,[.rodata:s_Hide_Panel_00138771] ;= "Hide Panel" XOR EDI,EDI MOV EDX,0x5 MOV RBP,RAX CALL .plt:::dcgettext ;undefined dcgettext() MOV RDI,RBP POP RBP MOV RSI,RAX JMP .plt:::atk_object_set_name ;undefined atk_object_set_name() ?? 66h f Actual src: static void gp_arrow_button_constructed (GObject *object) { GtkWidget *widget; AtkObject *atk; G_OBJECT_CLASS (gp_arrow_button_parent_class)->constructed (object); widget = GTK_WIDGET (object); atk = gtk_widget_get_accessible (widget); atk_object_set_name (atk, _("Hide Panel")); } Predicted src: static void glade_accessible_accessible_set_name (GtkWidget *widget) { GtkWidget *widget; widget = GTK_WIDGET_CLASS (glade_accessible_accessible_parent_class)->set_name (widget); GTK_WIDGET_CLASS (parent_class)->set_name (widget, widget); } ============================== Sample 3 ============================== ASM: ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;undefined ioe_err_free() PUSH RBX MOV RBX,RDI MOV RDI,qword ptr [RDI] CALL .plt:free ;void free(void * __ptr) MOV RDI,qword ptr [RBX + 0x10] POP RBX JMP .plt:free ;void free(void * __ptr) ?? 66h f Actual src: void ioe_err_free(ioe_err_t *err) { free(err->path); free(err->msg); } Predicted src: void free_err_err (err_err_t err) { free (err->err); free (err); } ============================== Sample 4 ============================== ASM: ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;undefined lxsession_lxde_session_server_CanShutdown() PUSH R14 MOV R14,RDX PUSH R13 MOV R13,RSI PUSH R12 MOV R12,RDI MOV EDI,0x40 PUSH RBP SUB RSP,0x8 CALL .plt:::g_slice_alloc ;undefined g_slice_alloc() PXOR XMM0,XMM0 XOR ESI,ESI MOV RDX,R13 MOV RDI,R12 MOVUPS xmmword ptr [RAX],XMM0 MOV RCX,R14 MOV RBP,RAX MOVUPS xmmword ptr [RAX + 0x10],XMM0 MOVUPS xmmword ptr [RAX + 0x20],XMM0 MOVUPS xmmword ptr [RAX + 0x30],XMM0 CALL .plt:::g_task_new ;undefined g_task_new() LEA RDX,[lxsession_lxde_session_server_CanShutdown_data_free] MOV RSI,RBP MOV RDI,RAX MOV qword ptr [RBP + 0x18],RAX CALL .plt:::g_task_set_task_data ;undefined g_task_set_task_data() TEST R12,R12 JZ LAB_0011ca0a MOV RDI,R12 CALL .plt:::g_object_ref ;undefined g_object_ref() MOV R12,RAX LAB_0011ca0a: MOV qword ptr [RBP + 0x20],R12 ADD RSP,0x8 MOV RDI,RBP POP RBP POP R12 POP R13 POP R14 JMP lxsession_lxde_session_server_CanShutdown_co.isra.0 ;undefined lxsession_lxde_session_ser... ?? 66h f Actual src: void lxsession_lxde_session_server_CanShutdown (LxsessionLxdeSessionServer* self, GAsyncReadyCallback _callback_, gpointer _user_data_) { lxsession_lxde_session_server_CanShutdownData* _data_; LxsessionLxdeSessionServer* _tmp0_; g_return_if_fail (self!= NULL); _data_ = g_slice_new0 (lxsession_lxde_session_server_CanShutdownData); _data_->_async_result = g_task_new (G_OBJECT (self), NULL, _callback_, _user_data_); g_task_set_task_data (_data_->_async_result, _data_, lxsession_lxde_session_server_CanShutdown_data_free); _tmp0_ = _g_object_ref0 (self); _data_->self = _tmp0_; lxsession_lxde_session_server_CanShutdown_co (_data_); } Predicted src: static void application_session_server_server_new (GObject* source_object, GAsyncResult* _res_, gpointer _user_data_) { ApplicationServerserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserve ============================== Sample 5 ============================== ASM: ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;undefined Perl_parse_arithexpr() PUSH RBP MOV RBP,RDI PUSH RBX SUB RSP,0x8 TEST ESI,0xfffffffe JNZ LAB_001a9ade MOV EBX,ESI MOV EDX,0xa MOV ESI,0x103 CALL S_parse_recdescent_for_op ;undefined S_parse_recdescent_for_op() TEST RAX,RAX JZ LAB_001a9a90 LAB_001a9a87: ADD RSP,0x8 POP RBX POP RBP RET ?? 66h f ?? 90h LAB_001a9a90: TEST EBX,EBX JNZ LAB_001a9a87 MOV RAX,qword ptr [RBP + 0x200] CMP byte ptr [RAX + 0xff],0x0 JZ LAB_001a9ac0 LAB_001a9aa4: ADD RSP,0x8 MOV RDI,RBP XOR EDX,EDX XOR ESI,ESI POP RBX POP RBP JMP .plt:Perl_newOP ;undefined Perl_newOP() ?? 66h f ?? 2Eh . ?? 0Fh ?? 1Fh ?? 84h ?? 00h ?? 00h ?? 00h ?? 00h ?? 00h LAB_001a9ac0: MOV RDI,RBP LEA RSI,[.rodata:s_Parse_error_002d58bc] ;= "Parse error" XOR EAX,EAX CALL .plt:Perl_mess ;undefined Perl_mess(undefined param_... MOV RDI,RBP MOV RSI,RAX CALL .plt:Perl_qerror ;undefined Perl_qerror() JMP LAB_001a9aa4 LAB_001a9ade: LEA RDX,[.rodata:s_parse_expr_002d6081] ;= "parse_expr" LEA RSI,[.rodata:s_Parsing_code_internal_error_(%s)_002d7450] ;= "Parsing code internal error (%s)" XOR EAX,EAX CALL .plt:Perl_croak ;undefined Perl_croak(undefined param... NOP dword ptr CS:[RAX + RAX*0x1] Actual src: OP * Perl_parse_arithexpr(pTHX_ U32 flags) { return parse_expr(LEX_FAKEEOF_COMPARE, flags); } Predicted src: const char * Perl_expr_parse_expr(pTHX_ SV *expr) { PERL_ARGS_ASSERT_NULL_RETURN(expr); PERL_ARGS_ASSERT_NULL_RETURN(expr, NULL); PERL_ARGS_ASSERT_NULL_RETURN(expr, NULL); PERL_ARGS_ASSERT_NULL_RETURN(expr, NULL); PERL_ARGS_RETURN(expr); }