rev.ng🎥 How does rev.ng detect jump table?
In this presentation Ale explains how the rev.ng decompiler detects jump tables and, more in general, how it devirtualizes indirect jumps.
In short, we optimize the code so we have a nice SSA form, build the data-flow graph of the jump destination and analyze the control flow to obtain constraints over certain nodes of the data flow graph.
Finally, we enumerate all the possible values that the jump destination can assume given the constraints we collected.
The constraints are collected using an extension of an LLVM-provided analysis (`LazyValueInfo`) that can track disjoint ranges of values.
Presentation: https://pad.rev.ng/p/nZM078b9C#/