Igor’s Tip of the Week #159: Where’s my code? The case of not-so-constant data

In order to show the user only the most relevant code and hide the unnecessary clutter, the decompiler performs various optimizations before displaying the pseudocode. Some of these optimizations rely on various assumptions which are usually correct in well-behaved programs. However, in some situations they may be incorrect which may lead to wrong output, so you may need to know how to fix them.

Constant data and dead code removal

Consider this example from a recent iOS kernelcache:

The function …

case code data decompiler hide malware analysis may order pseudocode relevant week