Igor’s Tip of the Week #162: Where’s my code? The case of no-return call

Let’s say you found a promising-looking string in the binary, followed the cross reference to the function using it, then decompiled it to see how the string is used, only to see no signs of it in the pseudocode. What’s happening?

In such situation it often helps to set up two synchronized disassembly<->pseudocode views and scroll through them looking for oddities. As a rule of thumb, most pseudocode lines should map to one or few assembly instructions and most assembly …

binary call case code found function malware analysis pseudocode reference return week