Improved algorithm for identification of switch tables in executable code

Abstract

This paper introduces novel approach for identification of switch tables in executable code. Compared to existing solutions based on SSA intermediate representation and different propagation techniques, developed algorithm is more accurate and has greater flexibility. Set of iterative algorithms based on Pearson, weighted Pearson and Spearman correlation coefficients is introduced in this paper. Simple noise value filtering and improved segmentation algorithm are described.

Keywords

• disassembly
• decompilation
• executable code
• switch table
• jump table
• switch-case
• case statement
• multiway branch