I'm currently trying to add in Auto-detect code and data, but it is proving
tricky. My first attempt was to take a copy of the stack, and then starting
at the current program position follow all the jumps/calls/rets through the
code (remembering to add/remove data when finding PUSH and POP calls). This
didn't find particularly much (about 2.5K from 40K). So my next attempt
expanded on this with the following theory:-

  A code block must end with an unconditional jump or RET.

  Except for the very first part of the code, a block has to be called or
  jumped to.

I therefore searched the code for everything that was a possible jump, and
recorded the address. After the first phase above had finished, I then
started at the start of the code area, and checked through the disassembly.
If I found a nonvalid op-code, or a NOP, I assumed the block to be data.
Once I found an unconditional jump or RET I marked it as code. In either
case, I then tested the next jumped-to address.

This found lots of obvious gibberish, so I expanded further. The most
obvious gibberish was where a register was altered, and then loaded without
the altered value being used, so I put in checks to test and remove this.

This identified about 8K.

There were still some obviously dodgy parts, often small blocks ending in
a call to bits of data. Unfortunately, trying to remove anything that had
a call to parts I'd not identified as code removed almost everything.

The point of that explanation is: Anybody have any good ideas on how to
Auto-detect code?

Leslie Styles

lms@soton.ac.uk
