Analysing indirect jump based on critical semantic subtree

Indirect jump has been widely adopted in implementing multi-way branches due to its flexibility of jump targets, which makes it difficult to carry out reverse analysis of binary. To deal with this, the traditional approach is to summarize characteristics how compilers generate instructions, using the corresponding pattern to match and process. However, it is limited to specific platform and compiler, failing to cope with unknown compilation mode. In this paper, an approach independent of platform and compiler is proposed. We focus on the semantic character of switch-case table, the most representative form of indirect jump, and extract relevant elements to the computation of jump targets to get corresponding addresses automatically. Platform and compiler is ignored throughout the whole process. Good generality and practicability of the method has been proved in the test.