-Reversing Tip 29/30-
buckle up buckaroos! Here& #39;s the most useful RE strategy no one talks about:
*analyze the block layout before diving into ASM code*. Layout view is available on many disassemblers, here’s how to use it #BinReversingTips Explanatory threadhttps://abs.twimg.com/emoji/v2/... draggable="false" alt="🧵" title="Thread" aria-label="Emoji: Thread">[1/6] >>>

Let’s start with an easy example. The 1st image shows the layout of an “if” statement: the code splits to 2 paths. Question: What layout does the 2nd pic show? Answer on the next tweet. Assembly is purposely hidden - that’s the point of this ;) [2/6]

If you answered it’s a switch case statement, you’re correct :) Great!
Let’s use our new killer skillz on func_1. Q: func_1 is most likely:
1. Computing a hash
2. Parsing a format
3. String comparison [tweet 3/6]

the answer is #2. Func_1 has many “if”s leading to a return block (End A), typical of format parsing code to bail early if it finds a corrupt field/magic value. Here is func_1 fully exposed to confirm our assumption [4/6]

Last example; what is func_2 most likely handling?
1. Computing a hash
2. Parsing a format
3. String comparison [tweet 5/6]

The answer is #3. Func_2 has a loop, typical in str related funcs which use the loop to iterate over the str’s chars. Also, we can rule out #2 w/knowledge from the prev. tweet & rule out #1 from my 1st RE tip https://abs.twimg.com/emoji/v2/... draggable="false" alt="😉" title="Zwinkerndes Gesicht" aria-label="Emoji: Zwinkerndes Gesicht">
Func_2 exposed: </END THREAD>

link to my 1st RE tip: https://twitter.com/va_start/status/1245197118865846273">https://twitter.com/va_start/...