And this is exactly why traces are better than assembly. You see instructions that were executed, not the code. You can restore the decision tree (and then the graph, most probaly) and figure out what is going on.
> And this is exactly why traces are better than assembly. You see instructions that were executed, not the code. You can restore the decision tree (and then the graph, most probaly) and figure out what is going on.
I think a good example is the last level (Hollywood) from www.microcorruption.com, which has self modifying code and is set up such that the actual execution jumps into the middle of what the disassembler thinks are actual instructions. Reading the code is pretty useless, but with a trace of instructions executed and register state at each instruction it's easy to start at the end and follow backwards to the interesting part of the program.
Getting the trace is the tricky bit, I had to write an msp430 emulator.
(Actually seeing this example requires completing the rest of the levels, but you should do that anyway, especially if this is the sort of thing you're interested in)
Let me hypothetically apply movfuscator to some not too complex program and look at the assembly. I believe I'll get nothing useful from it, which is fair. But if I trace the program, I can get some useful results - like filling some array with data (increase of the addresses accessed), looping over indices (accesses within some range), see through generated code (table lookups here and there are identical), etc.
