download the last version for mac Binary Ninja 3.5.4526

There's a var declared that isn't used either, this is kind of weird. This is quite confusing from the high level IL, as it looks like it's calling a syscall and returning the response.

As we can see, it picks up the initial function right through to the RET opcode and then stops, and it doesn't find the rest of the function:

We'll start with a simple app that we can load up into Binary Ninja, source code is here. For a decompiler/lifter it's also generally important to trust RET opcodes and turn them into return statements, and this is why it's using PUSH/RET combinations is a good obfuscation tool. It's normal for a disassembler explore a function, traversing all branches, and terminate each when it gets to a RET opcode. The PUSH before the return here is actually the address we're about to jump to The RET/ RETN opcode in x86/圆4 pops the stack and jumps to that address If you've been reversing x86/圆4 for a while then you will have definitely come across functions that end like this:

Download the last version for mac Binary Ninja 3.5.4526