Beneath
the surface.

Instructions describe operations, but an executable also contains a contract with its loader. Sections, imports, relocations, and exception metadata influence how those operations become a running program.

Start with the file format. Map file offsets to virtual addresses before trusting a disassembly, identify the entry point, and distinguish initialized data from memory that only exists at runtime. An address in the file is not necessarily an address in memory.

Then connect the static picture to observed behavior. A debugger can validate whether a suspected path executes and what values reach it. Treat the disassembler's labels and inferred types as hypotheses, not ground truth.

A control-flow graph is a model of possible transfers between blocks. Its usefulness depends on which transfers the analysis can recover.

Indirect branches, exceptions, and code generated at runtime can leave gaps in a static graph. An observed execution trace helps confirm edges, but one trace cannot establish that an unobserved path is impossible.

Keep those two forms of evidence separate. Record which edges were inferred and which were observed, then design a small experiment around the uncertainty that matters.

A useful finding should survive a fresh environment and a second pair of eyes. Preserve the original input, record its hash, and write down the toolchain and operating system versions.

Reduce the test case until it isolates the behavior. Change one variable at a time, save the exact invocation, and capture the output needed to distinguish the expected result from the observed one.

Finally, document the limits: what the experiment demonstrates, what it leaves open, and which assumptions would invalidate the conclusion.