How can i determine forehand the destination of JUMP for which there is no PUSH instruction thst preceeds it and the entries in the code where they where set, when analysing the bytecode?
I looked through the example of https://blog.positive.com/reversing-evm-bytecode-with-radare2-ab77247e5e53 and the tool doesn't point the last JUMP mentioned in the post to the respective destination entry 0x62.

1 Answer 1


Since the destination of a JUMP is dynamic (though the destination does have to be a JUMPDEST opcode), you can't do it by just analyzing the code. You have to actually run the bytecode to figure out where it is going to jump to.

  • 1
    Yeah, but in that case, the JUMP was a consequence of PUSH1 0X42 PUSH1 0X20 and ADD. That's what i'm looking for, some tool that tells me what are the entries in the code that are responsible for the JUMP, even if it is an opcode like CALLER or something of a sort
    – user53414
    Commented Apr 26, 2019 at 19:24
  • I don't think you're going to find a tool that does that very specific job. Even the spot in the bytecode that pushes the value used in the JUMP is dynamic. The best you can do is run the program and, every time a word is pushed to the stack, track the location in bytecode where it happened.
    – natewelch_
    Commented Apr 26, 2019 at 19:42
  • 1
    So there is no symbolic evm available and up and running?
    – user53414
    Commented May 4, 2019 at 21:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.