Lifting assistance with a conditional branch.

Open
#1,908 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Stale
Domain
reverse-engineering

Research direction

No file or test is identified. Start by locating the lifting logic for conditional branches and the handling of pop(), cmp_ne(), set_reg(), and dangling IL statements. Define which obviously dangling statements should trigger a diagnostic, then add coverage showing that the conditional pop is detected and valid lifting remains unaffected.

Written by the indexing model from the issue text.

Description

Component: Core Core: LLIL Effort: Low Impact: Medium

This is a feature request for sanity checks on some lifting.

I ran across a particular hard to debug instance of this. I am lifting a stack machine which has a conditional branch instruction that is something like:

if pop() != 0:
  // true path
else:
  // fall through

Originally, I lifted this by creating a cmp_ne(pop(), const(0)) expression. However, this is subtly incorrect -- the stack adjustment from the pop in the conditional will never be be applied as control flow passes to either the true or false branch before its committed. This is extremely hard to detect/debug, because by all appearances this initially looks correct: there is a conditional that does look at the top stack value, its just implemented as a peek() instead of a pop() in effect. The correct lifting for this ended up being something like set_reg(t0, pop()); cmp_ne(reg(t0), const(0)).

The feature request here is when there are some obviously dangling il statements that the user should be notified.

Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Vector35/binaryninja-api

All issues in Vector35/binaryninja-api

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.