Vector35 / Vector35/binaryninja-api
Better handling of register clobbers in functions that adjust the stack pointer
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Vague title, but I don't really know what the root issue is.
Repro: http://cyberjes.us/bash-ppc.elf @ 0x100c0a00
current_function.clobbered_regs lists just about every register. The one that's particularly bothering me is r2, which is the global pointer register defined in the calling convention. This is breaking a bunch of references to constant data (r2 + offset).
For context, 100c0a00 is part of the fairly standard "restore GPRs" sled compilers generate for PPC. Rather than doing your typical push for each callee-saved register used in a function, PPC compilers tend to insert a sled of stores and a sled of loads, then functions will just branch to the right offset in the sled, e.g. save_r20_to_r31(); actual function code; restore_r20_to_r31();
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the PPC repro at http://cyberjes.us/bash-ppc.elf at 0x100c0a00, and inspect how current_function.clobbered_regs is populated for the restore-GPR sled. Done means the analysis no longer incorrectly marks registers such as r2 as clobbered in this pattern, while preserving correct clobber reporting.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100