Vector35 / Vector35/binaryninja-api

Far jumps/returns and IRETs are explicitly lifted to "undefined"

Open
#4,031 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Arch: x86 Component: Architecture Impact: Low
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

I'd just submit a PR for this myself, but I was wondering if there's some reasoning behind it I'm just not familiar with. I don't see a reason why a jmp far [rcx], for example, shouldn't just be a jump(rcx); or why an iretq shouldn't just lift to a return. Am I missing something?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the lifting entry points for far jumps, far returns, and IRET instructions, then inspect how each currently becomes undefined. Determine whether the proposed jump and return semantics are valid for all relevant cases, and add focused coverage showing the intended lifted form if the behavior is changed.

Written by the indexing model from the issue text.

Assessment

Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.