Vector35 / Vector35/binaryninja-api
Use the symbol in byte by byte comparison for strings instead of string itself
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
004160d2 HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)
004160e8 struct PROCESSENTRY32 pe32
004160e8 my_memset(&pe32.cntUsage, 0, 0x124)
004160f0 pe32.dwSize = 0x128
00416102 BOOL hp = Process32First(hSnap, &pe32)
0041613e int32_t explorer_pid
0041613e while (true) {
0041613e if (hp == 0) {
00416141 CloseHandle(hSnap)
00416147 explorer_pid = 0
00416147 break
00416147 }
00416115 int32_t i = 0
0041611e while (pe32.szExeFile[i] == (*"explorer.exe")[i]) {
00416120 i = i + 1
00416124 if (i == 0xd) {
00416124 break
00416124 }
00416124 }
0041611e if (*(&pe32.szExeFile + i) == (*"explorer.exe")[i]) {
00416126 explorer_pid = pe32.th32ProcessID
0041612c break
0041612c }
00416136 hp = Process32Next(hSnap, &pe32)
00416134 }
0041614c return explorer_pid
I believe that at 0041611e and 0041611e BN should use symbol name instead of string. (explorerexe_str, in this case). I know this is also correct, but it's a bit awkward.
Here is the IDA output for comparison:
hSnap= CreateToolhelp32Snapshot(2u, 0);
my_memset(&pe.cntUsage, 0, 292);
pe.dwSize = 296;
for ( i = Process32First(hSnap, &pe); i; i = Process32Next(hSnap, &pe) )
{
v2 = 0;
while ( pe.szExeFile[v2] == aExplorerExe[v2] )
{
if ( ++v2 == 13 )
return pe.th32ProcessID;
}
}
CloseHandle(hSnap);
return 0;
Also it looks like we can get some benefit from #3924 in order to make output more simplified.
Disassembly of function:
004160c3 55 push ebp {__saved_ebp}
004160c4 8bec mov ebp, esp {__saved_ebp}
004160c6 81ec28010000 sub esp, 0x128
004160cc 56 push esi {__saved_esi}
004160cd 57 push edi {__saved_edi}
004160ce 6a00 push 0x0
004160d0 6a02 push 0x2
004160d2 ff15ac914100 call dword [CreateToolhelp32Snapshot]
004160d8 6824010000 push 0x124
004160dd 8bf0 mov esi, eax
004160df 8d85dcfeffff lea eax, [ebp-0x124 {pe32.cntUsage}]
004160e5 6a00 push 0x0
004160e7 50 push eax {pe32.cntUsage} {var_140}
004160e8 e8a6b1feff call my_memset
004160ed 83c40c add esp, 0xc
004160f0 c785d8feffff2801…mov dword [ebp-0x128 {pe32.dwSize}], 0x128
004160fa 8d85d8feffff lea eax, [ebp-0x128 {pe32}]
00416100 50 push eax {pe32} {var_138}
00416101 56 push esi {var_13c}
00416102 ff15d0914100 call dword [Process32First]
00416108 eb32 jmp 0x41613c
0041610a 8d95fcfeffff lea edx, [ebp-0x104 {pe32.szExeFile}]
00416110 bff0c74100 mov edi, 0x41c7f0
00416115 33c9 xor ecx, ecx {0x0}
00416117 0fb6040a movzx eax, byte [edx+ecx] {pe32.szExeFile}
0041611b 3a040f cmp al, byte [edi+ecx]
0041611e 750e jne 0x41612e
00416120 41 inc ecx
00416121 83f90d cmp ecx, 0xd
00416124 75f1 jne 0x416117
00416126 8b85e0feffff mov eax, dword [ebp-0x120 {pe32.th32ProcessID}]
0041612c eb1b jmp 0x416149
0041612e 8d85d8feffff lea eax, [ebp-0x128 {pe32}]
00416134 50 push eax {pe32} {var_138_1}
00416135 56 push esi {var_13c_1}
00416136 ff15d4914100 call dword [Process32Next]
0041613c 85c0 test eax, eax
0041613e 75ca jne 0x41610a
00416140 56 push esi {var_138_2}
00416141 ff15fc914100 call dword [CloseHandle]
00416147 33c0 xor eax, eax {0x0}
00416149 5f pop edi {__saved_edi}
0041614a 5e pop esi {__saved_esi}
0041614b c9 leave {__saved_ebp}
0041614c c3 retn {__return_addr}
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the shown decompilation and compare its byte-by-byte string comparison with the IDA output. Read the handling of string symbols and the related simplification work in #3924; done when the comparison uses the explorerexe_str symbol and the resulting output is appropriately simplified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- reverse-engineering
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100