Vector35 / Vector35/binaryninja-api

Use the symbol in byte by byte comparison for strings instead of string itself

Open
#4,102 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Core IL Optimization Impact: Medium
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

004160d2  HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)
004160e8  struct PROCESSENTRY32 pe32
004160e8  my_memset(&pe32.cntUsage, 0, 0x124)
004160f0  pe32.dwSize = 0x128
00416102  BOOL hp = Process32First(hSnap, &pe32)
0041613e  int32_t explorer_pid
0041613e  while (true) {
0041613e    if (hp == 0) {
00416141      CloseHandle(hSnap)
00416147      explorer_pid = 0
00416147      break
00416147    }
00416115    int32_t i = 0
0041611e    while (pe32.szExeFile[i] == (*"explorer.exe")[i]) {
00416120      i = i + 1
00416124      if (i == 0xd) {
00416124        break
00416124      }
00416124    }
0041611e    if (*(&pe32.szExeFile + i) == (*"explorer.exe")[i]) {
00416126      explorer_pid = pe32.th32ProcessID
0041612c      break
0041612c    }
00416136    hp = Process32Next(hSnap, &pe32)
00416134  }
0041614c  return explorer_pid

I believe that at 0041611e and 0041611e BN should use symbol name instead of string. (explorerexe_str, in this case). I know this is also correct, but it's a bit awkward.

Here is the IDA output for comparison:

  hSnap= CreateToolhelp32Snapshot(2u, 0);
  my_memset(&pe.cntUsage, 0, 292);
  pe.dwSize = 296;
  for ( i = Process32First(hSnap, &pe); i; i = Process32Next(hSnap, &pe) )
  {
    v2 = 0;
    while ( pe.szExeFile[v2] == aExplorerExe[v2] )
    {
      if ( ++v2 == 13 )
        return pe.th32ProcessID;
    }
  }
  CloseHandle(hSnap);
  return 0;

Also it looks like we can get some benefit from #3924 in order to make output more simplified.

Disassembly of function:

004160c3  55                 push    ebp {__saved_ebp}
004160c4  8bec               mov     ebp, esp {__saved_ebp}
004160c6  81ec28010000       sub     esp, 0x128
004160cc  56                 push    esi {__saved_esi}
004160cd  57                 push    edi {__saved_edi}
004160ce  6a00               push    0x0
004160d0  6a02               push    0x2
004160d2  ff15ac914100       call    dword [CreateToolhelp32Snapshot]
004160d8  6824010000         push    0x124
004160dd  8bf0               mov     esi, eax
004160df  8d85dcfeffff       lea     eax, [ebp-0x124 {pe32.cntUsage}]
004160e5  6a00               push    0x0
004160e7  50                 push    eax {pe32.cntUsage} {var_140}
004160e8  e8a6b1feff         call    my_memset
004160ed  83c40c             add     esp, 0xc
004160f0  c785d8feffff2801…mov     dword [ebp-0x128 {pe32.dwSize}], 0x128
004160fa  8d85d8feffff       lea     eax, [ebp-0x128 {pe32}]
00416100  50                 push    eax {pe32} {var_138}
00416101  56                 push    esi {var_13c}
00416102  ff15d0914100       call    dword [Process32First]
00416108  eb32               jmp     0x41613c

0041610a  8d95fcfeffff       lea     edx, [ebp-0x104 {pe32.szExeFile}]
00416110  bff0c74100         mov     edi, 0x41c7f0
00416115  33c9               xor     ecx, ecx  {0x0}

00416117  0fb6040a           movzx   eax, byte [edx+ecx] {pe32.szExeFile}
0041611b  3a040f             cmp     al, byte [edi+ecx]
0041611e  750e               jne     0x41612e

00416120  41                 inc     ecx
00416121  83f90d             cmp     ecx, 0xd
00416124  75f1               jne     0x416117

00416126  8b85e0feffff       mov     eax, dword [ebp-0x120 {pe32.th32ProcessID}]
0041612c  eb1b               jmp     0x416149

0041612e  8d85d8feffff       lea     eax, [ebp-0x128 {pe32}]
00416134  50                 push    eax {pe32} {var_138_1}
00416135  56                 push    esi {var_13c_1}
00416136  ff15d4914100       call    dword [Process32Next]

0041613c  85c0               test    eax, eax
0041613e  75ca               jne     0x41610a

00416140  56                 push    esi {var_138_2}
00416141  ff15fc914100       call    dword [CloseHandle]
00416147  33c0               xor     eax, eax  {0x0}

00416149  5f                 pop     edi {__saved_edi}
0041614a  5e                 pop     esi {__saved_esi}
0041614b  c9                 leave    {__saved_ebp}
0041614c  c3                 retn     {__return_addr}

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the shown decompilation and compare its byte-by-byte string comparison with the IDA output. Read the handling of string symbols and the related simplification work in #3924; done when the comparison uses the explorerexe_str symbol and the resulting output is appropriately simplified.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
reverse-engineering
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.