Vector35 / Vector35/binaryninja-api
Support for more than 2 syscall return registers
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
What is the feature you'd like to have?
Support for more than 2 return registers in platform-specified system calling conventions.
Is your feature request related to a problem?
I'm attempting to write a platform plugin for the Nintendo 3DS (which uses the ARMv6 architecture). The system calls for this platform use supervisor calls (SVCs), and some syscalls return information in multiple registers.
For example, one system call is QueryMemory, which returns values in 6 different registers:
r0: Result
r1: u32 base_process_virtual_address
r2: u32 size
r3: MemoryPermission permission
r4: MemoryState state
r5: PageFlags flags
Are any alternative solutions acceptable?
The main option I've considered is lifting these as IL intrinsics. There are two ways to go about this:
- Write an
ArchitectureHookthat lifts matched SVCs differently - Create a modified
arch-armv7plugin that handles the SVCs
Both options are quite invasive and would interfere with anyone working on a separate ARMv7 binary that doesn't use the 3DS system calling convention. As far as I'm aware, there's no way to register an ArchitectureHook based on the platform in use, so option 1 would affect any binary in use. Option 2 would mean I need to pull in any changes to the arch-armv7 plugin as they go along, and I would be unable to register the ELF as a view type (since it would collide with arch-armv7's registration), which would mean disabling the built-in ARMv7 architecture to load 3DS CXIs converted to ELF files (which can be much easier for RE purposes than loading the ROM directly, in some cases).
Additional Information:
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names ArchitectureHook, IL intrinsics, and the arch-armv7 plugin as the relevant entry points; begin by tracing how platform-specified syscall return registers are represented. Done should support more than two return registers for platform-specific conventions without changing behavior for unrelated ARMv7 binaries.
Written by the indexing model from the issue text.
Assessment
- Domain
- reverse-engineering
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100