Vector35 / Vector35/binaryninja-api

Support for more than 2 syscall return registers

Open
#4,515 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Platform Core: Calling Convention Impact: Medium
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

What is the feature you'd like to have?
Support for more than 2 return registers in platform-specified system calling conventions.

Is your feature request related to a problem?
I'm attempting to write a platform plugin for the Nintendo 3DS (which uses the ARMv6 architecture). The system calls for this platform use supervisor calls (SVCs), and some syscalls return information in multiple registers.

For example, one system call is QueryMemory, which returns values in 6 different registers:

r0: Result
r1: u32 base_process_virtual_address
r2: u32 size
r3: MemoryPermission permission
r4: MemoryState state
r5: PageFlags flags

Are any alternative solutions acceptable?
The main option I've considered is lifting these as IL intrinsics. There are two ways to go about this:

  1. Write an ArchitectureHook that lifts matched SVCs differently
  2. Create a modified arch-armv7 plugin that handles the SVCs

Both options are quite invasive and would interfere with anyone working on a separate ARMv7 binary that doesn't use the 3DS system calling convention. As far as I'm aware, there's no way to register an ArchitectureHook based on the platform in use, so option 1 would affect any binary in use. Option 2 would mean I need to pull in any changes to the arch-armv7 plugin as they go along, and I would be unable to register the ELF as a view type (since it would collide with arch-armv7's registration), which would mean disabling the built-in ARMv7 architecture to load 3DS CXIs converted to ELF files (which can be much easier for RE purposes than loading the ROM directly, in some cases).

Additional Information:

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue names ArchitectureHook, IL intrinsics, and the arch-armv7 plugin as the relevant entry points; begin by tracing how platform-specified syscall return registers are represented. Done should support more than two return registers for platform-specific conventions without changing behavior for unrelated ARMv7 binaries.

Written by the indexing model from the issue text.

Assessment

Domain
reverse-engineering
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.