Vector35 / Vector35/binaryninja-api

Support for more than 2 syscall return registers

Aperta
#4,515 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Component: Platform Core: Calling Convention Impact: Medium
Lingua principale
C++
Stelle
1.3k
Fork
298
Merge medio
5g 5h
PR unite (30g)
19

Descrizione

What is the feature you'd like to have?
Support for more than 2 return registers in platform-specified system calling conventions.

Is your feature request related to a problem?
I'm attempting to write a platform plugin for the Nintendo 3DS (which uses the ARMv6 architecture). The system calls for this platform use supervisor calls (SVCs), and some syscalls return information in multiple registers.

For example, one system call is QueryMemory, which returns values in 6 different registers:

r0: Result
r1: u32 base_process_virtual_address
r2: u32 size
r3: MemoryPermission permission
r4: MemoryState state
r5: PageFlags flags

Are any alternative solutions acceptable?
The main option I've considered is lifting these as IL intrinsics. There are two ways to go about this:

  1. Write an ArchitectureHook that lifts matched SVCs differently
  2. Create a modified arch-armv7 plugin that handles the SVCs

Both options are quite invasive and would interfere with anyone working on a separate ARMv7 binary that doesn't use the 3DS system calling convention. As far as I'm aware, there's no way to register an ArchitectureHook based on the platform in use, so option 1 would affect any binary in use. Option 2 would mean I need to pull in any changes to the arch-armv7 plugin as they go along, and I would be unable to register the ELF as a view type (since it would collide with arch-armv7's registration), which would mean disabling the built-in ARMv7 architecture to load 3DS CXIs converted to ELF files (which can be much easier for RE purposes than loading the ROM directly, in some cases).

Additional Information:

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Direzione di ricerca

The issue names ArchitectureHook, IL intrinsics, and the arch-armv7 plugin as the relevant entry points; begin by tracing how platform-specified syscall return registers are represented. Done should support more than two return registers for platform-specific conventions without changing behavior for unrelated ARMv7 binaries.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Ambito
reverse-engineering
Tipo di issue
Funzionalità
Difficoltà
5/5
Tempo stimato
Più di una settimana
Stato di attività
Ferma
Chiarezza
Abbastanza chiara
Idoneità per principianti
25/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.