Vector35 / Vector35/binaryninja-api
Support for more than 2 syscall return registers
Nessuno ha ancora preso questa issue.
- Lingua principale
- C++
- Stelle
- 1.3k
- Fork
- 298
- Merge medio
- 5g 5h
- PR unite (30g)
- 19
Descrizione
What is the feature you'd like to have?
Support for more than 2 return registers in platform-specified system calling conventions.
Is your feature request related to a problem?
I'm attempting to write a platform plugin for the Nintendo 3DS (which uses the ARMv6 architecture). The system calls for this platform use supervisor calls (SVCs), and some syscalls return information in multiple registers.
For example, one system call is QueryMemory, which returns values in 6 different registers:
r0: Result
r1: u32 base_process_virtual_address
r2: u32 size
r3: MemoryPermission permission
r4: MemoryState state
r5: PageFlags flags
Are any alternative solutions acceptable?
The main option I've considered is lifting these as IL intrinsics. There are two ways to go about this:
- Write an
ArchitectureHookthat lifts matched SVCs differently - Create a modified
arch-armv7plugin that handles the SVCs
Both options are quite invasive and would interfere with anyone working on a separate ARMv7 binary that doesn't use the 3DS system calling convention. As far as I'm aware, there's no way to register an ArchitectureHook based on the platform in use, so option 1 would affect any binary in use. Option 2 would mean I need to pull in any changes to the arch-armv7 plugin as they go along, and I would be unable to register the ELF as a view type (since it would collide with arch-armv7's registration), which would mean disabling the built-in ARMv7 architecture to load 3DS CXIs converted to ELF files (which can be much easier for RE purposes than loading the ROM directly, in some cases).
Additional Information:
Guida per i contributori
Nessuna guida per i contributori indicizzata per questo repository
Come iniziare
- Leggi tutta la issue e poi la guida ai contributi del progetto.
- Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
- Fai un fork del repository e lavora su un branch.
- Apri una pull request che faccia riferimento al numero della issue.
Direzione di ricerca
The issue names ArchitectureHook, IL intrinsics, and the arch-armv7 plugin as the relevant entry points; begin by tracing how platform-specified syscall return registers are represented. Done should support more than two return registers for platform-specific conventions without changing behavior for unrelated ARMv7 binaries.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Valutazione
- Ambito
- reverse-engineering
- Tipo di issue
- Funzionalità
- Difficoltà
- 5/5
- Tempo stimato
- Più di una settimana
- Stato di attività
- Ferma
- Chiarezza
- Abbastanza chiara
- Idoneità per principianti
- 25/100