Vector35 / Vector35/binaryninja-api
Offer an option to lift pushf/pushfd/pushfq/lahf instructions in a simpler form
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Right now, we lift these instruction into the combination of the individual flags, e.g., pushfq is lifted into
push(flagbit.q(flag:o, 0xb) | flagbit.q(flag:d, 0xa) | flagbit.q(flag:s, 7) | flagbit.q(flag:z, 6) | flagbit.q(flag:a, 4) | flagbit.q(flag:p, 2) | flagbit.q(flag:c, 0))
Although this is technically correct, this is rarely helpful and often times killing the readability of the code. I suggest that we lift it into something like:
push(rflags)
This will drastically improve the readability of the code, and, assume most obfuscated code are simply pushing the flags onto the stack to preserve it (rather than actually doing some nasty operations on top of it), this also does not hurt the dataflow significantly.
I admit there may be some cases where the current lifting is desired, so I suggest we offer an option to toggle the behavior, and we should default to the simpler behavior.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the existing lifting path for pushf, pushfd, pushfq, and lahf, including how flag expressions are represented and where lifting options are configured. Done means the simpler aggregate-flag form is the default, while an option preserves the current individual-flag expansion.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100