Vector35 / Vector35/binaryninja-api

Offer an option to lift pushf/pushfd/pushfq/lahf instructions in a simpler form

Open
#4,920 1 comment 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Arch: x86 Component: Architecture Effort: Low Impact: Low
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Right now, we lift these instruction into the combination of the individual flags, e.g., pushfq is lifted into

push(flagbit.q(flag:o, 0xb) | flagbit.q(flag:d, 0xa) | flagbit.q(flag:s, 7) | flagbit.q(flag:z, 6) | flagbit.q(flag:a, 4) | flagbit.q(flag:p, 2) | flagbit.q(flag:c, 0))

Although this is technically correct, this is rarely helpful and often times killing the readability of the code. I suggest that we lift it into something like:

push(rflags)

This will drastically improve the readability of the code, and, assume most obfuscated code are simply pushing the flags onto the stack to preserve it (rather than actually doing some nasty operations on top of it), this also does not hurt the dataflow significantly.

I admit there may be some cases where the current lifting is desired, so I suggest we offer an option to toggle the behavior, and we should default to the simpler behavior.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the existing lifting path for pushf, pushfd, pushfq, and lahf, including how flag expressions are represented and where lifting options are configured. Done means the simpler aggregate-flag form is the default, while an option preserves the current individual-flag expansion.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.