Vector35 / Vector35/binaryninja-api
Cannot figure out the parameter of the call if the parameters are moved into the stack rather than pushed
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
In the following code,
It seems the analysis is confused and it does not figure out the parameter being moved into [esp] is the parameter for the function call. What is even more puzzling is that this is NOT always the case. For example, for the sleep call, there are three occasions, and only two of them show the behavior, and the other one works just fine. For the sub_804a300, which is printf-like, we actually get it correct plenty of times, though for some of them, it does not work.
I checked the IL, and when we cannot figure out the parameters, the MLIL is MLIL_CALL_UNTYPED, and for those cases that we get it correct, it is a MLIL_CALL with the appropriate parameters.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the cases shown in the screenshots, comparing calls to sleep and sub_804a300 where parameters moved into [esp] produce different results. Inspect the IL around MLIL_CALL_UNTYPED versus MLIL_CALL and determine why equivalent call parameters are not inferred consistently; done means the affected calls expose the appropriate parameters.
Written by the indexing model from the issue text.
Assessment
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100