Vector35 / Vector35/binaryninja-api
Convert switch-case with only two cases to an if-else branch
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
I have a binary that obfuscates a regular if-else statement to a switch-case with two cases. It would be good if we can automatically concert such a case to an if-else branch, thus defeating the obfuscation, with minimal user-interaction:
Here is what it now looks like in HLIL:
We can see it is checking if the start of the buffer is 0x5a4d, a typical check for PE file.
Repro steps:
- Download the binary from https://malshare.com/sample.php?action=detail&hash=0cf55c7e1a19a0631b0248fb0e699bbec1d321240208f2862e37f6c9e75894e7 and open it
- Go to function 0x434a60
- Set the type of the data variable at
0x44284ctoconst int32_t - Set the type of the data variable at
0x442844toconst int32_t[2] - View the function code in HLIL
I came across this while looking at https://github.com/Vector35/binaryninja-api/discussions/5629.
P.S. some other switch-case conversion related issues: https://github.com/Vector35/binaryninja-api/issues/4670, https://github.com/Vector35/binaryninja-api/issues/1723
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the behavior with the linked binary by opening function 0x434a60, applying the two listed data types, and viewing its HLIL. Trace the switch-case conversion related to issues #4670 and #1723; done means a two-case switch representing a binary condition is rendered as an if-else branch with equivalent behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers, reverse-engineering
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100