Vector35 / Vector35/binaryninja-api

Convert switch-case with only two cases to an if-else branch

Open
#5,637 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Effort: Trivial IL Optimization Impact: Low
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

I have a binary that obfuscates a regular if-else statement to a switch-case with two cases. It would be good if we can automatically concert such a case to an if-else branch, thus defeating the obfuscation, with minimal user-interaction:

Here is what it now looks like in HLIL:

Screenshot 2024-06-20 at 12 43 49 PM

We can see it is checking if the start of the buffer is 0x5a4d, a typical check for PE file.

Repro steps:

  1. Download the binary from https://malshare.com/sample.php?action=detail&hash=0cf55c7e1a19a0631b0248fb0e699bbec1d321240208f2862e37f6c9e75894e7 and open it
  2. Go to function 0x434a60
  3. Set the type of the data variable at 0x44284c to const int32_t
  4. Set the type of the data variable at 0x442844 to const int32_t[2]
  5. View the function code in HLIL

I came across this while looking at https://github.com/Vector35/binaryninja-api/discussions/5629.

P.S. some other switch-case conversion related issues: https://github.com/Vector35/binaryninja-api/issues/4670, https://github.com/Vector35/binaryninja-api/issues/1723

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the behavior with the linked binary by opening function 0x434a60, applying the two listed data types, and viewing its HLIL. Trace the switch-case conversion related to issues #4670 and #1723; done means a two-case switch representing a binary condition is rendered as an if-else branch with equivalent behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers, reverse-engineering
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.