Vector35 / Vector35/binaryninja-api

Optimize virtual calls with "this" parameter when global variable is used in HLIL

Open
#5,679 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Core Effort: Low IL Optimization Impact: Low
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

What is the feature you'd like to have?
In virtual calls with global variable as "this" param HLIL creates new local variable instead of using global variable, thus instead of:

// gSomeObj - global variable of type "struct SomeClass"
gSomeObj->vtable->SomeFunc(gSomeObj, ...);

HLIL looks like:

struct SomeClass* gSomeObj_1 = gSomeObj
gSomeObj_1->vtable->SomeFunc(gSomeObj_1, ...)

Are any alternative solutions acceptable?
Idk actually, mb it can be solved with workflow (?).

Additional Information:
As i've said it only happens (at least i've checked against it) only when "this" parameter is passed to the function, so if function signature not using it, then BN generates compact code, for example, if SomeFunc signature is void(*)() or void(*)(int32_t @ rdx) then code would be gSomeObj->vtable->SomeFunc() and gSomeObj->vtable->SomeFunc(1337) accordingly.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue's HLIL example with a global variable passed as the virtual call's "this" parameter, and compare it with the compact forms described for signatures that do not use "this". Trace the HLIL virtual-call handling and verify that the output keeps the global variable directly while preserving the existing no-"this" cases.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers, reverse-engineering
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.