Vector35 / Vector35/binaryninja-api

Remove dead partial stores of return registers when possible

Open
#5,993 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Core Core: HLIL Effort: Medium IL Optimization Impact: Low
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 4.2.6188-dev (ab61b8dc)
  • OS: Windows 11
  • OS Version: 23H2
  • CPU Architecture: x86-64

Bug Description:
In function sub_180001160 of the attached binary, result is defined as a single variable, stored in rax, but before each return, the variable should be split and merged with the return value. Binary ninja correctly shows just return 0 and return 1, but the stores into RAX for the return values are still shown when they should be hidden.

Steps To Reproduce:
Open the attached binary and let analysis finish.

Expected Behavior:
the stores into result before each of the returns should be hidden.

Screenshots/Video Recording:
Initial with return value changed to bool and reanalyzed:
image
Split into new variables (which binja warns could be incorrect):
image
Each new variable set to bool, which finally removes the store:
image

Binary:

Source code of the function:

Additional Information:

  • The source code is also just one line instead of split with an if statement: return handle != NULL && isOpened && handle != INVALID_HANDLE_VALUE;
  • The fully reversed function looks like this:
    image

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue by opening the attached NativeNamedPipe.zip binary and inspecting function sub_180001160 after analysis finishes. Compare the decompilation with connection_win.cpp, especially the one-line boolean return; done means the dead stores into RAX are hidden while the return values remain correct.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.