Vector35 / Vector35/binaryninja-api
xor reg1, reg1 is not always simplified to reg1 = 0
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
When we have some code like
xor edx, edx
jne 0x18
The LLIL simplifies the xor instruction to edx = 0, and the jne instruction is treated as opaque predicate and removed in higher level of ILs.
LLIL:
MLIL:
HLIL:
This works perfectly for the above example, however, I noticed that it does not work all of the time. See below for an example:
This is an opaque predicate as well and the left branch is fake. The code always executes the right branch.
LLIL:
MLIL:
HLIL:
While the semantics of the code is still correct and we can see it is still an opaque predicate, we should be able to simplify it automatically.
Database:
Offending binary:
Address: 0x416ed5
Simple case:
xor_simple.bndb.zip
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by opening the supplied xor_simple.bndb.zip and keygenme4.exe.bndb.zip databases, then inspect the LLIL, MLIL, and HLIL around address 0x416ed5. Compare the inconsistent xor self-assignment simplification with the simple case. Done means equivalent opaque-predicate branches are simplified consistently without changing program semantics.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers, reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100