Vector35 / Vector35/binaryninja-api

xor reg1, reg1 is not always simplified to reg1 = 0

Open
#6,010 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Core Core: LLIL Effort: Low Impact: Low
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

When we have some code like

xor edx, edx
jne 0x18
Screenshot 2024-10-19 at 12 56 30 PM

The LLIL simplifies the xor instruction to edx = 0, and the jne instruction is treated as opaque predicate and removed in higher level of ILs.

LLIL:

Screenshot 2024-10-19 at 12 57 55 PM

MLIL:

Screenshot 2024-10-19 at 12 58 06 PM

HLIL:

Screenshot 2024-10-19 at 12 58 33 PM

This works perfectly for the above example, however, I noticed that it does not work all of the time. See below for an example:

Screenshot 2024-10-19 at 12 59 41 PM

This is an opaque predicate as well and the left branch is fake. The code always executes the right branch.

LLIL:

Screenshot 2024-10-19 at 1 00 37 PM

MLIL:

Screenshot 2024-10-19 at 1 01 03 PM

HLIL:

Screenshot 2024-10-19 at 1 01 35 PM

While the semantics of the code is still correct and we can see it is still an opaque predicate, we should be able to simplify it automatically.

Database:

Offending binary:

keygenme4.exe.bndb.zip

Address: 0x416ed5

Simple case:
xor_simple.bndb.zip

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by opening the supplied xor_simple.bndb.zip and keygenme4.exe.bndb.zip databases, then inspect the LLIL, MLIL, and HLIL around address 0x416ed5. Compare the inconsistent xor self-assignment simplification with the simple case. Done means equivalent opaque-predicate branches are simplified consistently without changing program semantics.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers, reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.