Vector35 / Vector35/binaryninja-api
Constant Folding / Optimization in HLIL
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
What is the feature you'd like to have?
I want constant arithmetic to be folded/resolved after the HLIL div/mod optimization stage runs
Is your feature request related to a problem?
This binary does a bunch of obfuscation and while binja can piece apart the math, it happens too late in the analysis pipeline to actually evaluate it and simplify it entirely.
Are any alternative solutions acceptable?
Div/mod deopt at an earlier stage? Probably not feasible.
Additional Information:
Reported over pub slack:
Not sure if it's something to report as a bug but look at this: (address 100f54698 for me)
(*(&data_1012e61a0 + (zx.q(((((((8 + ((0xf61c1a - 0x1a s/ 0x4e * 0x4e - sx.d((0xf61c1a - 0x1a s/ 0x4e * 0x4e).b) s/ 0x47 * 0x47) & 0xf61bcc) * 0xd) & 0x34) u% 0x32 u/ 0x28) | 0x44) u/ 0x1a) ^ 0x4f) - 0x39) << 3)))(&var_80)
I do believe we can do a better job in terms of recognizing some identities (e.g. 0x1a / 0x4e * 0x4e == 0x1a) and we can actually eval part of this
Binary: terrify shave embrace
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the reported expression from binary terrify shave embrace, including the example at address 100f54698, and inspect the HLIL div/mod optimization stage. Determine how constant arithmetic is represented after that stage; done means the constant portions are evaluated and the resulting HLIL expression is simplified rather than left as the shown obfuscated arithmetic.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers, reverse-engineering
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100