Vector35 / Vector35/binaryninja-api

Constant Folding / Optimization in HLIL

Open
#6,126 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Core Core: HLIL Effort: Medium Impact: Medium
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

What is the feature you'd like to have?
I want constant arithmetic to be folded/resolved after the HLIL div/mod optimization stage runs

Is your feature request related to a problem?
This binary does a bunch of obfuscation and while binja can piece apart the math, it happens too late in the analysis pipeline to actually evaluate it and simplify it entirely.

Are any alternative solutions acceptable?
Div/mod deopt at an earlier stage? Probably not feasible.

Additional Information:
Reported over pub slack:

Not sure if it's something to report as a bug but look at this: (address 100f54698 for me)
(*(&data_1012e61a0 + (zx.q(((((((8 + ((0xf61c1a - 0x1a s/ 0x4e * 0x4e - sx.d((0xf61c1a - 0x1a s/ 0x4e * 0x4e).b) s/ 0x47 * 0x47) & 0xf61bcc) * 0xd) & 0x34) u% 0x32 u/ 0x28) | 0x44) u/ 0x1a) ^ 0x4f) - 0x39) << 3)))(&var_80)
I do believe we can do a better job in terms of recognizing some identities (e.g. 0x1a / 0x4e * 0x4e == 0x1a) and we can actually eval part of this

Binary: terrify shave embrace

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the reported expression from binary terrify shave embrace, including the example at address 100f54698, and inspect the HLIL div/mod optimization stage. Determine how constant arithmetic is represented after that stage; done means the constant portions are evaluated and the resulting HLIL expression is simplified rather than left as the shown obfuscated arithmetic.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers, reverse-engineering
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.