Vector35 / Vector35/binaryninja-api
Better trivial function identification in WARP
@emesare is already working on this.
Since Nov 22, 2024.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
WARP tries to identify trivial functions to force constraint matching, this is what prevents trivial functions from matching random functions that don't have more than one possible match. For example the following function:
10004860 68484f3a10 push data_103a4f48 {var_4}
10004865 b9984f3a10 mov ecx, data_103a4f98
1000486a e831c20700 call sub_10080aa0
1000486f 6840962210 push 0x10229640 {var_4}
10004874 e8f06a1f00 call _atexit
10004879 59 pop ecx {var_4} {0x10229640}
1000487a c3 retn {__return_addr}
Will match with:
[WARP] ?CleanupTopologyInformation@ResourceManager@details@Concurrency@@CAXXZ (98891602-4774-52eb-b4ca-ff23c8d6b104)
[WARP] CS _free (f29d4b0d-29ef-5957-85fa-9fdbab6b0a1a)
[WARP] ADJ _free (f29d4b0d-29ef-5957-85fa-9fdbab6b0a1a)
As seen above, there is only one possible match, and because the length is greater than analysis.warp.trivialFunctionLength (default of 20 bytes), the function will match without checking the constraint.
Of course the user can raise the setting listed above, but the primary issue here is the fact that our definition of a "trivial" function goes as far as the length of said function, rather than for example, the number of basic blocks.
We should extend WARP's definition of a trivial function to include things such as the number of basic blocks, the number of calls, and other broad metrics that make sense to include.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.