Vector35 / Vector35/binaryninja-api
IL simplification does not take advantage of distributive property
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
For the following source code,
struct AllocStruct {
void * padding[0x30];
char * buffers[0x10];
int sizes[0x10];
};
int main() {
struct AllocStruct* a = malloc(sizeof(struct AllocStruct));
for (int i = 0; i < 0x10; i++) {
a->buffers[i] = malloc(0x18);
a->sizes[i] = 0x20;
}
return 0;
}
When it gets compiled with gcc -O0 test.c on Ubuntu 22.04, the HLIL looks like this:
The IL simplification does not take advantage that
rax_5->padding[sx.q(i) + 0x30] = malloc(bytes: 0x18)
is equivalent to
rax_5->buffers[sx.q(i)] = malloc(bytes: 0x18)
, since padding[0x30] is the size of the padding member.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the supplied test.c example and compile it with gcc -O0 on Ubuntu 22.04, then inspect the resulting HLIL and the a.out.zip reproduction. Trace the IL simplification responsible for the padding and buffers indexing, and verify that the distributive equivalence is recognized without changing other expressions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, cpp
- Domain
- compilers, reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100