Vector35 / Vector35/binaryninja-api

IL simplification does not take advantage of distributive property

Open
#6,199 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Core Core: HLIL Effort: High Impact: Medium
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

For the following source code,

struct AllocStruct {
    void * padding[0x30];
    char * buffers[0x10];
    int sizes[0x10];
};

int main() {

    struct AllocStruct* a = malloc(sizeof(struct AllocStruct));

    for (int i = 0; i < 0x10; i++) {
        a->buffers[i] = malloc(0x18);
        a->sizes[i] = 0x20;
    }
    return 0;
}

a.out.zip

When it gets compiled with gcc -O0 test.c on Ubuntu 22.04, the HLIL looks like this:

image

The IL simplification does not take advantage that

rax_5->padding[sx.q(i) + 0x30] = malloc(bytes: 0x18)

is equivalent to

rax_5->buffers[sx.q(i)] = malloc(bytes: 0x18)

, since padding[0x30] is the size of the padding member.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the supplied test.c example and compile it with gcc -O0 on Ubuntu 22.04, then inspect the resulting HLIL and the a.out.zip reproduction. Trace the IL simplification responsible for the padding and buffers indexing, and verify that the distributive equivalence is recognized without changing other expressions.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, cpp
Domain
compilers, reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.