Vector35 / Vector35/binaryninja-api

Use .ppc.EMB.apuinfo section in powerpc ELFs to distinguish between APUs (Altivec, SPE, etc.)

Open
#6,290 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Arch: PowerPC Component: Architecture Component: BinaryViewType Effort: Low File Format: ELF Impact: Low
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

What is the feature you'd like to have?
There are several different powerPC variants with overlapping opcodes, notably Altivec and SPE, among others. Currently, ELFs just pick the default one (Altivec), and there isn't an easy way to override that if it uses SPE, for example.

However, SPE ELFs exist (I wish I had one I could share), and it would be nice to be able to auto-detect them. The way this is done is with the .ppc.EMB.apuinfo section in ELFs. PowerPC could define a platform recognizer to dispatch to the correct APU variant, but it needs more information in the Metadata argument passed to it. It would be nice to add sections to the Metadata argument so that this would work.

Note that at the time of writing, the SPE architecture is defined in arch_ppc, capstone isn't routed to correctly use it (the call to cs_open fails; try Architecture["ppc_spe"].get_instruction_text(b"\x10\x00\x00\x00", 0x1000) in the binaryninja console and it segfaults binaryninja on my box -- note that this isn't a "binaryninja isn't using capstone correctly" issue (other than not checking the call to cs_open), but a bug in capstone itself)...don't get too hung up on this, I'm hoping to push a PR with a replacement to capstone in a few weeks.

Is your feature request related to a problem?
A PowerPC SPE elf is basically unanalyzable by binaryninja right now.

Are any alternative solutions acceptable?
I'm sure there's a way to override the architecture of an ELF, but it would be nice not to have to.

Additional Information:
https://www.nxp.com/docs/en/engineering-bulletin/EB622.pdf

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the PowerPC platform recognizer and the Metadata argument, then inspect the arch_ppc architecture and the .ppc.EMB.apuinfo ELF section described in the issue. Check how architecture selection currently handles overlapping PowerPC variants. Done means SPE and other APU variants can be detected automatically from the section without requiring a manual ELF architecture override.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.