Vector35 / Vector35/binaryninja-api
PVS analysis not consulted for range or sets of values when computing conditional branches
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
When computing the conditional branches in MLIL data flow we seem to ignore most of our value types other than constants.
This means a user cannot use the UIDF to eliminate opaque predicates, there are other ways to eliminate these using patching but it would be nice to let the analysis see those branches as "dead" instead of not there. Using a constant value type would also satisfy the condition but that is not possible in certain patterns where the variable value is inspected for some non opaque predicate operation.
For example edi => SignedRangeValue { 2 : 4 : 1 }:
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing conditional-branch computation in MLIL data flow and how the UIDF consults PVS results. Reproduce the example using SignedRangeValue { 2 : 4 : 1 }, then inspect handling of range and set value types alongside constants. Done means eligible branches are recognized as dead when PVS proves their conditions impossible.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100