Vector35 / Vector35/binaryninja-api

PVS analysis not consulted for range or sets of values when computing conditional branches

Open
#6,824 3 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Core Core: Dataflow Core: MLIL Effort: Low Impact: Medium
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

When computing the conditional branches in MLIL data flow we seem to ignore most of our value types other than constants.

This means a user cannot use the UIDF to eliminate opaque predicates, there are other ways to eliminate these using patching but it would be nice to let the analysis see those branches as "dead" instead of not there. Using a constant value type would also satisfy the condition but that is not possible in certain patterns where the variable value is inspected for some non opaque predicate operation.

For example edi => SignedRangeValue { 2 : 4 : 1 }:

Image

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing conditional-branch computation in MLIL data flow and how the UIDF consults PVS results. Reproduce the example using SignedRangeValue { 2 : 4 : 1 }, then inspect handling of range and set value types alongside constants. Done means eligible branches are recognized as dead when PVS proves their conditions impossible.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.