Vector35 / Vector35/binaryninja-api
Stack pointer analysis diverged because opaque branch is not removed at LLIL
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Binary: laminar frost talks serenely
At 0x417011, there is an opaque predicate:
However, since we are not removing opaque branches at LLIL, we still did the stack pointer analysis for both sides, which diverges, as can be seen with the red question mark. It can be more obviously seen at LLIL:
This causes the stack variable to screw up in further places, and until this opaque predicate is patched out, there is no good way to fix it. But ideally we should be able to handle it automatically since we already did the dataflow analysis to recognize it
I am thinking maybe we can add a opaque branch removal at both LLIL and MLIL
Similar to https://github.com/Vector35/binaryninja-api/issues/7460, though that one is at MLIL
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the LLIL and MLIL opaque-branch handling discussed here and compare the related issue #7460. Reproduce the divergence at 0x417011 from the laminar frost talks serenely binary, then verify that removing the opaque branch at LLIL prevents stack pointer analysis from following both paths and corrupting later stack variables.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100