angr / angr/angr

SwitchLowering + Clustering failing on `tail.o` function `parse_options`

Open
#4,720 0 comments 0 reactions 0 assignees View on GitHub
bug decompiler
Dominant language
Python
Stars
9.1k
Forks
1.2k
Avg merge
16h 20m
Merged PRs (30d)
169

Description

### Description

On the `tail.o` binary (present in our binaries repo) we fail to recover a _single correct_ Switch statement inside the code. The important section of the function looks like this:
```c
if ((unsigned int)v5 == -1)
break;
if (!((unsigned int)v5 <= 133))
goto LABEL_4044e6;
if ((unsigned int)v5 <= 47)
{
switch ((unsigned int)v5)
{
case 4294967165:
v0 = v5;
version_etc(*((long long *)&stdout), "tail", "GNU coreutils", *((long long *)&Version), "Paul Rubin", "David MacKenzie", "Ian Lance Taylor", "Jim Meyering", 0);
exit(0); /* do not return */
case 4294967166:
usage(0); /* do not return */
default:
LABEL_4044e6:
usage(1); /* do not return */
}
}
else
{
switch ((unsigned int)v5)
{
case 48: case 49: case 50: case 51: case 52: case 53: case 54: case 55: case 56: case 57:
v1 = v6;
```

As you might guess, this entire series of if-stmts and Switches should all be merged into a single Switch. The root-cause of the failure appears to be related to the variable identified as the SwitchClusters variable:
https://github.com/angr/angr/blob/bf197cb0dc268e9203acf0484e96036a2b05a7b6/angr/analyses/decompiler/region_simplifiers/region_simplifier.py#L164

Here the value is:
```
ipdb> finder.var2switches
defaultdict(, {None: [>, >], <0x4040d0[ir_4]|Reg 32, 1B>: [<<0x4040d0[ir_4]|Reg 32, 1B> (2 cases) @ 0x4042dd, parent node >]})
```

The variable is `None`.

### Steps to reproduce the bug

In your terminal:
```
angr decompile binaries/tests/x86_64/decompiler/tail.o --functions parse_options
```

This should run angr with default optimizations enabled, which should include SwitchLowering. If it does not, then enable it.
Assumes you are in the root of `angr-dev`.

### Environment

_No response_

### Additional context

_No response_

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.