avast / avast/retdec

Library function analysis problem

Open
#1,076 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

I found that there was an error in the parsing of the library function. The reason for the error was that retdec could not parse the jump from plt to got.

Finally I located the function, and its parsing result went wrong. I don't know how to fix it.
https://github.com/avast/retdec/blob/f9ac9ec7e8af77bc14944ce2650c9bbcc84f6368/src/bin2llvmir/optimizations/decoder/decoder.cpp#L822

retdec parsing result
```
define i32 @function_11e94(i32 %arg1) local_unnamed_addr {
dec_label_pc_11e94:
%0 = call i32 @function_e5933000(), !insn.addr !125
ret i32 %0, !insn.addr !125
}
```

radare parsing result
![image](https://user-images.githubusercontent.com/31761342/166695103-e31c2c20-55b0-45f1-8189-3364019851bc.png)

ida parsing result
image

My tested file info
```
ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.3, for GNU/Linux 2.6.16, stripped

```

It can be resolve? Thank you.

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the issue with the supplied stripped 32-bit ARM ELF executable, then inspect src/bin2llvmir/optimizations/decoder/decoder.cpp around line 822 and the PLT-to-GOT handling. Compare RetDec's generated function with the radare and IDA results; done means the library function and jump are parsed correctly.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers, reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.