avast / avast/retdec

ARM: handle strings in a function body

Open
#166 0 comments 0 reactions 0 assignees View on GitHub
C-bin2llvmir enhancement P-output
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

Try to handle the following case when `naked` attribute is used to prevent function prologue/epilogue generation, and uses the body for strings:
```c
#include

__attribute__ ((naked)) void my_mum_said_im_special(){
asm ( ".long 0x6C6C6548" );
asm ( ".long 0x6f57206f" );
asm ( ".long 0x00646c72" );
}

int main(){
const char *s = (const char *)&my_mum_said_im_special;
printf( "%s\n", s );
return 0;
}
```

[naked.zip](https://github.com/avast-tl/retdec/files/1700360/naked.zip)

It is from [this article](https://www.evilsocket.net/2015/05/02/using-inline-assembly-and-naked-functions-to-fool-disassemblers/).

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the ARM case from naked.zip and compare RetDec's output for the C sample using naked functions and inline assembly strings. Trace the decompiler's handling of naked function bodies and embedded string data. Done means the sample is handled without losing or misinterpreting the string content.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, cpp
Domain
compilers, reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.