avast / avast/retdec

Sometimes not all functions are recognized as such, or otherwise: functions are simply missing.

Open
#226 1 comment 1 reaction 0 assignees View on GitHub
C-bin2llvmir enhancement P-output
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

It seems to be a general problem if you have a more complex program optimized by the compiler, that not all functions are recognized as such. The best example is, for example, a function that refers to another memory location. This contains only one jmp to another function. But these places are not really recognized. I have now tried to figure out what this is, but it seems to depend on the compiler. Building examples in which this occurs again and again, or to check if it works, i. e. to adjust, is very difficult.

The problem seems to be generally known, and there are already some [blog entries](https://binary.ninja/2017/11/06/architecture-agnostic-function-detection-in-binaries.html) about it.

What is the basic situation here? Are there further analysis steps planned to find all functions? If the user knows that there is definitely a function at the position 0x123 and this position is passed to the program, then it can also happen that you only get an empty result, because the position is not recognized internally as a function.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the optimized, jump-only function cases described in the issue and use the linked Binary Ninja article as background on function detection. Build a small reproducible binary where a known address is not recognized, then trace the existing analysis to determine whether the function is recovered and whether querying that address produces a nonempty result.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers, reverse-engineering
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.