avast / avast/retdec

Detection of C++/CLI fails, resulting in incorrect results

Open
#233 1 comment 0 reactions 0 assignees View on GitHub
enhancement P-output T-comp-msvc
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

I have created an example in C++/CLI, known to be the special version of C++ from Microsoft. C++ and CLI are mixed in it. But the detection is faulty, which means that no analysis takes place at all and no single function is detected.

```
File format : PE
File class : 32-bit
File type : Executable file
Architecture : x86
Endianness : Little endian
Image base address : 0x400000
Entry point address : 0x403f71
Entry point offset : 0x3371
Entry point section name : .text
Entry point section index: 0
Bytes on entry point : ff25444040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Detected tool : MSVC (compiler), 104 from 106 significant nibbles (98.1132%)
Original language : CIL/.NET (bytecode)
Rich header offset : 0x80
Rich header key : 0x2dbc7cdc
```
The result looks like this.

```
//
// This file was generated by the Retargetable Decompiler
// Website: https://retdec.com
// Copyright (c) 2018 Retargetable Decompiler
//

#include

// ------------------------- Classes --------------------------

// type_info

// ------------------- Function Prototypes --------------------

int32_t entry_point(void);

// ------------------------ Functions -------------------------

// Address range: 0x403f71 - 0x403f76
int32_t entry_point(void) {
// entry
return _CorExeMain();
}

// --------------- Dynamically Linked Functions ---------------

// __int32 _CorExeMain();

// --------------------- Meta-Information ---------------------

// Detected compiler/packer: msvc
// Detected language: CIL/.NET (bytecode)
// Detected functions: 1
// Decompilation date: 2018-03-02 17:25:10
```

The source code for the program is attached. It is easy to compile and run with Visual Studio 2017. It is knitted as simple as possible to check the results quickly and easily.

[ConsoleApplication1.zip](https://github.com/avast-tl/retdec/files/1775906/ConsoleApplication1.zip)

A small addition: I know that C++/CLI is a mixture of real C++ and of course it can contain many NET framework classes. It is in itself a very unpleasant mixture. But from my point of view, there is a lot of additional information which could be used to decompile at least the real native assembler code. There are of course enough decompilers for NET Framework, but not for the C++ part.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by compiling the attached ConsoleApplication1.zip with Visual Studio 2017 and reproducing the incorrect one-function output. Trace the C++/CLI language and compiler detection path, then verify that analysis identifies the native C++ portion rather than only the CIL/.NET entry point.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.