avast / avast/retdec

Incorrect translation of code

Open
#664 5 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

I am testing retdec on Juliet 1.3 Test Suite Dataset

when i apply retdec-decompile to binary, the result is quite different as i expect.
I upload binary and c source code in my repositoy
https://github.com/leepeter2019/test

binary file is "CWE457_Use_of_Uninitialized_Variable__int_array_alloca_no_init_01.out"
i build c source code with linux gcc compiler

original file is "CWE457_Use_of_Uninitialized_Variable__int_array_alloca_no_init_01.c"
translated file is "CWE457_Use_of_Uninitialized_Variable__int_array_alloca_no_init_01_retdec.c"

the function is interested in is
`
void CWE457_Use_of_Uninitialized_Variable__int_array_alloca_no_init_01_bad()
{
int * data;
data = (int *)ALLOCA(10*sizeof(int));
/* POTENTIAL FLAW: Don't initialize data */
; /* empty statement needed for some flow variants */
/* POTENTIAL FLAW: Use data without initializing it */
{
int i;
for(i=0; i<10; i++)
{
printIntLine(data[i]);
}
}
}
`

the result of retdec is
`// From module: /home/vmware/test/Juliet_Test_Suite_v1.3_for_C_Cpp/testcases/CWE457_Use_of_Uninitialized_Variable/CWE457_Use_of_Uninitialized_Variable__int_array_alloca_no_init_01.c
// Address range: 0x804893b - 0x80489ba
// Line range: 22 - 36
void CWE457_Use_of_Uninitialized_Variable__int_array_alloca_no_init_01_bad(void) {
int32_t v1 = __readgsdword(20); // 0x8048941
int32_t v2 = g2 - 64; // 0x8048990
for (int32_t i = 0; i < 10; i++) {
// 0x804897f
*(int32_t *)(v2 - 16) = *(int32_t *)(4 * i + (g2 - 49 & -16));
printIntLine(i);
v2 = g2 + 16;
}
// 0x80489a6
if (__readgsdword(20) != v1) {
// 0x80489b3
__stack_chk_fail();
}
}`

Can you explain why the result on 'printIntLine(i)' is different original 'printIntLine(data[i])'?

I have another question.
When I apply retdec-decompiler, it shows which options they use for fileinfo and bin2IR. But the IR and C result is different from 'using retdec-decompiler' and 'using retdec-fileinfo and retdec-bin2llvmir with same options as retdec-decompiler'. Can you explain why the result of using directly retdec-decomipler and the result of using retdec-fileinfo, retdec-bin2llvmir and retdec-llvmir2hll as sequence'

Thanks

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the binary and source files in the linked test repository, especially CWE457_Use_of_Uninitialized_Variable__int_array_alloca_no_init_01.out, the original .c file, and the generated _retdec.c file. Reproduce the retdec-decompiler run, then compare it with the retdec-fileinfo, retdec-bin2llvmir, and retdec-llvmir2hll sequence using the reported options. Done means explaining the differing printIntLine output and the pipeline discrepancy.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, cpp, linux
Domain
compilers, reverse-engineering
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.