avast / avast/retdec

Switch-cases wrongly deleted, indirect jump not reconstructed correctly.

Open
#669 5 comments 0 reactions 1 assignee Claimed by @PeterMatula View on GitHub
bug C-bin2llvmir P-output
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

I experimented with RetDec and a simple C program. I compiled the program with **clang** (Apple clang version 11.0.0 (clang-1100.0.33.8)) on macOS 10.14.
The program contains a simple **switch-case statement** which is compiled to a **lookup table and lookup + indirect branching assembly code**.
When decompiling the code, **the switch-cases are missing in the recovered LLVM IR code**. I tried disabling all of the optimization passes used in `bin2llvmir`. It turns out that the **indirect branch instruction is not correctly reconstructed** and therefore the switch-cases are unreachable blocks of code (removed by optimizations).
The problem is unaffected by the optimization level (`-O0` or `-O2`) used for compilation.

The C program in question:
```C
#include
int main() {
char operator;
int n1, n2;
printf("Enter an operator (+, -, *, /): ");
scanf("%c", &operator);
printf("Enter two operands: ");
scanf("%d %d",&n1, &n2);
switch(operator)
{
case '+':
printf("%d + %d = %d",n1, n2, n1+n2);
break;
case '-':
printf("%d - %d = %d",n1, n2, n1-n2);
break;
case '*':
printf("%d * %d = %d",n1, n2, n1*n2);
break;
case '/':
printf("%d / %d = %d",n1, n2, n1/n2);
break;
// operator doesn't match any case constant +, -, *, /
default:
printf("Error! operator is not correct");
}
return 0;
}
```

The correctly disassembled switch-statement in IDA:
![image](https://user-images.githubusercontent.com/1275898/66997419-b57a4b80-f0d2-11e9-9643-1c54e5491683.png)

And the incorrectly reconstructed LLVM IR code from RetDec (before RetDec optimization passes):
![image](https://user-images.githubusercontent.com/1275898/66997750-59fc8d80-f0d3-11e9-8626-7342a15e35e8.png)

Consecutively, the optimized IR code is missing large parts of the program, same for the reconstructed C program. If I can help with this issue any further by providing binaries or anything else, let me know.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.