Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Incorrect implementation of the Binary Ninja backend #11

Open
Learner0x5a opened this issue Apr 18, 2023 · 2 comments
Open

Incorrect implementation of the Binary Ninja backend #11

Learner0x5a opened this issue Apr 18, 2023 · 2 comments

Comments

@Learner0x5a
Copy link

For x86_64 indirect calls like call rax, binary ninja does not identify them as branch instruction.

1681800923432

Thus even BNBranchType::CallDestination cannot record these indirect calls.

Maybe by parsing the disassembly text token types can resolve this issue, as shown in https://api.binary.ninja/binaryninja.architecture-module.html#binaryninja.architecture.InstructionTextToken

image

@Learner0x5a
Copy link
Author

Based on the above comment, I've write an example for x86_64:

extern "C" bool is_indirect_branch_default_impl(uint8_t *insn_data, size_t insn_size) {
    size_t ttCount;
    BNInstructionTextToken* ttResult = NULL;
    BNGetInstructionText(arch, (const uint8_t*) insn_data, 0 /*addr*/, &insn_size, &ttResult, &ttCount);
    std::string call_op = "call";

    auto opcode = ttResult[0];
    // auto padding = ttResult[1];
    auto first_operand = ttResult[2];
    if ((call_op.compare(opcode.text) == 0) && (first_operand.type != BNInstructionTextTokenType::CodeRelativeAddressToken)){
        return true;
    }

    //BNInstructionInfo info;
    //BNGetInstructionInfo(arch, insn_data, 0, insn_size, &info);
    //for (int i = 0; i < info.branchCount; i++) {
    //    BNBranchType br = info.branchType[i];
    //    if ((br == BNBranchType::IndirectBranch) || (br == BNBranchType::UnresolvedBranch)) {
    //        return true;
    //    }
    //}
    return false;
}

@Learner0x5a
Copy link
Author

Learner0x5a commented Apr 21, 2023

I've tested arm32 blx reg instructions, and the results are similar: BN does not recognize these instructions as branches.

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant