BinKit icon indicating copy to clipboard operation
BinKit copied to clipboard

Binaries compiled to MIPS64 tend to have fewer functions compared to other architectures when using clang-4.0 ~ clang-7.0 with O0

Open island255 opened this issue 8 months ago • 3 comments

Thanks for your great job! Recently, I have been conducting research based on this dataset. After I disassemble the binaries, I find that binaries compiled to MIPS64 tend to have fewer functions compared to other architectures when using clang-4.0 ~ clang-7.0 with O0. For example, gsl-2.7.1_clang-10.0_mipseb_64_O0_libgsl.so.27.0.0 has 3447 functions while gsl-2.7.1_clang-10.0_mipseb_64_O1_libgsl.so.27.0.0 has 5971 functions. Besides, gsl-2.7.1_clang-10.0_arm_32_O0_libgsl.so.27.0.0 also has 8074 functions.

I am confused why these binaries have a great difference in their functions. I have found that the library functions in different architectures may be different, but some binaries are compiled from different source code regions. Do you have any idea why these binaries are largely different in the number of functions? Why does it occur only when applying clang-4.0~clang-7.0 and O0 to mips64?

island255 avatar May 30 '25 10:05 island255

Thanks for your interest!

Does that apply to only gsl or other binaries as well?

I am not sure about this as I havn't look into this after clang 7. Would it be because clang itself had changed significantly after 7? (e.g., more debug / template functions or even more accurately handling no-optimization features)

It seems that we might need to analyze compiler backend implementation and understand its features as well ..

0xdkay avatar May 30 '25 19:05 0xdkay

Thanks for your reply! I rechecked these binary files and found that the binaries have these functions, but these functions do not appear in the FCG of binaries compiled to MIPS with clang and O0, where there is no call to these functions. I guess that this may be because IDA Pro cannot discover some indirect function calls.

island255 avatar Jun 03 '25 03:06 island255

That makes sense. Thanks for letting me know. I would also recommend the latest IDA Pro v9.1. The one I used (i.e., v6.95 and v7.5) is too outdated :(

0xdkay avatar Jun 04 '25 00:06 0xdkay