binaryninja-api icon indicating copy to clipboard operation
binaryninja-api copied to clipboard

Tail call analysis of indirect jumps

Open 0x1F9F1 opened this issue 7 years ago • 1 comments

Binary Ninja Version: 1.1.1227-dev, 92412e23 Platform: Windows 10 (10.0)

There seems to have been a regression analyzing indirect tail calls between 1.1.1200-dev and 1.1.1201-dev.

1.1.1200-dev:

>>> current_llil[24]
<il: jump([rsp - 8 {var_8}].q => 25 @ 0x143455093)>

>>> current_llil[24].operation
<LowLevelILOperation.LLIL_JUMP_TO: 52>

>>> current_llil[24].get_reg_value('rsp')
<stack frame offset 0x0>

>>> current_llil[24].dest.value
<const ptr 0x14152ad3c>

>>> current_llil[25]
<il: <return> tailcall(0x14152ad3c)>

>>> current_llil[25].operation
<LowLevelILOperation.LLIL_TAILCALL: 55>

image

image

1.1.1201-dev:

>>> current_llil[24]
<il: jump([rsp - 8 {var_8}].q)>

>>> current_llil[24].operation
<LowLevelILOperation.LLIL_JUMP: 51>

>>> current_llil[24].get_reg_value('rsp')
<stack frame offset 0x0>

>>> current_llil[24].dest.value
<const ptr 0x14152ad3c>

image

image

0x1F9F1 avatar Jun 09 '18 02:06 0x1F9F1

This is intentional behavior for now -- indirect tail calls were actually being handled on accident in certain situations leading up to build 1.1.1201-dev (and causing problems of their own since there's some additional groundwork to lay before we can handle it robustly).

This is almost the only change that was made in build 1.1.1201-dev.

rssor avatar Jun 09 '18 10:06 rssor