xor reg1, reg1 is not always simplified to reg1 = 0

[xusheng6]

When we have some code like

xor edx, edx
jne 0x18

The LLIL simplifies the xor instruction to edx = 0, and the jne instruction is treated as opaque predicate and removed in higher level of ILs.

LLIL:

MLIL:

HLIL:

This works perfectly for the above example, however, I noticed that it does not work all of the time. See below for an example:

This is an opaque predicate as well and the left branch is fake. The code always executes the right branch.

LLIL:

MLIL:

HLIL:

While the semantics of the code is still correct and we can see it is still an opaque predicate, we should be able to simplify it automatically.

Database:

Offending binary:

keygenme4.exe.bndb.zip

Address: 0x416ed5

Simple case: xor_simple.bndb.zip