JonathanSalwan / Triton

Triton is a dynamic binary analysis library. Build your own program analysis tools, automate your reverse engineering, perform software verification or just emulate code.
https://triton-library.github.io
Apache License 2.0
3.4k stars 524 forks source link

Incorrect basic block simplification after "verw" instruction #1240

Closed Z4ee closed 1 year ago

Z4ee commented 1 year ago

Description of the issue:

When using Triton to disassemble and simplify a basic block containing a verw instruction, the subsequent instructions are ignored and removed from the simplified block. This can lead to incorrect semantics for the simplified block of code.

Steps to reproduce:

Here is an example code demonstrating the issue:

triton::Context ctx;
ctx.setArchitecture(ARCH_X86_64);

BasicBlock block;

block.add(Instruction("\x50", 1)); // push rax
block.add(Instruction("\x0F\x00\xEB", 3)); // verw bx
block.add(Instruction("\xC3", 1)); // ret

ctx.disassembly(block);

cout << "[Original basic block] -----------------------------------------------" << endl;

cout << block << endl;

cout << "[End of original basic block] ----------------------------------------" << endl << endl;

block = ctx.simplify(block);
ctx.disassembly(block);

cout << "[Simplified basic block] ---------------------------------------------" << endl;

cout << block << endl;

cout << "[End of simplified basic block] --------------------------------------" << endl;

return 0;

Expected result:

The simplified basic block is expected to contain all instructions, possibly with modified semantics if that is in accordance with Triton's analysis.

Actual result:

After simplifying the basic block containing a verw instruction, the subsequent instructions are ignored and removed, leaving only the instruction before verw:

[Simplified basic block] ---------------------------------------------
0x0: push rax
[End of simplified basic block] --------------------------------------
JonathanSalwan commented 1 year ago

This is because the verw and verr are not supported. If we add them, it should fix this issue.

cnheitman commented 1 year ago

Commit 20393f5e021de9481121b3cd71662e0111ad57b1 add supports for verr and verw. It should fix this issue.