NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
51.96k stars 5.9k forks source link

non-compliant decompiler #1289

Open spein46 opened 4 years ago

spein46 commented 4 years ago

Hi. I ve little problem with ghidra, works bad in one function, I ve in DIsplay listening this instruction: jalr t9=>memset

but decompiler decompile this like: (*(code *)(local_b38 + -0x70c8))(&local_900,0,0x34)

in other function same instruction is decompiled well, so I get

memset(param1, param2, param3)

I tried to re-create function, clear bytes and decompile function, re-analyze, nothing

cmccord-dev commented 4 years ago

I'm actually having the same problem, most of the decompiler output isn't useful but the disassembler manages to find the right functions and data pointers. I can post more info and maybe try to isolate an example if necessary.

cmccord-dev commented 4 years ago

Okay it seems some functions have two entry points. One of them sets up the $gp register and then flows into the second. I assume this is an optimization by the compiler (an old ido mips compiler) for functions that share the same $gp register. manually setting the gp register for the second entry fixes its output.

spein46 commented 4 years ago

lw t9,-0x70c8(gp)=>->memset ...... jalr t9=>memset in one function decompiler, decompile this instruction flow well, so memset(param1, param2, param3 in other function with identical disassemble instrucion, decompiler: (**(code **)(local_b38 + -0x70c8))(&local_900,0,0x34) because lw instruction with gp register in disassembler in both function is the same, with pointer to memset function. Should I edit gp register?I didn 't understand how I can fix this behavior thanks

cmccord-dev commented 4 years ago

The decompiler seems to have trouble remembering the gp when it gets spilled to the stack before a function call.

spein46 commented 4 years ago

this is the weird behavior

Screenshot 2019-11-28 at 02 11 27

idea about it? I think the issue is in decompiler, something goes wrong, but I don t know how fix it I think trigger of issue could

69778982-c1176280-11a6-11ea-8403-afb050c8fdfa

be that: