NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
51.28k stars 5.84k forks source link

How to distinguish if the condition of cbranch is flipped. #5279

Closed hiro4bbh closed 1 year ago

hiro4bbh commented 1 year ago

I use Ghidra C++ decompiler component only, so I interpret the encoded result of the decompilation.

Cbranch is tricky. Its condition seems to be flipped if op->isBooleanFlip()^op->isFallthruTrue() is satisfied.

https://github.com/NationalSecurityAgency/ghidra/blob/80ccdadeba79cd42fb0b85796b55952e0f79f323/Ghidra/Features/Decompiler/src/decompile/cpp/typeop.cc#L545-L556

However, the values of isBooleanFlip and isFallthruTrue seem to not be encoded.

https://github.com/NationalSecurityAgency/ghidra/blob/80ccdadeba79cd42fb0b85796b55952e0f79f323/Ghidra/Features/Decompiler/src/decompile/cpp/op.cc#L395

Is there any way to distinguish this condition flip from the encoded result? The syntax of cbranch is underspecified (Refer: https://spinsel.dev/assets/2020-06-17-ghidra-brainfuck-processor-1/ghidra_docs/language_spec/html/pcodedescription.html), so I cannot figure out how to handle cbranch correctly.

Entirely, I wonder why the encoder drops many additional information (e.g. many part of PcodeOp flags and use-def relations between variables, etc.). I think the Java frontend/engine uses the C++ component via IPC transferring this encoded commands and results. Please tell me if you know how to handle these additional information in Java implementation.

hiro4bbh commented 1 year ago

Is this is hint?

https://github.com/NationalSecurityAgency/ghidra/blob/80ccdadeba79cd42fb0b85796b55952e0f79f323/Ghidra/Features/Decompiler/src/decompile/cpp/blockaction.cc#L1383

properif is (maybe) negated, however, ifelse is not negated.

https://github.com/NationalSecurityAgency/ghidra/blob/80ccdadeba79cd42fb0b85796b55952e0f79f323/Ghidra/Features/Decompiler/src/decompile/cpp/blockaction.cc#L1398

How about whiledo?

https://github.com/NationalSecurityAgency/ghidra/blob/80ccdadeba79cd42fb0b85796b55952e0f79f323/Ghidra/Features/Decompiler/src/decompile/cpp/blockaction.cc#L1522