search

Vector35 / binaryninja-api

Public API, examples, documentation and issues for Binary Ninja
https://binary.ninja/
MIT License
897 stars 200 forks source link

Dataflow for stack-based languages #1008

Open joshwatson opened 6 years ago

joshwatson commented 6 years ago

Dataflow breaks when lifting a stack based language like EVM bytecode. This creates issues with control flow recovery.

image

plafosse commented 5 years ago

We do support tracking dataflow through stack variables this seems like there is a bug. Do you have a more simple test case for this?

joshwatson commented 5 years ago

Any control flow that results in the stack pointer being assigned a phi function will result in dataflow becoming undetermined for the rest of the function

CouleeApps commented 3 years ago

^^ if the stack pointer is assigned the result of a phi whose operands are mergeable, variable creation will not be affected. The issue is when the operands of the phi are incompatible (eg two different stack offsets). 2.4.2902-dev adds tags to notify when this is detected and annotations to debug stack pointer values while lifting. Hopefully that should help with lifting architectures like EVM and show where a missing/incorrectly lifted instructions cause the stack pointer to diverge. If EVM encourages the use of diverging stack pointer values like that, then we will need additional dataflow improvements.