Vector35 / binaryninja-api

Public API, examples, documentation and issues for Binary Ninja
https://binary.ninja/
MIT License
849 stars 194 forks source link

add setting to disable HLIL pure call elimination #3477

Closed elbiazo closed 1 year ago

elbiazo commented 1 year ago

What is the feature you'd like to have? Please provide a clear and concise description of what you want. I have love and hate relationship with binaryninja HLIL. On one had, I love reversing in binja because it folds a lot of corner cases. In other hand whenever I am trying to find bug, it is good to not optimize too much because I want to see as code as close as source code much as possible. (Think of memory on stack that never gets touched but if you overflow it you might get into some different state). Also, sometimes it really does fold it too aggressively and I have missed entire section of code while reversing.

Current strategy bunch of use that use binja full time is to have MLIL and HLIL side by side when we are looking for something interesting. Some only stick to MLIL since it is most consistent. Even when writing analysis tool, most people stick with MLIL ssa form.

Is your feature request related to a problem? If applicable, please provide a clear and concise description of what the problem is.

Problem is when I am trying to scope out really big code, it is really hard to trust HLIL because it feels like it saves me a lot of time sometimes but really wastes a lot of time as much.

Conclusion

I wish there is a way to maybe set optimization level. Here is really bad and simple example.

I have code `#include void flow(int a , int b) { int x = a + b; int y = a * b; while(y > a + b) { a = a + 1; x = a + b; } }

int main() { int a = 0; int b = 0; flow(a, b);

return 0;

}`

In binja it would look like this in HLIL image

IN MLIL image

Although that example makes no sense and indeed it should optimize out that function, I would still like to see it. It would be cool if we can fold trival stuff but maybe not fold control flow code. Not sure how that would look like but I think end goal is to have HLIL optimize 0 and HLIL optimize 3 side by side for even faster reversing.

psifertex commented 1 year ago

resolved in builds >= 3712

New setting is analysis.hlil.pureCallElimination (enabled by default, disabling it gets you what you're looking for)