search

Vector35 / binaryninja-api

Public API, examples, documentation and issues for Binary Ninja
https://binary.ninja/
MIT License
896 stars 200 forks source link

Linear Sweep need to be improved especially for Arm/Thumb #4245

Open joelreymont opened 1 year ago

joelreymont commented 1 year ago

Version and Platform (required):

Bug Description:

Please see attached screenshots.

Screenshots: Screenshot 2023-04-19 at 15 38 22 Screenshot 2023-04-19 at 15 39 07

joelreymont commented 1 year ago

This is not consistent as I have plenty of functions that were created and that start with CBZ.

plafosse commented 1 year ago

Linearsweep of ARM/Thumb2 code is a very trick problem. If you have a binary you can share we might be able to tweak our heuristics.

joelreymont commented 1 year ago

Will ping you on Slack.

On Wed, Apr 19, 2023 at 5:29 PM Peter LaFosse @.***> wrote:

Linearsweep of ARM/Thumb2 code is a very trick problem. If you have a binary you can share we might be able to tweak our heuristics.

— Reply to this email directly, view it on GitHub https://github.com/Vector35/binaryninja-api/issues/4245#issuecomment-1514840682, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAAESZZXUNKI5TEMKN4ZQOTXB7ZC5ANCNFSM6AAAAAAXEAM5Y4 . You are receiving this because you authored the thread.Message ID: @.***>

joelreymont commented 1 year ago

V35 should search for "Encourage Salesman Prompt Delay" to find the database.

joelreymont commented 1 year ago

Here's another example...

This 

000c6218                                                                          78                                               x
000c6219  data_c6219:
000c6219                                                                             b1 6a b1                                       .j.

000c621c  int32_t sub_c621c(int32_t* arg1, int32_t arg2, void* arg3)

000c621c  2429       cmp     r1, #0x24
000c621e  0bd1       bne     #0xc6238

000c6220  02f10801   add     r1, r2, #8
000c6224  02f12c03   add     r3, r2, #0x2c

000c6228  51f8042b   ldr     r2, [r1], #4
000c622c  9942       cmp     r1, r3
000c622e  40f8042b   str     r2, [r0], #4
000c6232  f9d1       bne     #0xc6228

000c6234  2420       movs    r0, #0x24
000c6236  7047       bx      lr

000c6238  0020       movs    r0, #0
000c623a  7047       bx      lr

should really be this

000c6218  void sub_c6218(int32_t* arg1, int32_t arg2, void* arg3)

000c6218  78b1       cbz     r0, #0xc623a

000c621a  6ab1       cbz     r2, #0xc6238

000c621c  2429       cmp     r1, #0x24
000c621e  0bd1       bne     #0xc6238
...