Open NeoQuix opened 1 year ago
Note: The problem was already fixed with #150 by fixing the ssa labels on global variables. Most likely the ssa labels on other variables have a problem as well.
There error is also in:
The functions are all the same, therefore the bin in touch should be enough.
Also in OslGetBootStatusData
in winload.exe
I guess this is a problem of expression propagation memory, but I am not sure. I try to explain where the problem comes from: Consider the following cfg (Before Expression Propagation Memory) In block 12, we have the phi-functions:
rpb#2 = Phi(rax_27#33, r10_1#2)
var_d0#3 = Phi(var_d0#2, var_d0#19)
Now, Expression propagation memory propagates the variable var_d0#4
into r10_1#2
(see cfg after expression propagation memory below):
The propagation of var_d0#4
into var_d0#5
in block 14 is okay, but I think we should not propagate into r10_1#2
because we "go over" the variable var_d0#19
. Since var_d0
is an aliased variable, I think we do not want to do this.
Now, the problem of propagating var_d0#4
into the phi-function of block 12 is that when we remove the phi-functions, the variables var_d0#3
and var_d0#4
interfere. In this case, it could probably be possible to sort the instruction in such a way that they do not interfere by first adding the instruction rbp#2 = var_d0#4
and then the instruction var_d0#3 = var_d0#19
.
(sample of Issue description)
fix in expression propagation, should be part of expression-propagation memory
Could be related to #245, TODO check after #245 is done (if noone does something on this issue earlier)
Does not get fixed with #245 and #390 resolved.
What happened?
How to reproduce?
Decompile mktime_internal in touch.zip
Affected Binary Ninja Version(s)
Version 3.3.3996