Different CFG determination

google / binexport

Export disassemblies into Protocol Buffers

Apache License 2.0

1.03k stars 197 forks source link

Different CFG determination #116

Open wideglide opened 1 year ago

wideglide commented 1 year ago

Any ideas on why I would be getting different generation for the control flow graph of these two functions? These are from two versions of busybox, exported with IDA 8.3 and the f9409a7 commit. I'm not sure where to begin to look for the apparent non-determinism? I haven't reviewed IDA's representation, but I thought BinDiff computed its own control flow.

Here's a second discrepancy from the same diff as well.

cblichmann commented 1 year ago

That indeed looks somewhat surprising. However, BinExport still relies on IDA's representation. In AnalyzeFlow(), we simply follow its internal representation and do some fix-ups. So if IDA has spurious basic blocks, BinExport will have them as well.