search

junxzm1990 / x86-sok

124 stars 20 forks source link

isFallThrough function seems incorrect #13

Open thaddywu opened 2 years ago

thaddywu commented 2 years ago

Hi~Happy Chinese Mid-Autumn Festival! SOK sometimes recursively disassembles data bytes and even never terminates. I think isFallThrough is responsible for it. When isFallThrough considers instructions of CALL nonreturn-function as fall-through, it may go into data parts to disassemble them (see here)!

bin2415 commented 2 years ago

Hello, Happy festival! The identification of nonreturn functions is too simple(it only checks some instructions) in recursive disassembly and it may leads to false positives when disassembling data bytes.

We could enhance it by identifying the nonreturn functions following the idea of bap or dyninst.

Thanks!

thaddywu commented 2 years ago

Thanks for your reply! You're right. Definitely, fine-grained methods could be taken to improve the results. But sure, there's some workload on the implementation side. If we wanna do some simple modification on existing codes, it seems better to take CALL functions as non-fallthrough by default rather than fall-through, in that disassembling data bytes do incur fatal errors. In this case, we'd better adopt a conservative way. We could at least avoid fatal errors this way (though we get false negatives).