static-analysis-engineering / CodeHawk-Binary

CodeHawk Binary Analyzer for malware analysis and general reverse engineering
MIT License
21 stars 9 forks source link

Enhanced trampoline identification #138

Closed brk closed 4 months ago

brk commented 4 months ago

This produces the following lifting for spring target 4:

Lifted code for function 0x18a18
--------------------------------------------------------
void enqueue() {
  ? R2
  ? stackvar_44
  ? stackvar_12

  if ((front == 0xffffffff)) {
    R2 = &(front); // 0x18a2e, MOV
    front = 0; // 0x18a32, STR
  } // if 
  stackvar_44 = R2; // 0x2389c, PUSH
  if ((rear > 29)) {
    return;
  } // if 
  rear = (rear + 1); // 0x18a40, STR
  stackvar_12 = ((data[1] + (data[2] << 16)) << (data[0] + 8)); // 0x18a5e, STR
  rq_queue[(rear + 1)] = ((data[1] + (data[2] << 16)) << (data[0] + 8)); // 0x18a6e, STR
  return;
}

The conditional return looks good; I'm not sure about the treatment of R2.