-
Notifications
You must be signed in to change notification settings - Fork 274
Description
What is the feature you'd like to have?
See title.
Is your feature request related to a problem?
When we encounter invalid instructions in a function, we enter Guided Analysis Mode (https://docs.binary.ninja/guide/guided_analysis.html). This helps both us and users in cases where there are things like obfuscated functions that will send analysis going off in directions it shouldn't.
Unfortunately, there's a common pattern used by some compilers for noreturn functions that also currently triggers it. It looks something like this, for RISC-V:
0009b7c4 e0 efe27175 jal t0, sub_ba71a
0009b7c8 e0 ef909158 jal ra, sub_b5550
0009b7cc e0 0000 ??
0009b7ce e0 c175 lui a1, -0x10000 {0xffff0000}
0009b7d0 e0 2246 lw a2, 0x8(sp) {var_d8}
0009b7d2 e0 f18d and a1, a1, a2
The 0000 "instruction" here is intended to trap in the event that something goes wrong and execution comes back from sub_b5550 (which it should not).
We should not enter guided analysis mode in these situations as it prevents analysis in a situation where it should continue.
Are any alternative solutions acceptable?
For the RISC-V case above, I've opened a PR (#7998) to address this by lifting 0000 as a trap instead. But, we should solve this more generally so that other architectures (and, particularly ones that might not be our official ones, but user plugins) are not also running into this.