Skip to content

Ignore invalid instruction after jump/call for triggering guided analysis #7999

@fuzyll

Description

@fuzyll

What is the feature you'd like to have?
See title.

Is your feature request related to a problem?
When we encounter invalid instructions in a function, we enter Guided Analysis Mode (https://docs.binary.ninja/guide/guided_analysis.html). This helps both us and users in cases where there are things like obfuscated functions that will send analysis going off in directions it shouldn't.

Unfortunately, there's a common pattern used by some compilers for noreturn functions that also currently triggers it. It looks something like this, for RISC-V:

0009b7c4 e0 efe27175 jal t0, sub_ba71a
0009b7c8 e0 ef909158 jal ra, sub_b5550
0009b7cc e0 0000 ??
0009b7ce e0 c175 lui a1, -0x10000 {0xffff0000}
0009b7d0 e0 2246 lw a2, 0x8(sp) {var_d8}
0009b7d2 e0 f18d and a1, a1, a2

The 0000 "instruction" here is intended to trap in the event that something goes wrong and execution comes back from sub_b5550 (which it should not).

We should not enter guided analysis mode in these situations as it prevents analysis in a situation where it should continue.

Are any alternative solutions acceptable?
For the RISC-V case above, I've opened a PR (#7998) to address this by lifting 0000 as a trap instead. But, we should solve this more generally so that other architectures (and, particularly ones that might not be our official ones, but user plugins) are not also running into this.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions