Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ghidra failed to identify the function when analyzing files for the MIPS:BE:32 architecture #4675

Open
nocbtm opened this issue Oct 18, 2022 · 3 comments
Assignees
Labels
Status: Triage Information is being gathered

Comments

@nocbtm
Copy link

nocbtm commented Oct 18, 2022

When ghidra analyzed the file of MIPS:BE:32 architecture, the function recognized the error and expected FUN_00402120 to be changed to system.
image
Like the files for the MIPS:LE:32 architecture
image

@nocbtm
Copy link
Author

nocbtm commented Oct 18, 2022

The sample files
boa_fie.zip

@ryanmkurtz ryanmkurtz added the Status: Triage Information is being gathered label Oct 18, 2022
@Tim---
Copy link
Contributor

Tim--- commented Oct 19, 2022

There is something weird in the first screenshot with the delay slots.

The second one looks correct: addiu is located after jr, so it will be executed in the delay slot of jr.

However it the first example, addiu is before jr. So the lui instruction of the next function will be executed in the delay slot of jr. This could explain why the function is not "thunked" ; it is not just a call to "system". Also, it seems to mess up the function analysis a lot, since it adds a "call return override" on the lui instruction.

I guess it's a "bug" in the compiler for the plt/got generation, since the rest of the functions looks normal.

@emteere
Copy link
Contributor

emteere commented Oct 27, 2022

It does appear to be a bug in the compiler generating the .plt code.
The code might actually execute, however as @Tim--- mentions the function below the jr to system has it's first instruction as part of the delayslot of the previous functions final jr instruction.

Ghidra doesn't currently support branching into the delay-slot, so it messes with analysis a bit, including turning the first instruction of the following function into a call/return. Which it is, but as the first instruction of the next function it isn't.

The shared return analyzer might be able to put the flow override on the jr, but the API might actually force it on the delay-slotted instruction.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Status: Triage Information is being gathered
Projects
None yet
Development

No branches or pull requests

4 participants