New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add the ability to toggle a function's '__pure' status #1712
Comments
Yup this is a feature not a bug :) pure functions like this can be eliminated safely. Is there a reason that this could be considered unsafe In this binary? |
In this binary the stubs (like sceIoOpen) are part of the dynamic linking process. At runtime they are patched and replaced by trampolines to other module functions. Here binary ninja is removing all the calls to these imports which is pretty troublesome for reverse-engineering. Is there a way to prevent the optimization ? |
A test case binary would be pretty useful here, especially if it’s a result of missing relocations that would give us an opportunity to skip the stub and directly point it towards an extern, since BinaryViews are generally responsible setting up a post-dynamic linker environment to help with analysis for pretty much the reasons seen here. Could you send an example binary to the support email or to one of us on slack? (rss or peter) I don’t think there’s currently a trivial way to prevent the optimization at the moment, but that’s certainly something worth adding. |
Thank you, I sent the binary to @plafosse on Slack. |
As a temporary workaround, does replacing the nop instruction with a random syscall instruction suppress the behavior? |
Yes it does seem to prevent the optimization. |
To solve this issue we'll need to expose the ability to change a function's pure status, and perhaps add a setting which will not inline pure functions. I changed the title of this issue to reflect the potential solution. |
Mentioning here for others that run into this issue before it can be toggled on a function-by-function basis, pure call elimination can be disabled across the entire binary by disabling |
This is now done in 3.5.4377-dev via the |
I have a weird behavior on a PSP Game (MIPS). A call that is present in the assembly, LLIL and MLIL view is absent from the HLIL view. This doesn't happen with all calls but only those jumping to a stub (trampoline) section. Which is correctly detected as code by binary ninja.
Assembly:
LLIL:
MLIL:
HLIL:
I can share the binary privately if needed.
The text was updated successfully, but these errors were encountered: