toor-de-force / ghidrall Goto Github PK

For example, in this CBRANCH op, the address 0x80511a1 is referred to but there is no block with that label:

CBRANCH


0x80511a1
code
1


register0x00000206
bool
1

The following are good testsets to expand the support for:

https://samate.nist.gov/SARD/testsuite.php
https://github.com/trailofbits/cb-multios
https://github.com/llvm/llvm-test-suite

The following test cases are commented out in run-tests.py: seq_call_five, seq_call_four, seq_call_one, seq_call_three, seq_call_two, inter_rv, condcall_two. They all have a common theme of having a function with a return 1-liner and the result not being present in the xml files emitted, so the lifting fails.

I tried it with the following binary:
https://ece.uwaterloo.ca/~agurfink/secret.bin

Register types are sometimes allocated twice

fix by setting both operands to larger type

As it stands R2 recovers arrays as individual arrays. We want to test 3 options:

• Represent stack variables a single struct with variables within it.
• Represent stack variables as a single memory allocation and byte addressable.
• Represent stack variables as a single memory allocation and word addressable.

Give Ghidrall debug flags to optionally emit intermediate files.

The binary 3D_Image_Toolkit has this problem in the function 'sym.cgc_init_freelist'