Skip to content

Fix outofssa algorithm: lost update in insert_parallel_copy and insructions after conditional jmp - #1521

Open
Explosiontime202 wants to merge 3 commits into
cea-sec:masterfrom
Explosiontime202:master
Open

Explosiontime202 wants to merge 3 commits into
cea-sec:masterfrom
Explosiontime202:master

Conversation

@Explosiontime202

@Explosiontime202 Explosiontime202 commented Mar 14, 2026 •

Copy link
Copy Markdown
Contributor

I have noticed that for certain larger IRCFGs the UnSSADiGraph produced an invalid output. This is caused by insert_parallel_copy in certain constellations as it would add parallel copies to the end of a IRBlock in one loop iteration and then in a later one add parallel copies to the start of the same IRBlock. But as the iteration is over the IRBlocks itself, the first update was lost.

Secondly, I noticed that the code produces the following sequence of instructions at the end of a basic block:

IRDst = A?(loc_1, loc_2)
C = D

As i would interpret the IRDst assignment as a jump, this seems not correct. Please correct me there if the semantics of the IRDst assignments differ from my assumptions.
As mentioned in the paper this algorithm stems from, if we need to insert parallel copies before the conditional jump instructions, we need to check for interference with the condition computation. As for a quick fix, this is currently done with an assert, which is less than ideal. But I don't know how to implement that interference check into the given algorithm.

@serpilliere

Copy link
Copy Markdown
Contributor

Hi @Explosiontime202 !

The assignment of IRDst is here "only an assignment". Here are the rules:

  • every irblock has exactly one assignment to IRDst
  • the assignment can be anywhere in the irblock

So you can have other assignments later in the irblock: this is legit.

For the first point, have you a little example to show the faulty behavior?

@Explosiontime202

Copy link
Copy Markdown
Contributor Author

Thanks for your quick answer :)
Then I am going to revert the change regarding the IRDst assignment and manage ensure that invariant in another way (because I need that for my stuff to work correctly :) )

Regarding an example: I have an example which triggers this, but it is quite lengthy. I put it below, but I am now sure, how it is helpful to you. The difference in the example is in loc_1c9b0f where R11.6 = R11.54 is missing.
I think that the explanation is easier to understand: In one iteration inside the insert_parallel_copy, a copy is added to a IRBlock and the block is added to the IRCFG. In an iteration following it, another copy is inserted into the same block (for example because it is the parent of another block). But the copy is added to the old version of the block, which is then added to the IRCFG and thereby loosing the previous copy instruction.

Before OutOfSSA:
example_bug_before

After correct OutOfSSA:
example_bug_after

After buggy OutOfSSA:
example_bug_after_buggy

here is also a diff between the .dot files (left fixed vs. right buggy): https://www.diffchecker.com/39K40dRm/
(this still includes my patch to move the assignments before IRDst assignments)

Comment thread miasm/analysis/outofssa.py Resolved
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants