how to edit function's control flow graph? #4577
-
I'm dealing with confusion about control flow flattening, how do I modify the function's cfg to rebuild the control flow after I've extracted the order between basic blocks? |
Beta Was this translation helpful? Give feedback.
Replies: 2 comments
-
I migrated this to a discussion. For general questions as opposed to specific bugs or feature requests, please use discussions instead of issues. You have several options. The first and simplest is to do what the OPP plugin does. It merely patches the branches appropriately. Note that we recommend making all of your changes once and then triggering analysis at the end instead of doing it once at a time. Next, you could use a workflow. Workflow APIs allow you to rewrite ILs in many ways and don't require patching the native bytes in the BV. This is more of a pain because workflows aren't suited to Python but they can allow far more power for modifying the ILs. Here are some examples: docs: https://docs.binary.ninja/dev/workflows.html Finally, another option is to leverage the UIDF which allows forcing values to be interpreted as a specific value or set of values which can be used to prune branches so they are eliminated at higher ILs: |
Beta Was this translation helpful? Give feedback.
-
We are also evaluating an alternative way to alter the control flow without patching the code: #4428. In other words, it avoids the need to patch the code, and it would be easier to use than a workflow. However, we are still considering whether this is the correct route to go, so it is unlikely that this gets implemented soon. Please feel free to respond to #4428 and let us know what you think. |
Beta Was this translation helpful? Give feedback.
I migrated this to a discussion. For general questions as opposed to specific bugs or feature requests, please use discussions instead of issues.
You have several options.
The first and simplest is to do what the OPP plugin does. It merely patches the branches appropriately. Note that we recommend making all of your changes once and then triggering analysis at the end instead of doing it once at a time.
https://github.com/Vector35/OpaquePredicatePatcher
https://binary.ninja/2017/10/01/automated-opaque-predicate-removal.html
Next, you could use a workflow. Workflow APIs allow you to rewrite ILs in many ways and don't require patching the native bytes in the BV. This is more of a pain becau…