Real-world deoptimization cases in binaries

[mahaloz]

Overview

This issue lists a few examples of binaries and functions that have had optimizations applied on them. These opts are documented in the SAILR paper into three categories:

• Irreducible Statement Duplication: opts that duplicate code
• Irreducible Statement Condensing: opts that turn ncode statements into less statements
• Misc: currently on Switch Lowering (converts switches into bad ifs)

The attached binaries and source are from Coreutils 9.1 and have been compiled with GCC 9 on optimization level O2, with inlining disabled. Each case below is shown as binary_name: function_name. Some cases come with a testcase to see what they should look like. In every case below, the SAILR version of angr should produce better results than IDA Pro 8.0. The best way to understand what happened in each of these cases is to take look at the corresponding source file to the function.

Cases

ISD Opts

• sort.o: zaptemp
• fmt.o: main
• cksum_digest.o: split_3
• nohup.o: main

ISC Opts

• test.o: binop
• tsort.o: search_item
• tail.o: tail_bytes
• chcon.o: process_file
• stty.o: recover_mode

Misc Opts (Switch Lowering)

• cksum-digest.o: filename_unescape
• cksum-digest.o: print_filename
• stat.o: human_fstype

Binaries and Source

Both are attached here:
coreutils_src_and_bin.tar.gz

In this directory, you will also find angr_sailr_*, ida_* and ghidra_*, which is the associated decompilation for each of those files :).