Skip to content

backward slicing error in arm64 binary #1408

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
riusksk opened this issue May 15, 2025 · 0 comments
Open

backward slicing error in arm64 binary #1408

riusksk opened this issue May 15, 2025 · 0 comments

Comments

@riusksk
Copy link

riusksk commented May 15, 2025

from __future__ import print_function
from triton     import *

import sys


function = {
    0x3ADFC8: b"\xFE\x07\xC1\xDA",      # PACIB           X30, SP
    0x3ADFCC: b"\xFF\x43\x01\xD1",      # SUB             SP, SP, #0x50
    0x3ADFD0: b"\xFD\x7B\x02\xA9",      # STP             X29, X30, [SP,#0x40+var_20]
    0x3ADFD4: b"\xF5\x1B\x00\xF9",      # STR             X21, [SP,#0x40+var_10]
    0x3ADFD8: b"\xF4\x4F\x04\xA9",      # STP             X20, X19, [SP,#0x40+var_s0]
    0x3ADFDC: b"\xFD\x83\x00\x91",      # ADD             X29, SP, #0x20
    0x3ADFE0: b"\xFF\x7F\x01\xA9",      # STP             XZR, XZR, [SP,#0x40+holder.section]
    0x3ADFE4: b"\xFF\x07\x00\xF9",      # STR             XZR, [SP,#0x40+holder]
    0x3ADFE8: b"\x00\x01\x00\xB5",      # CBNZ            X0, loc_3AE008
    0x3ADFEC: b"\xF4\x03\x1F\x2A",      # MOV             W20, WZR
    0x3ADFF0: b"\xE0\x03\x14\x2A",      # MOV             W0, W20
    0x3ADFF4: b"\xF5\x1B\x40\xF9",      # LDR             X21, [SP,#0x40+var_10]
    0x3ADFF8: b"\xF4\x4F\x44\xA9",      # LDP             X20, X19, [SP,#0x40+var_s0]
    0x3ADFFC: b"\xFD\x7B\x42\xA9",      # LDP             X29, X30, [SP,#0x40+var_20]
    0x3AE000: b"\xFF\x43\x01\x91",      # ADD             SP, SP, #0x50 
    0x3AE004: b"\xFF\x0F\x5F\xD6",      # RETAB
    0x3AE008: b"\x08\x00\x40\xF9",      # LDR             X8, [X0]
    0x3AE00C: b"\x08\x1D\x40\xB9",      # LDR             W8, [X8,#0x1C] 
}



if __name__ == '__main__':
    # Triton context
    ctx = TritonContext()

    # Set the architecture
    ctx.setArchitecture(ARCH.AARCH64)

    # Symbolic optimization
    ctx.setMode(MODE.ALIGNED_MEMORY, True)

    # Define the Python syntax
    ctx.setAstRepresentationMode(AST_REPRESENTATION.PYTHON)

    # Define entry point
    pc = 0x3ADFC8


    # Let's emulate the function
    for pc in function:
        # Build an instruction
        inst = Instruction()

        # Setup opcode
        inst.setOpcode(function[pc])

        # Setup Address
        inst.setAddress(pc)

        # Process the instruction
        ctx.processing(inst)
        #print(inst)

        # Spread the instruction address and its disassembly into its symbolic
        # expressions. Used to refer an instruction to its expressions. Will
        # be useful to understand the slicing part.
        for se in inst.getSymbolicExpressions():
            se.setComment(str(inst))

        reg_obj = ctx.getRegister('X8')

        # Let's slice (backward) the rcx expression at 0x4005ae
        if pc == 0x3AE00C:
            x8Expr = ctx.getSymbolicRegister(reg_obj)
            slicing = ctx.sliceExpressions(x8Expr)
            # Sort the slicing and display all expressions with their comments
            for k, v in sorted(slicing.items()):
                # Here we display the comment to understand the correspondence
                # between an expression and its referenced instruction.
                print('[slicing]', v.getComment())
            break

    sys.exit(0)

After execution, the following result is output:

[slicing] 0x3ae00c: ldr w8, [x8, #0x1c]

The correct result should be:

[slicing] 0x3ae008: ldr x8, [x0]
[slicing] 0x3ae00c: ldr w8, [x8, #0x1c]

Question: Is the issue with my code, or does Triton have bugs in analyzing ARM64 programs?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant