Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Mark non-returning Go runtime functions #6

Open
recvfrom opened this issue Mar 23, 2018 · 2 comments
Open

Mark non-returning Go runtime functions #6

recvfrom opened this issue Mar 23, 2018 · 2 comments

Comments

@recvfrom
Copy link
Contributor

Feature request:

For Go runtime functions that don't return (Ex: panic) it looks like the compiler inserts an illegal instruction after the call as a sanity checking mechanism in case the function did return. This stackexchange post has more details:

https://reverseengineering.stackexchange.com/questions/17665/undefined-instruction-in-go-binary-compiled-for-arm

In the case of ARM binaries, these instructions cause function creation in IDA Pro to fail with the following error message: The function has undefined instruction/data at the specified address. (and the address referenced is that of the 0xF7FABCFD instruction.)

Talking with IDA Pro support, the solution is to mark the non-returning function as such in IDA. IDA will stop looking for instructions after this function call, and function creation will succeed.

I'm not sure of the best way to implement this, but one approach would be to search for the undefined instruction for each architecture, look for a function call right above that, and mark that function as non-returning (maybe with some sanity checks.) I'll aim to implement this approach when I have a chance, and will submit a pull request once finished.

@grokeus
Copy link
Collaborator

grokeus commented Apr 16, 2018

I think we can use this approach to find place where we fail and check if we got bad instruction:
https://reverseengineering.stackexchange.com/questions/13884/how-to-get-address-where-makefunction-failed-in-ida-pro

smth like that:

pfn = ida_funcs.func_t()
pfn.start_ea = addr
ida_funcs.find_func_bounds(pfn, ida_funcs.FIND_FUNC_NORMAL)
pfn.endEA - in my test binary I get addr of 0xf7fabcfd

@recvfrom
Copy link
Contributor Author

Should there be a new button in the UI for this, or should it just be part of the 'Rename functions' functionality?

FYI, here is an ARM sample:

https://detux.org/report.php?sha256=8d9dd4f611e7d66769f44877b95f4b387c093bc58d701b1695e2b75fc5ce178b

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants