Semantics of SSA do not model the binary logic
Hello! The ircfg_to_ssa transformation isn't numbering my variables correctly. In, `loc_fffff8022ed3962a`, I have a statement (1) `RAX.0=RAX+0xFFFFFFFFF4E120DA` which is eventually used to resolve the next jump. This makes no sense to me. Even if I was able to solve the opaque predicates in my graph (provided below), i would end with the statements: `RAX.1=RAX.0`, `RAX.0=RAX+0xFFFFFFFFF4E120DA`. Through expression propagation, we get statement (2): `RAX.1=RAX + 0xFFFFFFFFF4E120DA` which is used to find the next block. But, I am unable to solve this statement since RAX is unknown. In the real binary, the `RAX` in statement (2) is replaced by `0xFFFFF80239D83800`, but, this value is assigned `RAX.1=0xFFFFF80239D83800` in `loc_fffff8022e0e7ce9`. So I am unable to propagate it and solve the jump.
I'm trying to understand why this is happening and how I can fix it to find the correct destination.

3 条评论