Add the ability to toggle a function's '__pure' status

[SiD3W4y]

I have a weird behavior on a PSP Game (MIPS). A call that is present in the assembly, LLIL and MLIL view is absent from the HLIL view. This doesn't happen with all calls but only those jumping to a stub (trampoline) section. Which is correctly detected as code by binary ninja.

Assembly:

LLIL:

MLIL:

HLIL:

I can share the binary privately if needed.

[SiD3W4y]

The issue may be that the stub (import) is defined as a simple return.

[plafosse]

Yup this is a feature not a bug :) pure functions like this can be eliminated safely. Is there a reason that this could be considered unsafe In this binary?

[SiD3W4y]

In this binary the stubs (like sceIoOpen) are part of the dynamic linking process. At runtime they are patched and replaced by trampolines to other module functions. Here binary ninja is removing all the calls to these imports which is pretty troublesome for reverse-engineering.

Is there a way to prevent the optimization ?

[rssor]

A test case binary would be pretty useful here, especially if it’s a result of missing relocations that would give us an opportunity to skip the stub and directly point it towards an extern, since BinaryViews are generally responsible setting up a post-dynamic linker environment to help with analysis for pretty much the reasons seen here.

Could you send an example binary to the support email or to one of us on slack? (rss or peter)

I don’t think there’s currently a trivial way to prevent the optimization at the moment, but that’s certainly something worth adding.

[SiD3W4y]

Thank you, I sent the binary to @plafosse on Slack.

[rssor]

As a temporary workaround, does replacing the nop instruction with a random syscall instruction suppress the behavior?

[SiD3W4y]

Yes it does seem to prevent the optimization.

[plafosse]

To solve this issue we'll need to expose the ability to change a function's pure status, and perhaps add a setting which will not inline pure functions. I changed the title of this issue to reflect the potential solution.

[w1282]

Mentioning here for others that run into this issue before it can be toggled on a function-by-function basis, pure call elimination can be disabled across the entire binary by disabling analysis.hlil.pureCallElimination in settings