Tailjmps to reloc targets are decompiled until infinity
dmknght opened this issue · comments
Linux Kernel Modules has no ret
in functions. Rizin is able to detect them. However, the decompiler failed to parse data of each function, causing very long function in decompiler widget which is totally wrong, or causing decompile time out
Step to reprocedure (with cutter)
- Open kernel module (
soundcore.ko
in this very case) - Show the function
sym.register_sound_dsp
- See the wrong output in decompiler widget
Screenshots
The function sym.register_sound_special
is even worse
Click on the .text.unlikely
makes Decompiler shows totally wrong function from function name
The output is the same in rizin
-> the problem is the plugin ghidra
And other issue relates to #229. sym.register_sound_dsp
showed function __fentry__
is called. However, Decompiler widget failed to show function name.
Tested binary
issue312_ghidra_failed_to_detect_functions.zip
Function names from reloc targets work now.
The __x86_return_thunk is handled in ghidra because it applies a flow override to the respective jmp instructions:
There are ways to address this in rizin/rz-ghidra too, but currently none that is trivial or straightforward. As a quick and dirty workaround for this bin, you can do e io.cache=1; wa ret @ reloc.target.__x86_return_thunk
Hello! This method worked for me. Hope it will be fixed by default soon.