binaryninja-api icon indicating copy to clipboard operation
binaryninja-api copied to clipboard

Stack Cookie Code Should Be Able To Hidden In Decompiler

Open op2786 opened this issue 3 years ago • 1 comments

If we reverse engineered a PE that have stack cookie protection, some functions have a code fragment that belongs to stack cookie protection like this in the beginning of the function:

18000168e      void var_248
18000168e      int64_t rax_1 = data_180023000 ^ &var_248

And of course there is another code fragment that calls to __security_check_cookie function at the bottom of the function.

I guess that code fragments making decompiler output a little bit dirty. Most of the time we don't care about that code fragment. It would be nice to have an option to hide them.

op2786 avatar Jul 19 '22 15:07 op2786

This has been discussed and is absolutely on the plan for the current stable release. I think there's another issue tracking it but in the meantime I'll take this and if we find the other issue it's a duplicate of we'll clear it up later.

psifertex avatar Jul 19 '22 15:07 psifertex