[CSE] Adjust tresholds for elimination

[fnhartmann]

Proposal

See the following example: example.zip

Dewolf is currently creating the following code:

int main(int argc, char ** argv, char ** envp) {
    unsigned long var_1;
    long i;
    long var_0;
    void * var_3;
    __builtin_strcpy(/* dest */ &var_0, /* src */ "This is an example.");
    var_1 = strlen(&var_0);
    for (i = 0L; i < var_1; i++) {
        var_3 = &var_0 + i;
        if ((int)*var_3 != 32) {
            *var_3 = *var_3 ^ ' ';
        }
        printf(/* format */ "%c", (unsigned int)(int)*(&var_0 + i));
    }
    return 0;
}

The array access will be replaced by a temp variable through the Common Subexpression Elimination. This makes the code less legible.

If we would skip the stage, the for-loop would look like the following:

    for (i = 0L; i < var_1; i++) {
        if ((int)*(&var_0 + i) != 32) {
            *(&var_0 + i) = *(&var_0 + i) ^ ' ';
        }
        printf(/* format */ "%c", (unsigned int)(int)*(&var_0 + i));
    }

This should be the preferred variant.

Used Binary Ninja version: 3.5.4526

Approach

The CSE should be skipped for those expressions.

There could be several options to get this done:

• exclude expressions with array access in CSE stage
• run array access stage before CSE (the array has to be correct detected for that)
• adjust the threshold value of expression complexity in CSE stage
• fine-tune the calculation of the expression complexity
• ...

Other approaches can be possible.

The best option should be evaluated, tested and implemented.