xAnalyzer icon indicating copy to clipboard operation
xAnalyzer copied to clipboard

Incorrect loop detection for a section with an non-conditional jump inside it

Open justanotheranonymoususer opened this issue 9 years ago • 6 comments

An example: screenshot

Actually I got second thoughts on this one. What is the "loop" definition?

ThunderCls avatar Dec 15 '16 17:12 ThunderCls

Let me try...

A loop in an assembly listing is a block of code which runs repeatedly multiple times, until a condition is met.

Now, this is a loop in terms of the definition:

@label:
    dec ecx
    test ecx, ecx
    jnz @label

This isn't:

@label:
  > dec ecx
    jmp @far_away_1
  > inc ecx
    jmp @far_away_2
  > xor ecx, ecx
    jmp @label

(> means that an x-ref exists)

Ok, then by the definition of loop...would this be incorrect?

@label:
  > cmp dword [eax + 5], ecx
    jne @label2
  > inc edx
    jmp @far_away_2
@label2:
  > inc ecx
    jmp @label

ThunderCls avatar Dec 16 '16 15:12 ThunderCls

By the definition, it isn't a loop. The commands 1, 2, 5, 6 are a loop, but it's not a contiguous block. Whether the whole block should be marked is a tricky question. What if the number of commands which are not part of the loop is very large? The mark would mis-inform. Perhaps a good solution would be to have the line next to the commands which are not actually part of the loop grayed out. Like this:

image

Ok, I see your point @justanotheranonymoususer, unfortunately x64dbg doesnt´t allow that kind of grayed out lines, besides that, making a more complex loops detection algo is not something I got much interest on making right now, anyways PRs are open if you would like to contribute in this matter or any other feature or improvement, anything is well received. Thanks

ThunderCls avatar Dec 16 '16 21:12 ThunderCls

Well, this is the ideal option, and I understand that it's not trivial. The original request was just to not mark code which doesn't contain loops at all. Like this one:

@label:
  > dec ecx
    jmp @far_away_1
  > inc ecx
    jmp @far_away_2
  > xor ecx, ecx
    jmp @label

In any case, thank you for the plugin, it already is awesome and very helpful!