How to Properly Handle Local Aliases for Globals

[utkonos]

This is an array of positions for global variables:

The first 20 are primarily used as variables and registers in NSIS's virtual machine in exec.c, but unfortunately, some are aliased for temporary use in functions outside of the virtual machine functions. Using an array in the .ndata section results in disassembly and ILs that are challenging to read. So, I use a struct in place of the array:

typedef char NSIS_STRING[1024];   // TCHAR[NSIS_MAX_STRLEN], ANSI build, 0x400 bytes

struct g_usrvars_t
{
    // Indices 0..9 are the user registers $0..$9.
    // NB: $5 and $6 are reused locally in NSISWinMainNOCRT as `unexe` / `unexecmd`.
    NSIS_STRING var_0;                  // 0x0000  $0
    NSIS_STRING var_1;                  // 0x0400  $1
    NSIS_STRING var_2;                  // 0x0800  $2
    NSIS_STRING var_3;                  // 0x0C00  $3
    NSIS_STRING var_4;                  // 0x1000  $4
    NSIS_STRING var_5;                  // 0x1400  $5   (alias: unexe)
    NSIS_STRING var_6;                  // 0x1800  $6   (alias: unexecmd)
    NSIS_STRING var_7;                  // 0x1C00  $7
    NSIS_STRING var_8;                  // 0x2000  $8
    NSIS_STRING var_9;                  // 0x2400  $9

    // Indices 10..19 are the user registers $R0..$R9.
    NSIS_STRING var_R0;                 // 0x2800  $R0
    NSIS_STRING var_R1;                 // 0x2C00  $R1
    NSIS_STRING var_R2;                 // 0x3000  $R2
    NSIS_STRING var_R3;                 // 0x3400  $R3
    NSIS_STRING var_R4;                 // 0x3800  $R4
    NSIS_STRING var_R5;                 // 0x3C00  $R5
    NSIS_STRING var_R6;                 // 0x4000  $R6
    NSIS_STRING var_R7;                 // 0x4400  $R7
    NSIS_STRING var_R8;                 // 0x4800  $R8
    NSIS_STRING var_R9;                 // 0x4C00  $R9

    // Indices 20+ are the named state slots (state.h).
    NSIS_STRING state_command_line;     // 0x5000  [20] $CMDLINE   -> was data_435000
    NSIS_STRING state_install_directory;// 0x5400  [21] $INSTDIR   -> was data_435400
    NSIS_STRING state_output_directory; // 0x5800  [22] $OUTDIR    -> was 0x435800
    NSIS_STRING state_exe_directory;    // 0x5C00  [23] $EXEDIR    -> was 0x435c00
    NSIS_STRING state_language;         // 0x6000  [24] $LANGUAGE  -> was data_436000
    NSIS_STRING state_temp_dir;         // 0x6400  [25]            -> was data_436400
    NSIS_STRING state_plugins_dir;      // 0x6800  [26] $PLUGINSDIR
    NSIS_STRING state_exe_path;         // 0x6C00  [27]            -> was data_436c00
    NSIS_STRING state_exe_file;         // 0x7000  [28]
    NSIS_STRING var_29;                 // 0x7400  [29] (unreferenced here)
    NSIS_STRING state_click_next;       // 0x7800  [30]
};

This looks great in the virtual machine, but then in other locations that alias certain locations, it looks wrong:

Source/exehead/Main.c

Solution Attempt 1: Symbols

The first attempt to fix this is to create symbols in those locations. This works nicely for disassembly, but not for any IL. The reason is the IL are accessing the location via the struct, so the symbol is not used:

from binaryninja import Symbol, SymbolType

addr = 0x431400
sym = Symbol(SymbolType.DataSymbol, addr, "unexe")
bv.define_user_symbol(sym)
addr = 0x431800
sym = Symbol(SymbolType.DataSymbol, addr, "unexecmd")
bv.define_user_symbol(sym)

This solution is not the correct one.

Solution Attempt 2: Render Layers

I then tried render layers. This works, but I can only seem to get it working on Graph not Linear.

And the change only happens in the view, not anywhere else like cross references

And render layers itself feels like a spaghetti kludge that doesn't really solve the problem at the root. This is what I am running in snippet editor:

from binaryninja.renderlayer import RenderLayer
from binaryninja.enums import InstructionTextTokenType, RenderLayerDefaultEnableState

NAME = "NSIS borrowed-slot aliases"
ENABLE_BY_DEFAULT = True

ALIASES = {
    "NSISWinMainNOCRT": {
        0x1400: "unexe",
        0x1800: "unexecmd",
    },
}

def _function_name(block):
    f = block.function
    src = getattr(f, "source_function", None)
    return (src or f).name

def _rewrite_tokens(tokens, func_name):
    if not tokens:
        return
    table = ALIASES.get(func_name)
    if not table:
        return
    for t in tokens:
        if t.type == InstructionTextTokenType.FieldNameToken and t.value in table:
            t.text = table[t.value]
            t.width = len(t.text)

_DEFAULT_STATE = (
    RenderLayerDefaultEnableState.EnabledByDefaultRenderLayerDefaultEnableState
    if ENABLE_BY_DEFAULT
    else RenderLayerDefaultEnableState.DisabledByDefaultRenderLayerDefaultEnableState
)

class NSISAliasRenderLayer(RenderLayer):
    name = NAME
    default_enable_state = _DEFAULT_STATE

    def _apply_block(self, block, lines):
        func_name = _function_name(block)
        for line in lines:
            _rewrite_tokens(getattr(line, "tokens", None), func_name)
        return lines

    def apply_to_disassembly_block(self, block, lines):
        return self._apply_block(block, lines)

    def apply_to_low_level_il_block(self, block, lines):
        return self._apply_block(block, lines)

    def apply_to_medium_level_il_block(self, block, lines):
        return self._apply_block(block, lines)

    def apply_to_high_level_il_block(self, block, lines):
        return self._apply_block(block, lines)

    def apply_to_high_level_il_body(self, function, lines):
        func_name = function.name
        for line in lines:
            contents = getattr(line, "contents", None)
            if contents is not None:
                _rewrite_tokens(getattr(contents, "tokens", None), func_name)
        return lines

if NAME not in RenderLayer:
    NSISAliasRenderLayer.register()
    print(f"Registered RenderLayer: {NAME!r} (enabled_by_default={ENABLE_BY_DEFAULT})")
else:
    print(f"RenderLayer {NAME!r} already registered; left as-is. "
          f"Edit ALIASES and re-run after restarting BN to change mappings.")

I am wondering if there are any elegant solutions to this problem? Is there some way to have two separate structs depending on which function accesses? Or is there some way to support local aliases per function?

Solution Attempt 3: Give Up And Follow The Source

I nuked the struct used earlier completely. After 5.4.9696-dev changes, that underlying struct made everything look really bad:

004035d9        char (* __offset(g_usrvars_t, 0x5000) cmdline)[0x400] =
004035d9            &g_usrvars.state_command_line

All of those problems were alleviated:

But now I am back to the original problem, but even worse: I don't know how to put those macro names in anywhere. I will have to just write comments everywhere unless there is some other way.

Here is the database I'm looking at btw: solar plasma spins profoundly