Skip to content

Pattern searcher appears to miscount matches #10

@p0lymeric

Description

@p0lymeric

The pattern searcher used by is_pattern_unique appears to be broken in BN 5.3.9434.
I was unable to generate signatures starting at some instructions, where nearby instructions would work.

I attached log excerpts and the assembly which I targeted in the txt attachment.

Referencing the attachment, it's very odd that as the signature is being built, uniqueness check match count can collapse to 0 (should decrease towards 1 if I understand the logic correctly).

I can say that the issue probably lies behind is_pattern_unique, as I was able to work around the issue by substituting the custom pattern searcher with bv.search.
p0lymeric@2c18a09

I did not debug much beyond is_pattern_unique, so I'm not sure about actual cause.

Thanks again for a very cool plugin, now I don't need to drop into Ghidra for this task. :)

Attachment:
coolsigmaker.txt

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions