-
Notifications
You must be signed in to change notification settings - Fork 279
Description
I have two binaries (tar_amd64_linux_gcc_o0.zip) that I am trying to compare function by function. When I look at the bir individually, I get:
$ bap -dbir tar_amd64_linux_gcc_o0_dynamic
0012760e: sub __overflow(__overflow_result)
0012ceeb: __overflow_result :: out u32 = RAX
000006a3:
000006a9: call @__overflow@external with return %000006ab
000006ab:
000006b1: RSP := RSP - 8
000006b4: mem := mem with [RSP, el]:u64 <- 0x40
000006bb: call @__ctype_toupper_loc@plt-0x10 with noreturn
and
$ bap -dbir tar_amd64_linux_gcc_o0_dynamic-rewritten
0012dadd: sub __overflow(__overflow_result)
001333c7: __overflow_result :: out u32 = RAX
0000073c:
00000742: call @__overflow@external with return %00000744
00000744:
0000074a: RSP := RSP - 8
0000074d: mem := mem with [RSP, el]:u64 <- 0x40
00000754: call @__ctype_toupper_loc@plt-0x10 with noreturn
which is what I expect. However, when I load both of them at the same time and observe the bir, the second binary looks different.
$ bap compare callgraph -dbir tar_amd64_linux_gcc_o0_dynamic tar_amd64_linux_gcc_o0_dynamic-rewritten
0012760e: sub __overflow(__overflow_result)
0012a4c5: __overflow_result :: out u32 = RAX
000006a3:
000006a9: call @__overflow@external with return %000006ab
000006ab:
000006b1: RSP := RSP - 8
000006b4: mem := mem with [RSP, el]:u64 <- 0x40
000006bb: call @__ctype_toupper_loc@plt-0x10 with noreturn
...
0025857e: sub __overflow(__overflow_result)
0025b43e: __overflow_result :: out u32 = RAX
0012b1de:
0012b1e4: call mem[0x277218, el]:u64 with noreturn
ivg
Metadata
Metadata
Assignees
Labels
No labels