Skip to content

Lifted BIR looks different when loading multiple binaries #1216

@fortunac

Description

@fortunac

I have two binaries (tar_amd64_linux_gcc_o0.zip) that I am trying to compare function by function. When I look at the bir individually, I get:

$ bap -dbir tar_amd64_linux_gcc_o0_dynamic
0012760e: sub __overflow(__overflow_result)
0012ceeb: __overflow_result :: out u32 = RAX
000006a3: 
000006a9: call @__overflow@external with return %000006ab

000006ab: 
000006b1: RSP := RSP - 8
000006b4: mem := mem with [RSP, el]:u64 <- 0x40
000006bb: call @__ctype_toupper_loc@plt-0x10 with noreturn

and

$ bap -dbir tar_amd64_linux_gcc_o0_dynamic-rewritten
0012dadd: sub __overflow(__overflow_result)
001333c7: __overflow_result :: out u32 = RAX
0000073c: 
00000742: call @__overflow@external with return %00000744

00000744: 
0000074a: RSP := RSP - 8
0000074d: mem := mem with [RSP, el]:u64 <- 0x40
00000754: call @__ctype_toupper_loc@plt-0x10 with noreturn

which is what I expect. However, when I load both of them at the same time and observe the bir, the second binary looks different.

$ bap compare callgraph -dbir tar_amd64_linux_gcc_o0_dynamic tar_amd64_linux_gcc_o0_dynamic-rewritten
0012760e: sub __overflow(__overflow_result)
0012a4c5: __overflow_result :: out u32 = RAX
000006a3: 
000006a9: call @__overflow@external with return %000006ab

000006ab: 
000006b1: RSP := RSP - 8
000006b4: mem := mem with [RSP, el]:u64 <- 0x40
000006bb: call @__ctype_toupper_loc@plt-0x10 with noreturn

...

0025857e: sub __overflow(__overflow_result)
0025b43e: __overflow_result :: out u32 = RAX
0012b1de: 
0012b1e4: call mem[0x277218, el]:u64 with noreturn

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions