Skip to content

Conversation

@fkil
Copy link

@fkil fkil commented Dec 2, 2025

Fixes #8717

RuleShiftAnd previously replaced the AND opcode with COPY. This, however doesn't update the NZMask of the Varnode. As a result, following rules may assume the NZMask after the AND operation also applies to the Varnode being copied.

In combination with RuleShiftCompare, an expression of the form (a & bitmask) >> const != 0, wrongfully is reduced to a != 0. Instead of replacing the AND with COPY, we now replace the input of the shift operation instead. This way, future rules will see the correct NZMask.

Fixes NationalSecurityAgency#8717

RuleShiftAnd previously replaced the AND opcode with COPY. This,
however doesn't update the NZMask of the Varnode. As a result, following
rules may assume the NZMask after the AND operation also applies to the
Varnode being copied.

In combination with RuleShiftCompare, an expression of the form
(a & bitmask) >> const != 0, wrongfully is reduced to a != 0.
Instead of replacing the AND with COPY, we now replace the input
of the shift operation instead. This way, future rules will see
the correct NZMask.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Decompiler: Ghidra sometimes incorrectly optimizes bit extractions that use AND and RSHIFT

1 participant