Example Binja Platform Plugin
This is an example Binja platform plugin which fixes up linux kernel module calls to __fentry__
. __fentry__
is the linux kernel function tracing framework that you can read more about here.
The problem, as far as Binja is concerned, is that fentry calls clobber registers on entry to the function, effectively discarding the functions actual arguments from analysis. For example, from the decompilation we would see:
00000050 int64_t kernote_ioctl()
00000050 kernote_ioctl:
0 @ 00000050 int64_t rdx_2
1 @ 00000050 int32_t rsi_2
2 @ 00000050 rdx_2, rsi_2 = __fentry__()
...
Note that the ioctl call has no parameters, and __fentry__
clobbers rdx and rsi. The solution is to create a calling convetion that modifies nothing, then automatically apply it to all of our fentry calls, which is exactly what this plugin does. With this plugin, we now see:
00000050 int64_t kernote_ioctl(int64_t arg1, int32_t arg2, int64_t arg3)
00000050 kernote_ioctl:
0 @ 00000050 __fentry__()
...
Ideally this plugin will be rolled into Binja's default linux platform types and be made obsolete. This code should be easily adaptable to apply a custom calling convention to any external call.