FindSimpleFPE2.py

import binaryninja
import networkx as nx

target = "cwe369B_x64"

RETURN_MAP = {
    'atoi': 0,
}

target_operations = [
    binaryninja.MediumLevelILOperation.MLIL_DIVS,
    binaryninja.MediumLevelILOperation.MLIL_DIVS_DP,
    binaryninja.MediumLevelILOperation.MLIL_DIVU,
    binaryninja.MediumLevelILOperation.MLIL_DIVU_DP,
    binaryninja.MediumLevelILOperation.MLIL_FDIV,
]

def get_function_name_from_address(bv, instr):
    if instr.operation == binaryninja.MediumLevelILOperation.MLIL_CALL_SSA:
        try:
            addr = instr.operands[1].value.value # [<mem>, <func_addr>, [<parameters>]]
            for func in bv.functions:
                if func.start == addr:
                    return func.name
        except AttributeError:
            pass # likely a dynamic call to a register/variable
    return None

def build_symbol_graph(bv, func):
    graph = nx.DiGraph()
    for func in bv.functions:
        for block in func.medium_level_il.ssa_form:
            for instr in block:
                # process MLIL_SET_VAR_SSA and MLIL_VAR_PHI operations
                if instr.operation in [binaryninja.MediumLevelILOperation.MLIL_SET_VAR_SSA, binaryninja.MediumLevelILOperation.MLIL_VAR_PHI]:
                    try:
                        for var_written in instr.vars_written:
                            vw_str = "{}#{}".format(var_written.var, int(var_written.version))
                            for var_read in instr.vars_read:
                                vr_str = "{}#{}".format(var_read.var, int(var_read.version))
                                graph.add_edge(vr_str, vw_str)
                            if instr.src.operation == binaryninja.MediumLevelILOperation.MLIL_CONST:
                                graph.add_edge(str(instr.src.value.value), vw_str)
                    except AttributeError as e:
                        pass
                      
                # MLIL_CALL_SSA
                if instr.operation in [binaryninja.MediumLevelILOperation.MLIL_CALL_SSA]:
                    func_name = get_function_name_from_address(bv, instr)
                    if func_name in RETURN_MAP:
                        value = RETURN_MAP[func_name]
                        for var_written in instr.vars_written:
                            vw_str = "{}#{}".format(var_written.var, int(var_written.version))
                            graph.add_edge(str(value), vw_str)
                            
    return graph

def find_all_paths_from(graph, symbol):
    roots = (v for v, d in graph.in_degree() if d == 0)
    all_paths = []
    for root in roots:
        paths = nx.all_simple_paths(graph, root, symbol)
        all_paths.extend(paths)
    return all_paths

print("Analyzing file: {}".format(target))
bv = binaryninja.BinaryViewType.get_view_of_file(target)
bv.add_analysis_option('linearsweep')

alert_count = 0
for func in bv.functions:
    if func.name != "main": continue
    print("Function: {}".format(func.name))
    for block in func.medium_level_il.ssa_form:
        for instr in block:
            for op in instr.postfix_operands:
                if op in target_operations:
                    try:
                        denom = instr.vars_read[-1]
                    except IndexError:
                        continue
                    denom_str = "{}#{}".format(denom.var, denom.version)
                    sg = build_symbol_graph(bv, func)
                    paths_from = find_all_paths_from(sg, denom_str)
                    for pf in paths_from:
                        if pf[0] == '0':
                            alert_count += 1
                            print("\n[ALERT {}]: Possible divide by zero detected.".format(alert_count))
                            print("  Function:    {}".format(func.name))
                            print("  Index:       {}".format(instr.instr_index))
                            print("  Address:     {}".format(hex(instr.address).rstrip("L")))
                            print("  Operation:   {}".format(instr.operation.name))
                            print("  Instruction: {}".format(instr))
                            print("  Variable:    {}".format(denom_str))
                            print("  Chain:       {}".format(pf[::-1]))
                            
print("\n>> CWE-369 analyzer found {} issues.".format(alert_count))