Improved Handling of Call for char* Push to Stack

[utkonos]

What is the feature you'd like to have?

In shellcode, a position independent base address is stored in a global register using a call to the next instruction address and then the next instruction being a pop to the global register. This is handled very well by Binary Ninja now. Here is an exampe of that:

Here is the feature request: in a similarly artful handling of that pattern, this sneaky call which in effect pushes the next "instruction" address to the stack whereas that next instruction is really a null terminated string. The distance in the call instruction is really the length of the string with trailing null byte. The result is the pointer to the string is now on the stack and becomes an input parameter for a subsequent call. Here is an example of this technique:

The area highlighted in red is really NTDLL. And the ff at 027a0152 is the start of the opcode for the call to GetProcAddress.

Is your feature request related to a problem?
The call at 027a0148 could be handled in the same way as the pattern that sets the global register above with the name of the "function" being $+11 in this case. The string would then, at least in the linear view be shown as a data symbol. Then everything looks much better.

Are any alternative solutions acceptable?
As @psifertex pointed out to me in Slack, the first call can be replaced with a jump, and it all falls in place. But this changes the bytes from their original.

Additional Information:
Here is another example of this where it makes the disassembly borken:

The call at 027a0179 should be $+20, the string NtQueryVirtualMemory should be a data symbol char string. Also, in this screenshot, there is the start of a trampoline function at 027a019c that is being misinterpreted as being part of the earlier function.

[xusheng6]

I have seen similar patterns before in #4752. Though I am not sure what the best way to fix this is. @utkonos in your sample, after the call_xxxx function returns, where does the control flow resume?

[utkonos]

@xusheng6 wow, yes, that other one is the same. I have been excavating and bumping issues tonight that I need and I missed that one as being the same as this.

I had changed the symbol name for the call so it obscures what's happening, sorry. The call is to address 0x27a0153 in the top example.

And the call is to address 0x27a0193 in the second example.

[utkonos]

And here is the binary:
kind dolphin flies quietly

ya'll probably have 9000 copies of it by now. 🤣

[utkonos]

@xusheng6 on closer inspection, these are actually two slightly different uses. The trick that isn't handled well is that it's shown as a call to a subroutine rather than one of those $+n calls (not sure how I should refer to this type of call).

The issue you raised is call + pop and the first example i have above is a call + call. The second example here is a call + push + call

[xusheng6]

And here is the binary: kind dolphin flies quietly

ya'll probably have 9000 copies of it by now. 🤣

which base address should I load it at to get the effect you showed in the screenshot?

[utkonos]

@xusheng6 Here is the database: blue star swims carefully

[utkonos]

@xusheng6 Here is another file with this pattern: brave dolphin creates brightly

The first location is 0x14000410e

The second location is 0x140004144