Argument storage overrides do not work at call sites except in Mapped MLIL

Open
#2,076 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
28/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
cpp
Domain
compilers, reverse-engineering

Research direction

Reproduce the float parameter example using the @ storage override, then compare call-site Mapped MLIL with standard MLIL and HLIL. Trace how the override is propagated into call-site representations and data flow; done means standard MLIL and HLIL honor the same location as Mapped MLIL.

Written by the indexing model from the issue text.

Description

Component: Core Impact: Medium

When overriding the storage location of a parameter via the @ syntax (e.g. void foo(float bar @ f1) where f1 is a register), the overriden location is used within the function, and at callsites' Mapped MLIL (example), but not in standard MLIL or HLIL (example), which breaks data flow as well.

(The usage of this feature is necessary in the first place because float arguments appear to use normal integer registers and not CallingConvention.float_arg_regs which I believe is a separate bug)

Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Vector35/binaryninja-api

All issues in Vector35/binaryninja-api

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.