Vector35 / Vector35/binaryninja-api
Use integer variable sign for constants in MLIL/HLIL
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
MLIL and HLIL seem to assume that constants are always unsigned, even during arithmetic with signed integer types. LLIL correctly determines the signedness of the constants.
Test case: /bin/cat from macOS 10.15 (likely same on newer versions), in _start at 1000015f6, eax is compared against 0xffffffff. eax is lifted into the variable int32_t rax_1 and binja assigns it a signed range from -0x80000000 to 0x6d.
Observe that lifting uses the wrong signedness in MLIL/HLIL
Disassembly:
LLIL:
MLIL:
HLIL:
BN Version: 2.2.2598-dev
OS: macOS 10.15
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the report with /bin/cat from macOS 10.15 at _start address 1000015f6, comparing the LLIL, MLIL, and HLIL views around the comparison with 0xffffffff. Trace how MLIL and HLIL determine constant signedness relative to the integer variable type. Done means the lifted expressions use the variable's signedness consistently with LLIL.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100