Vector35 / Vector35/binaryninja-api

Floating Point Variables Are Ignored

Open
#2,577 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Core Effort: Medium Impact: Medium
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version 2.4.2846 (Build ID df7c027e)

Describe the bug
Floating point variables seem to be ignored in the Binary Ninja Intermediate Language.

To Reproduce

#include <stdio.h>
#include <stdlib.h>
#include <time.h>

float test3() {
    srand(time(NULL));
    float f_x = 41.89465555f;
    float f_y = (float)(rand()) / 100000.0f;
    float sum = f_x + f_y;
    return sum;
}

int main() {
    float x = test3();
}
  1. compile with gcc -g0 -std=c99 -fno-stack-protector -m64 -O0
  2. open compiled binary
  3. navigate to test3 symbol
  4. show Medium Level IL

Result:

       00001279  test3:
   0 @ 0000128a  rax = time(nullptr)
   1 @ 0000128f  rdi = rax
   2 @ 00001291  srand(x: rdi)
   3 @ 00001296  zmm0 = 41,8946571f
   4 @ 0000129e  var_c = zmm0
   5 @ 000012a3  rax_1 = rand()
   6 @ 000012a8  zmm0 = 0f
   7 @ 000012ac  zmm0 = float.s(rax_1.eax)
   8 @ 000012b0  zmm1 = 100000f
   9 @ 000012b8  zmm0 = zmm0 / zmm1
  10 @ 000012bc  var_10 = zmm0
  11 @ 000012c1  zmm0 = var_c
  12 @ 000012c6  zmm0 = zmm0 + fconvert.t(var_10)
  13 @ 000012cb  var_14 = zmm0
  14 @ 000012d6  return rax_1

Expected behavior
The return value of the above example should be var_14 instead of rax_1.

Version and Platform

  • Binary Ninja: Version 2.4.2846 (Build ID df7c027e) / Version 2.4.2917-dev (Build ID d828c284)
  • OS: Ubuntu Linux
  • Version: 20.04.2 LTS

Additional context

  • binary_ninja_bug_report.zip several examples (including above mentioned one) that are related to this issue (source and compiled binary)
  • Could be related to #2566

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the C reproducer and compiled examples in binary_ninja_bug_report.zip, then inspect the test3 symbol in Medium Level IL. Compare the generated return value with var_14 and investigate why rax_1 is returned instead. Done means floating-point test3 returns the computed var_14 value in the IL.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.