Vector35 / Vector35/binaryninja-api
Floating Point Variables Are Ignored
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Version 2.4.2846 (Build ID df7c027e)
Describe the bug
Floating point variables seem to be ignored in the Binary Ninja Intermediate Language.
To Reproduce
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
float test3() {
srand(time(NULL));
float f_x = 41.89465555f;
float f_y = (float)(rand()) / 100000.0f;
float sum = f_x + f_y;
return sum;
}
int main() {
float x = test3();
}
- compile with
gcc -g0 -std=c99 -fno-stack-protector -m64 -O0 - open compiled binary
- navigate to test3 symbol
- show Medium Level IL
Result:
00001279 test3:
0 @ 0000128a rax = time(nullptr)
1 @ 0000128f rdi = rax
2 @ 00001291 srand(x: rdi)
3 @ 00001296 zmm0 = 41,8946571f
4 @ 0000129e var_c = zmm0
5 @ 000012a3 rax_1 = rand()
6 @ 000012a8 zmm0 = 0f
7 @ 000012ac zmm0 = float.s(rax_1.eax)
8 @ 000012b0 zmm1 = 100000f
9 @ 000012b8 zmm0 = zmm0 / zmm1
10 @ 000012bc var_10 = zmm0
11 @ 000012c1 zmm0 = var_c
12 @ 000012c6 zmm0 = zmm0 + fconvert.t(var_10)
13 @ 000012cb var_14 = zmm0
14 @ 000012d6 return rax_1
Expected behavior
The return value of the above example should be var_14 instead of rax_1.
Version and Platform
- Binary Ninja: Version 2.4.2846 (Build ID df7c027e) / Version 2.4.2917-dev (Build ID d828c284)
- OS: Ubuntu Linux
- Version: 20.04.2 LTS
Additional context
- binary_ninja_bug_report.zip several examples (including above mentioned one) that are related to this issue (source and compiled binary)
- Could be related to #2566
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the C reproducer and compiled examples in binary_ninja_bug_report.zip, then inspect the test3 symbol in Medium Level IL. Compare the generated return value with var_14 and investigate why rax_1 is returned instead. Done means floating-point test3 returns the computed var_14 value in the IL.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100