Vector35 / Vector35/binaryninja-api

Busybox PowerPC `unimplemented` instruction: mfcr

Open
#4,017 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Arch: PowerPC Component: Architecture Effort: Low Impact: Low Lifting
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Binary Ninja Version: 2.4.2898-dev Personal, 1e7cedd7
Platform: Fedora 34 (Workstation Edition)

10002c4c  int32_t sub_10002c4c(int32_t arg1, int32_t arg2, int32_t arg3, uint32_t arg4)

void var_1028  {Frame offset -1028}
int32_t var_24  {Frame offset -24}
int32_t arg1  {Register r3}
char const* const r3_2  {Register r3}
int32_t arg2  {Register r4}
void* r4  {Register r4}
void* r4_1  {Register r4}
int32_t arg3  {Register r5}
uint32_t arg4  {Register r6}

       10002c4c  sub_10002c4c:
   0 @ 10002c50  r12 = unimplemented
   1 @ 10002c5c  r24 = arg1
   2 @ 10002c5c  lt = r24 s< 0
   3 @ 10002c60  var_24 = r12
   4 @ 10002c64  r26 = arg2
   5 @ 10002c6c  r31 = arg4
   6 @ 10002c70  r30 = arg3
   7 @ 10002c74  r27 = 0xffffffff
   8 @ 10002c78  r28 = 0xffffffff

Or in a decompiler view:

10002c4c  int32_t sub_10002c4c(int32_t arg1, int32_t arg2, int32_t arg3, uint32_t arg4)

10002c50      int32_t r12 = unimplemented  {mfcr r12}
10002c5c      bool lt = arg1 s< 0
10002c60      int32_t var_24 = r12
10002c6c      uint32_t r31 = arg4
10002c70      int32_t r30 = arg3
10002c74      int32_t r27 = 0xffffffff
10002c7c      if (not(lt))

Or disasm output:

10002c4c  int32_t sub_10002c4c(int32_t arg1, int32_t arg2, int32_t arg3, uint32_t arg4)

int32_t var_1030  {Frame offset -1030}
void var_1028  {Frame offset -1028}
int32_t var_24  {Frame offset -24}
int32_t __saved_r24  {Frame offset -20}
int32_t __saved_r25  {Frame offset -1c}
int32_t __saved_r26  {Frame offset -18}
int32_t __saved_r27  {Frame offset -14}
int32_t __saved_r28  {Frame offset -10}
int32_t __saved_r29  {Frame offset -c}
int32_t __saved_r30  {Frame offset -8}
int32_t __saved_r31  {Frame offset -4}
void arg_0  {Frame offset 0}
int32_t arg_4  {Frame offset 4}

10002c4c  sub_10002c4c:
10002c4c  9421efd0   stwu    r1, -4144(r1) {var_1030} {arg_0}
10002c50  7d800026   mfcr    r12
10002c54  7c0802a6   mflr    r0
10002c58  bf011010   stmw    r24, 4112(r1) {__saved_r24} {__saved_r25} {__saved_r26} {__saved_r27} {__saved_r28} {__saved_r29} {__saved_r30} {__saved_r31}
10002c5c  7c781b79   or.     r24, r3, r3
10002c60  9181100c   stw     r12, 4108(r1) {var_24}
10002c64  7c9a2378   mr      r26, r4
10002c68  90011034   stw     r0, 4148(r1) {arg_4}
10002c6c  7cdf3378   mr      r31, r6
10002c70  7cbe2b78   mr      r30, r5
10002c74  3b60ffff   li      r27, -0x1  {0xffffffff}
10002c78  3b80ffff   li      r28, -0x1  {0xffffffff}
10002c7c  418000d0   blt     0x10002d4c

Binary is one of the Rizin's tests - busybox-powerpc: https://github.com/rizinorg/rizin-testbins/blob/master/elf/busybox-powerpc

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the supplied rizinorg/rizin-testbins busybox-powerpc binary and inspect how the PowerPC mfcr instruction at 0x10002c50 is represented in the disassembly and decompiler views. Compare the current unimplemented output with the expected instruction behavior; done means mfcr is handled without the unimplemented placeholder in both views.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.