Vector35 / Vector35/binaryninja-api
Incorrect MLIL->HLIL lifting related to variable-length array
Open
Nobody has claimed this yet.
Component: Core
Effort: Medium
Impact: Medium
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
For the call at 0x18ef, in the HLIL, the second argument becomes rsp_1, which is incorrect. The storage of rsp_1 is the rsp register, whereas the correct value, var_60, has a stack offset -96. We can see from the screenshot it is correct until the MLIL
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the supplied RetoRetro.zip and trace the call at 0x18ef from MLIL into HLIL, comparing the second argument's storage for rsp_1 and var_60. Done means the HLIL represents the second argument with the correct stack offset of -96 rather than the rsp register.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 32/100