Vector35 / Vector35/binaryninja-api
Strange HLIL generated
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Version and Platform (required):
- Binary Ninja Version: 3.5.4286-dev, 58311b01
- OS: macos
- OS Version: 13.3
- CPU Architecture: arm64
BN disassembly
000055e0 int32_t sub_55e0()
000055e0 0b4b ldr r3, [pc, #0x2c] {data_5610} {data_20056d18}
000055e2 1968 ldr r1, [r3] {data_20056d18}
000055e4 0868 ldr r0, [r1]
000055e6 b0e8f04f ldm r0!, {r4, r5, r6, r7, r8, r9, r10, r11, lr}
000055ea 80f30988 msr psp, r0
000055ee bff36f8f isb SY
000055f2 2de90140 push {r0, lr} {var_4} {var_8}
000055f6 0648 ldr r0, [pc, #0x18] {data_5610} {data_20056d18}
000055f8 0068 ldr r0, [r0] {data_20056d18}
000055fa c1f091fd bl #nullsub
000055fe bde80140 pop {r0, lr}
00005602 4ff00000 mov r0, #0
00005606 80f31188 msr basepri, r0
0000560a 7047 bx lr
0000560c int32_t data_560c = -0x7fff0c51
00005610 int32_t* data_5610 = data_20056d18
IDA decompiler
int sub_55E0()
{
int result; // r0
_R0 = *dword_20056D18 + 36;
__asm { MSR.W PSP, R0 }
__isb(0xFu);
nullsub_6(dword_20056D18);
result = 0;
__asm { MSR.W BASEPRI, R0 }
return result;
}
BN HLIL looks strange. What is the meaning of *r0 and r0[1] through r0[7]?
Pseudo-C doesn't make sense either.
000055e0 int32_t sub_55e0()
000055e4 int32_t* r0 = *data_20056d18
000055e6 *r0
000055e6 r0[1]
000055e6 r0[2]
000055e6 r0[3]
000055e6 r0[4]
000055e6 r0[5]
000055e6 r0[6]
000055e6 r0[7]
000055e6 int32_t lr = r0[8]
000055ea __msr(&r0[9])
000055ee __isb()
000055f2 int32_t var_4 = lr
000055f2 uint32_t var_8 = &r0[9]
000055f8 int32_t r0_2 = data_20056d18
00005606 __set_BASEPRI(0)
0000560a return r0_2
Anyone from V35 should search for "Encourage Salesman Prompt Delay" to find the database.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No source file or test is named. Reproduce the reported HLIL and pseudo-C output in Binary Ninja 3.5.4286-dev on macOS arm64 using the supplied disassembly, then inspect the relevant HLIL generation or ARM analysis entry points. Done means explaining or correcting the handling of the multi-register load and producing a regression test for the observed output.
Written by the indexing model from the issue text.
Assessment
- Domain
- compilers, reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100