Vector35 / Vector35/binaryninja-api

Strange HLIL generated

Open
#4,335 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Core Core: HLIL Impact: Low
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 3.5.4286-dev, 58311b01
  • OS: macos
  • OS Version: 13.3
  • CPU Architecture: arm64

BN disassembly

000055e0  int32_t sub_55e0()

000055e0  0b4b       ldr     r3, [pc, #0x2c]  {data_5610}  {data_20056d18}
000055e2  1968       ldr     r1, [r3]  {data_20056d18}
000055e4  0868       ldr     r0, [r1]
000055e6  b0e8f04f   ldm     r0!, {r4, r5, r6, r7, r8, r9, r10, r11, lr}
000055ea  80f30988   msr     psp, r0
000055ee  bff36f8f   isb     SY
000055f2  2de90140   push    {r0, lr} {var_4} {var_8}
000055f6  0648       ldr     r0, [pc, #0x18]  {data_5610}  {data_20056d18}
000055f8  0068       ldr     r0, [r0]  {data_20056d18}
000055fa  c1f091fd   bl      #nullsub
000055fe  bde80140   pop     {r0, lr}
00005602  4ff00000   mov     r0, #0
00005606  80f31188   msr     basepri, r0
0000560a  7047       bx      lr

0000560c  int32_t data_560c = -0x7fff0c51
00005610  int32_t* data_5610 = data_20056d18

IDA decompiler

int sub_55E0()
{
  int result; // r0

  _R0 = *dword_20056D18 + 36;
  __asm { MSR.W           PSP, R0 }
  __isb(0xFu);
  nullsub_6(dword_20056D18);
  result = 0;
  __asm { MSR.W           BASEPRI, R0 }
  return result;
}

BN HLIL looks strange. What is the meaning of *r0 and r0[1] through r0[7]?

Pseudo-C doesn't make sense either.

000055e0  int32_t sub_55e0()

000055e4      int32_t* r0 = *data_20056d18
000055e6      *r0
000055e6      r0[1]
000055e6      r0[2]
000055e6      r0[3]
000055e6      r0[4]
000055e6      r0[5]
000055e6      r0[6]
000055e6      r0[7]
000055e6      int32_t lr = r0[8]
000055ea      __msr(&r0[9])
000055ee      __isb()
000055f2      int32_t var_4 = lr
000055f2      uint32_t var_8 = &r0[9]
000055f8      int32_t r0_2 = data_20056d18
00005606      __set_BASEPRI(0)
0000560a      return r0_2

Anyone from V35 should search for "Encourage Salesman Prompt Delay" to find the database.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file or test is named. Reproduce the reported HLIL and pseudo-C output in Binary Ninja 3.5.4286-dev on macOS arm64 using the supplied disassembly, then inspect the relevant HLIL generation or ARM analysis entry points. Done means explaining or correcting the handling of the multi-register load and producing a regression test for the observed output.

Written by the indexing model from the issue text.

Assessment

Domain
compilers, reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.