Function parameters are not inlined when indirectly pushed to the stack

Open

#4,986 opened on Jan 30, 2024 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 38/100

Issue type: Bug
Clarity: Mostly clear
Activity status: Stale
Tech stack: cpp
Domain: reverse-engineering

Research direction

Start by loading the provided class_test.zip binary in Binary Ninja and inspecting address 0040104f, comparing the current analysis with the expected-result screenshot. Reproduce the clang-built case with optimizations disabled and verify that indirectly stack-pushed function parameters are inlined when appropriate.

Written by the indexing model from the issue text.

Description

Component: Core Effort: Low Impact: Low

Version and Platform (required):

Binary Ninja Version: 3.6.4807-dev, 864ff019
OS: Windows
OS Version: 11
CPU Architecture: x86_64

Bug Description:
I'm unsure if the root cause of the issue is what I mentioned in the title. Based on my testing, when optimizations are disabled, the clang compiler occasionally utilizes a register to store function arguments on the stack. However, when this occurs, BN does not inline function parameters.

Steps To Reproduce:
I'll share my binary below. Anyone can identify the bug by navigating to address 0040104f.

Expected Behavior:
I expect BN to inline those function parameters if it's appropriate (as it is in the current example), just as it did for other binaries built with other compilers I've tested using the same code.

Screenshots:

Disassembly:

Example expected result:

Additional Information:
class_test.zip

Dominant language: C++
Stars: 1.3k
Forks: 298
Avg merge: 5d 5h
Merged PRs (30d): 19

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

Eval bug: SIGSEGV in token-counting routes when the request arrives while the server is sleeping (stale vocab/mctx captured before the wake barrier) Open

Difficulty 2/5 1-3 hours Newbie friendliness 86/100

ggml-org/llama.cpp#29188 · Opened Sep 20, 2026
Sensor initialization takes very long when `--initial-sim-time` is set to current UNIX timestamp Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

gazebosim/gz-sensors#662 · 1 comment · Opened Sep 20, 2026
Aligned columns on the serial monitor while keeping CSV on the SD card Open

enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

NorthernWidget/Margay_Library#31 · Opened Sep 20, 2026
v1 manifest list: existing_files_count is the table-wide total-data-files Open

comp-datalake

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

ClickHouse/ClickHouse#121222 · Opened Sep 20, 2026
Case collision between `Canvas` and `canvas` test directories causes platform-dependent source hashes Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

LadybirdBrowser/ladybird#12123 · Opened Sep 20, 2026

More C++ issues