Indicate when pure function elimination occurs

Open
#5,557 10 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
32/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
cpp

Research direction

Start by comparing the provided disassembly, MLIL, and HLIL for DjiCore_SetFirmwareVersion, focusing on the eliminated DjiDataBuriedPoint_ApiHitRecord call. Trace the pure-function elimination behavior in the decompilation pipeline and determine how the transformation should be indicated. Done means the call's removal is represented clearly in the relevant high-level output without changing the remaining assignments.

Written by the indexing model from the issue text.

Description

Component: Core Effort: Medium Impact: Medium

Version and Platform (required):

  • Binary Ninja Version: 4.1.5474-dev, f6ba0af7
  • OS: macos
  • OS Version: 14.5
  • CPU Architecture: arm64

Internal binary major dine favor.

IDA

__int64 __fastcall DjiCore_SetFirmwareVersion(int a1)
{
  DjiDataBuriedPoint_ApiHitRecord("DjiCore_SetFirmwareVersion", 221LL);
  FIRMWARE_VERSION = a1;
  HAVE_FIRMWARE_VER = 1;
  return 0LL;
}

BN HLIL is missing the call to DjiDataBuriedPoint_ApiHitRecord

00049084  T_DjiReturnCode DjiCore_SetFirmwareVersion(struct T_DjiFirmwareVersion version)

0004908c      uint32_t ver
0004908c      ver.b = version.majorVersion
0004908c      ver:1.b = version.minorVersion
0004908c      ver:2.b = version.modifyVersion
0004908c      ver:3.b = version.debugVersion
00049094      int64_t x0
00049094      x0.b = 0xa8
00049094      x0:1.b = 0x81
00049094      x0:2.b = 0x12
00049094      x0:3.b = 0
000490ac      FIRMWARE_VERSION = ver
000490bc      HAVE_FIRMWARE_VERSION = 1
000490c0      int64_t x0_1
000490c0      x0_1.b = 0
000490c0      x0_1:1.b = 0
000490c0      x0_1:2.b = 0
000490c0      x0_1:3.b = 0
000490c8      return 0

even though it's present in the disassembly

00049084  T_DjiReturnCode DjiCore_SetFirmwareVersion(struct T_DjiFirmwareVersion version)

00049084  fd7bbea9   stp     x29, x30, [sp, #-0x20]! {__saved_x29} {__saved_x30}
00049088  fd030091   mov     x29, sp {__saved_x29}
0004908c  a01b00b9   str     w0, [x29, #0x18 {ver} {ver+0x1} {ver+0x2} {ver+0x3}]
00049090  e00600f0   adrp    x0, 0x128000
00049094  00a00691   add     x0, x0, #0x1a8  {__FUNCTION__.7263, "DjiCore_SetFirmwareVersion"}
00049098  a11b8052   mov     w1, #0xdd
0004909c  b5780094   bl      DjiDataBuriedPoint_ApiHitRecord
000490a0  a11b40b9   ldr     w1, [x29, #0x18 {ver}]
000490a4  000a00d0   adrp    x0, 0x18b000
000490a8  00200691   add     x0, x0, #0x188  {FIRMWARE_VERSION}
000490ac  010000b9   str     w1, [x0]  {FIRMWARE_VERSION}
000490b0  000a00d0   adrp    x0, 0x18b000
000490b4  00c00691   add     x0, x0, #0x1b0  {HAVE_FIRMWARE_VERSION}
000490b8  21008052   mov     w1, #0x1
000490bc  01000039   strb    w1, [x0]  {0x1}  {HAVE_FIRMWARE_VERSION}
000490c0  000080d2   mov     x0, #0
000490c4  fd7bc2a8   ldp     x29, x30, [sp], #0x20 {__saved_x29} {__saved_x30}
000490c8  c0035fd6   ret     

and even MLIL

00049084  T_DjiReturnCode DjiCore_SetFirmwareVersion(struct T_DjiFirmwareVersion version)

   0 @ 0004908c  ver:0.b = version.majorVersion
   1 @ 0004908c  ver:1.b = version.minorVersion
   2 @ 0004908c  ver:2.b = version.modifyVersion
   3 @ 0004908c  ver:3.b = version.debugVersion
   4 @ 00049094  x0:0.b = 0xa8
   5 @ 00049094  x0:1.b = 0x81
   6 @ 00049094  x0:2.b = 0x12
   7 @ 00049094  x0:3.b = 0
   8 @ 00049098  x1 = 0xdd
   9 @ 0004909c  DjiDataBuriedPoint_ApiHitRecord()
  10 @ 000490a0  x1_1 = ver
  11 @ 000490ac  [&FIRMWARE_VERSION].d = x1_1
  12 @ 000490bc  [&HAVE_FIRMWARE_VERSION].b = 1
  13 @ 000490c0  x0_1:0.b = 0
  14 @ 000490c0  x0_1:1.b = 0
  15 @ 000490c0  x0_1:2.b = 0
  16 @ 000490c0  x0_1:3.b = 0
  17 @ 000490c8  return 0
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Vector35/binaryninja-api

All issues in Vector35/binaryninja-api

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.