Vector35 / Vector35/binaryninja-api

Improve lifting of ARM64 CCMP instruction to compound if statement

Open
#5,915 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Core Effort: Low Impact: Low
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 4.2.6042-dev (e875db7b)
  • OS: Windows
  • OS Version: 10
  • CPU Architecture: x64

Bug Description:
This C pattern:

if (c == '\n' || c == '\r')
{
  // ...
}
// ...

Can compile into this ARM assembly:

00000000  3f280071   cmp     w1, #0xa
00000004  24184d7a   ccmp    w1, #0xd, #0x4, ne
00000008  00050054   b.eq    0xa8 

This ends up decompiling into this HLIL:

00000004      bool z
00000004      
00000004      if (c != 0xa)
00000004          z = c == 0xd
00000004      else
00000004          z = true
00000004      
00000008      if (z)
00000008          jump(0xa8)
00000008      
00000008      jump(0xc)

Steps To Reproduce:
Please provide all steps required to reproduce the behavior:

  1. Create a new blank view with Ctrl+N
  2. Paste in the following bytes: 3f28007124184d7a00050054
  3. Create aarch64 function and view HLIL

Expected Behavior:
Should decompile into a more compact form, e.g. if (c == 0xa || c == 0xd).

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue in a new blank view using the provided bytes, then create an AArch64 function and inspect its HLIL. Trace the lifting of the CCMP instruction and compare the result with the expected compound condition. Done means the sequence decompiles into an equivalent compact condition such as if (c == 0xa || c == 0xd).

Written by the indexing model from the issue text.

Assessment

Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.