Hide explicit pointer authentication checks before tail calls

Open
#6,702 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
cpp
Domain
reverse-engineering

Research direction

Reproduce the issue by opening a Mac shared cache, loading MediaLibrary.framework, and navigating to +[MLMediaLibrary initialize]. Read the HLIL output and compare the observed HighBitsNoTBI pattern with llvm/lib/Target/AArch64/AArch64PointerAuth.h, especially the patterns described in the linked LLVM source. Done means explicit pointer-authentication checks before tail calls are detected and suppressed so the HLIL control flow is no longer broken.

Written by the indexing model from the issue text.

Description

Arch: ARM64 Component: Architecture Component: Core Effort: Medium Impact: Medium

Version and Platform (required):

  • Binary Ninja Version: 5.0.7284-dev (e7d42d95)
  • OS: macOS 15.4.1
  • CPU Architecture: arm64

Bug Description:
When PAC is enabled, arm64 functions that end with a tail call rather than returning often explicitly validate lr prior to branching.

19c01be2c     0  ff2303d5   autibsp 
19c01be30     0  d0071eca   eor     x16, x30, x30, lsl #0x1
19c01be34     0  5000f0b6   tbz     x16, #0x3e, 0x19c01be3c

19c01be38     0  208e38d4   brk     #0xc471

19c01be3c     0  a1450014   b       0x19c02d4c0

This validation ends up in HLIL in an incomplete/broken form:

19c01be34        int64_t x30
19c01be34        
19c01be34        if (((x30 ^ x30 << 1) & 0x40000000) == 0)
19c02d4d4            return _objc_msgSend(x0_2, "instrument:", &cfstr_MLMediaLibrary) __tailcall

These patterns make it harder to follow the control flow of the function and should be detected and suppressed.

Steps To Reproduce:

  1. Open a Mac shared cache
  2. Load MediaLibrary.framework
  3. Navigate to +[MLMediaLibrary initialize]

Additional Information:
There's a few different patterns for these explicit checks that LLVM can emit per https://github.com/llvm/llvm-project/blob/0014b49482c0862c140149c650d653b4e41fa9b4/llvm/lib/Target/AArch64/AArch64PointerAuth.h#L44-L86 The HighBitsNoTBI pattern is what I've seen on Apple platforms.

Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Vector35/binaryninja-api

All issues in Vector35/binaryninja-api

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.