Vector35 / Vector35/binaryninja-api

Constants should not be displayed as string literals when used in contexts where string literals don't make sense (bitwise operations, comparisons against integer variables)

Open
#6,883 1 comment 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: UI Effort: Medium Impact: Low
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 5.1.7500-dev (1da2316a)
  • OS: macOS 15.5
  • CPU Architecture: arm64

Bug Description:
In some armv7 code I've been looking at it's pretty common to see 16-bit loop indexes updated using:

00283334    10  014084e2   add     r4, r4, #0x1
…
00283344    10  7440ffe6   uxth    r4, r4, ror  #0

This is basically i = (i + 1) & 0xffff.

If you're unlucky enough for 0xffff to be an address within a character array, Binary Ninja renders the 0xffff as a string literal in MLIL, HLIL, and pseudo C despite it not making any sense given the context. In LLIL it is rendered as data_0xffff which is not great, but at least lets me see the constant value.

This is not specific to 0xffff, that just happens to be a common pattern in the binary I've been looking at.

Steps To Reproduce:

  1. Open the provided binary.
  2. Go to 0x283334.

Expected Behavior:
No string literal.

Screenshots/Video Recording:

In this case 0xffff points within the dynamic symbol table and is one byte into the literal fseek.

Image

Binary:
eager dragon paints eagerly

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Use the provided binary and inspect address 0x283334 across LLIL, MLIL, HLIL, and pseudo C, focusing on how the 0xffff constant is rendered in the bitwise operation. The issue is done when constants used in bitwise operations or comparisons against integer variables are not displayed as string literals, while genuine string contexts remain unaffected.

Written by the indexing model from the issue text.

Assessment

Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.