Vector35 / Vector35/binaryninja-api
Constants should not be displayed as string literals when used in contexts where string literals don't make sense (bitwise operations, comparisons against integer variables)
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Version and Platform (required):
- Binary Ninja Version: 5.1.7500-dev (1da2316a)
- OS: macOS 15.5
- CPU Architecture: arm64
Bug Description:
In some armv7 code I've been looking at it's pretty common to see 16-bit loop indexes updated using:
00283334 10 014084e2 add r4, r4, #0x1
…
00283344 10 7440ffe6 uxth r4, r4, ror #0
This is basically i = (i + 1) & 0xffff.
If you're unlucky enough for 0xffff to be an address within a character array, Binary Ninja renders the 0xffff as a string literal in MLIL, HLIL, and pseudo C despite it not making any sense given the context. In LLIL it is rendered as data_0xffff which is not great, but at least lets me see the constant value.
This is not specific to 0xffff, that just happens to be a common pattern in the binary I've been looking at.
Steps To Reproduce:
- Open the provided binary.
- Go to 0x283334.
Expected Behavior:
No string literal.
Screenshots/Video Recording:
In this case 0xffff points within the dynamic symbol table and is one byte into the literal fseek.
Binary:
eager dragon paints eagerly
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Use the provided binary and inspect address 0x283334 across LLIL, MLIL, HLIL, and pseudo C, focusing on how the 0xffff constant is rendered in the bitwise operation. The issue is done when constants used in bitwise operations or comparisons against integer variables are not displayed as string literals, while genuine string contexts remain unaffected.
Written by the indexing model from the issue text.
Assessment
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100