Vector35 / Vector35/binaryninja-api

R5900 Platform does not gracefully handle float literals being assigned to float variables

Open
#7,035 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Arch: MIPS Component: Architecture Effort: Trivial Impact: Low Lifting
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 5.1.7821-dev
  • Edition: Non-Commercial / Commercial / Ultimate
  • OS: Windows 10 Pro
  • OS Version: 10.0.19045 Build 19045
  • CPU Architecture: x86-64

Bug Description:
When a float literal (such as 0x3F800000) is assigned to a float variable, instead of emitting HLIL such as var = 1.0f, HLIL such as __builtin_memcpy(dest: &var, src: "\x00\x00\x80\x3F", count: 4) is emitted instead.

Steps To Reproduce:
Please provide all steps required to reproduce the behavior:

  1. Open an R5900 binary.
  2. Change the type of a variable to float (assuming the variable is actually a float).
  3. Observe the HLIL emitted by code assigning a value to that variable.

I've included a binary which demonstrates this issue (see @0x15be70)

Expected Behavior:
As per above, the HLIL should indicate that said float variable is being assigned that float constant.

Binary:
I've uploaded an archive to Portal with the key phrase: fierce forest sings calmly

This includes the original source binary and the bndb file.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Open the supplied R5900 binary and inspect HLIL at @0x15be70 after changing the variable type to float. Use the Portal binary and bndb with the reported reproduction steps, and confirm that the assignment is represented as a float literal rather than the emitted __builtin_memcpy form.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers, reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.