Vector35 / Vector35/binaryninja-api

Calls to ___chkstk_darwin result in HLIL statements with no apparent side effects

Open
#7,343 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Platform File Format: Mach-O Impact: Medium
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 5.2.8313-dev
  • Edition: Commercial
  • OS: macOS
  • OS Version: 15.6.1
  • CPU Architecture: ARM64

Bug Description:

100005874    int64_t sub_100005874(int64_t arg1, int64_t arg2, int64_t arg3 @ x20)

100005884        int64_t var_20 = arg3
100005898        int64_t var_c0 = arg1
1000058a0        void* x0 = _$s8Dispatch0A13WorkItemFlagsVMa(0)
1000058a8        void* x8 = *(x0 - 8)
1000058b0        *(x8 + 0x40)

^-- what is this?

1000058d0        void* x21 = &var_c0 - ((___chkstk_darwin() + 0xf) & 0xfffffffffffffff0)
1000058dc        void* x0_1 = _$s8Dispatch0A3QoSVMa(0)
1000058e0        void* x8_5 = *(x0_1 - 8)
1000058e8        *(x8_5 + 0x40)

^-- what is this?

100005908        void* x23 = x21 - ((___chkstk_darwin() + 0xf) & 0xfffffffffffffff0)
100005914        void* x0_2 = _$s8Dispatch0A4TimeVMa(0)
10000591c        void* x27 = *(x0_2 - 8)
100005920        *(x27 + 0x40)

^-- what is this?

100005940        void* x22 = x23 - ((___chkstk_darwin() + 0xf) & 0xfffffffffffffff0)
10000595c        void* x25 = x22 - ___chkstk_darwin()

Steps To Reproduce:
Open the Rectangle.app binary as ARM64 and browse to 0x100005874.

Expected Behavior:
Statements that have side effects.

Screenshots/Video Recording:
If applicable, please add screenshots/video recording here to help explain your problem.

Binary:

Rectangle.bndb.zip

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Open Rectangle.bndb.zip in Binary Ninja as an ARM64 binary and browse to 0x100005874. Inspect the HLIL statements around the ___chkstk_darwin calls and compare their displayed side effects with the expected behavior; done means the relevant statements show their effects rather than appearing side-effect-free.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers, reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.