Vector35 / Vector35/binaryninja-api
[ObjC] Support removing reference counting calls in more cases
@bdash is already working on this.
Since Nov 18, 2025.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
What is the feature you'd like to have?
Support for IL rewriting to remove Objective-C reference counting calls such as objc_retain / objc_release / objc_autorelease was implemented in https://github.com/Vector35/binaryninja-api/pull/7440 and released in Binary Ninja 5.2. The initial implementation has a couple of limitations:
- It is only enabled for arm64 / arm64e.
- It does not support removing functions that use a custom calling convention, such as
objc_retain_x1and friends that take their only argument in a specific register.
Addressing both of these requires more sophisticated IL rewriting in order to ensure that the argument to the function call being removed still ends up being available for the return value. For arm64 the first argument and result register are the same so we get away with replacing the call itself with a nop. This will need to be replaced by an explicit assignment of the first argument, whatever its location may be, to the result register.
Support for x86_64 also requires matching a wider range of LLIL patterns.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.