Vector35 / Vector35/binaryninja-api

[ObjC] Support removing reference counting calls in more cases

Open
#7,660 0 comments 0 reactions 1 assignee View on GitHub

@bdash is already working on this.

Since Nov 18, 2025.

Effort: Low Impact: Low Language: Objective-C
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

What is the feature you'd like to have?
Support for IL rewriting to remove Objective-C reference counting calls such as objc_retain / objc_release / objc_autorelease was implemented in https://github.com/Vector35/binaryninja-api/pull/7440 and released in Binary Ninja 5.2. The initial implementation has a couple of limitations:

  1. It is only enabled for arm64 / arm64e.
  2. It does not support removing functions that use a custom calling convention, such as objc_retain_x1 and friends that take their only argument in a specific register.

Addressing both of these requires more sophisticated IL rewriting in order to ensure that the argument to the function call being removed still ends up being available for the return value. For arm64 the first argument and result register are the same so we get away with replacing the call itself with a nop. This will need to be replaced by an explicit assignment of the first argument, whatever its location may be, to the result register.

Support for x86_64 also requires matching a wider range of LLIL patterns.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.