Vector35 / Vector35/binaryninja-api
[AArch64] Apple-specific system register names should not be present for all platforms
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Version and Platform (required):
- Binary Ninja Version: 5.3.8714-dev Ultimate, 4a6b6596
- OS: macos
- OS Version: 26.1.0
- CPU Architecture: arm64
Bug Description:
The aarch64 disassembler currently includes system register names derived from both the ARM ISA data set and from a set of Apple implementation-specific register names. There are two big problems with this:
- Apple register names are not applicable to non-Apple CPUs. Non-Apple CPUs may use the same implementation-defined system register for entirely different purposes.
- Apple register names may vary across different generations or models of Apple CPUs. Different CPUs may use the same implementation-defined system register for entirely different purposes.
Ideally the Apple-specific register names would be split out of the aarch64 disassembler and added only when the binary is known to be for an Apple platform.
There are a couple of challenges here:
- The Apple-specific register names need to be available for firmware that may not be using Mach-O files.
- The aarch64 architecture plug-in uses the system register names in a number of places:
- It generates an enum type from the system register names that is applied as the argument type of intrinsics that work with system registers.
- Lifting
mrs/mrsto IL is handled differently for known system register names. - System register names are looked up when generating the textual disassembly.
- System register names can be looked up via
GetRegisterName.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Begin in the AArch64 architecture plug-in and trace the system-register enum, MRS lifting, textual disassembly lookup, and GetRegisterName paths described in the issue. Compare how platform information is available for firmware and non-Mach-O inputs; done means Apple names are restricted appropriately without breaking generic register handling.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100