Vector35 / Vector35/binaryninja-api

[AArch64] Apple-specific system register names should not be present for all platforms

Open
#7,737 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Arch: ARM64 Component: Architecture Impact: Low
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 5.3.8714-dev Ultimate, 4a6b6596
  • OS: macos
  • OS Version: 26.1.0
  • CPU Architecture: arm64

Bug Description:
The aarch64 disassembler currently includes system register names derived from both the ARM ISA data set and from a set of Apple implementation-specific register names. There are two big problems with this:

  • Apple register names are not applicable to non-Apple CPUs. Non-Apple CPUs may use the same implementation-defined system register for entirely different purposes.
  • Apple register names may vary across different generations or models of Apple CPUs. Different CPUs may use the same implementation-defined system register for entirely different purposes.

Ideally the Apple-specific register names would be split out of the aarch64 disassembler and added only when the binary is known to be for an Apple platform.

There are a couple of challenges here:

  1. The Apple-specific register names need to be available for firmware that may not be using Mach-O files.
  2. The aarch64 architecture plug-in uses the system register names in a number of places:
    1. It generates an enum type from the system register names that is applied as the argument type of intrinsics that work with system registers.
    2. Lifting mrs / mrs to IL is handled differently for known system register names.
    3. System register names are looked up when generating the textual disassembly.
    4. System register names can be looked up via GetRegisterName.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Begin in the AArch64 architecture plug-in and trace the system-register enum, MRS lifting, textual disassembly lookup, and GetRegisterName paths described in the issue. Compare how platform information is available for firmware and non-Mach-O inputs; done means Apple names are restricted appropriately without breaking generic register handling.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.