Vector35 / Vector35/binaryninja-api

MIPS analysis is treating computed addresses as signed 32-bit integers instead of unsigned

Open
#7,805 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 5.2.8722 Personal, c75356aa
  • OS: windows
  • OS Version: 11
  • CPU Architecture: x86_64

Bug Description:
Binary Ninja's MIPS32 analysis is treating computed addresses as signed 32-bit integers instead of unsigned, causing addresses ≥ 0x80000000 to be interpreted as negative values that don't match the mapped memory ranges, preventing automatic cross-reference creation.

Binary:

Address: 0x9fc01068
Bytes:   3c 19 9f c0 27 39 28 9c 03 20 00 08 00 00 00 00

Get translated to:

9fc01068  3c 19 9f c0      li      $t9, -0x603fd764    ← WRONG: Shows as negative
9fc0106c  27 39 28 9c      addiu   $t9, $t9, 0x289c
9fc01070  03 20 00 08      jr      $t9                 ← WRONG: No function resolved
9fc01074  00 00 00 00      nop

What it should show:

9fc01068  3c 19 9f c0      lui     $t9, 0x9fc0        ← CORRECT: Positive immediate
9fc0106c  27 39 28 9c      addiu   $t9, $t9, 0x289c
9fc01070  03 20 00 08      jr      $t9 {target_function}  ← CORRECT: Function resolved
9fc01074  00 00 00 00      nop

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the MIPS32 analysis with the provided bytes at 0x9fc01068 and trace how the computed address is represented. Compare the signed and unsigned interpretations against the mapped memory range and cross-reference creation. Done means the address is treated as 0x9fc0289c and the jump resolves to the target function.

Written by the indexing model from the issue text.

Assessment

Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.