Vector35 / Vector35/binaryninja-api
The `Override Call Type...` UI command doesn't appear when HLIL has multiple calls in a single HLIL instruction
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Version and Platform (required):
- Binary Ninja Version: 5.3.9147-dev Ultimate (209ad20f)
- Edition: Ultimate
- OS: macOS
- OS Version: 26.3
- CPU Architecture: M1
Bug Description:
When a HLIL instruction (or line?) has multiple call expressions, the Override Call Type... UI command does not appear in the right-click menu. If there is just a single call in a HLIL instruction it works fine.
Expected Behavior:
The command should be able to handle when there are multiple calls in a single HLIL instruction. In the screenshot below I should be able to override the call type of both the outer and inner calls to objc_msgSend.
Screenshots/Video Recording:
Binary:
The screenshot comes from the function -[NSRTFD writePath:docInfo:errorHandler:remapContents:markBusy:hardLinkPath:] in the Foundation library for the DYLD Shared Cache for iOS 26.0 for an iPhone 17 Pro Max.
Additional Information:
This issue seems to have always existed, I just hadn't reported it until now. The workaround is simply to find the call in MLIL and apply the override that way. Its a bit of an inconvenience because I don't normally have HLIL and MLIL side by side (usually HLIL and disassembly) but it does work.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue in the HLIL UI using the reported Foundation function, comparing a single-call instruction with one containing nested calls. Check how the right-click menu handles call selection and compare the behavior with the MLIL workaround; done means the command appears for the HLIL instruction and supports both calls.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100