Vector35 / Vector35/binaryninja-api

The `Override Call Type...` UI command doesn't appear when HLIL has multiple calls in a single HLIL instruction

Open
#7,983 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 5.3.9147-dev Ultimate (209ad20f)
  • Edition: Ultimate
  • OS: macOS
  • OS Version: 26.3
  • CPU Architecture: M1

Bug Description:
When a HLIL instruction (or line?) has multiple call expressions, the Override Call Type... UI command does not appear in the right-click menu. If there is just a single call in a HLIL instruction it works fine.

Expected Behavior:
The command should be able to handle when there are multiple calls in a single HLIL instruction. In the screenshot below I should be able to override the call type of both the outer and inner calls to objc_msgSend.

Screenshots/Video Recording:

Image

Binary:
The screenshot comes from the function -[NSRTFD writePath:docInfo:errorHandler:remapContents:markBusy:hardLinkPath:] in the Foundation library for the DYLD Shared Cache for iOS 26.0 for an iPhone 17 Pro Max.

Additional Information:
This issue seems to have always existed, I just hadn't reported it until now. The workaround is simply to find the call in MLIL and apply the override that way. Its a bit of an inconvenience because I don't normally have HLIL and MLIL side by side (usually HLIL and disassembly) but it does work.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue in the HLIL UI using the reported Foundation function, comparing a single-call instruction with one containing nested calls. Check how the right-click menu handles call selection and compare the behavior with the MLIL workaround; done means the command appears for the HLIL instruction and supports both calls.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.