Vector35 / Vector35/binaryninja-api

aarch64 disassembler test failure for D50049BF instruction

Open Beginner friendly
#8,098 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Arch: ARM64
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Hi,

The test cases are failing for D50049BF instruction.

// MSR_SI_pstate 1101010100000xxxxxxxxxxxxxxxxxxx
D50049BF: -msr pstate_spsel, #0x9- vs -msr spsel, #0x9-
0xD50049BF
  actual:  msr pstate_spsel, #0x9 
expected:  msr spsel, #0x9 
line 22420/46060 (48.68%)

The error appears to be in decode_scratchpad.c here:

        case ENC_MSR_SI_PSTATE:
        {       
                SystemReg sr = SYSREG_NONE;
                if (ctx->op1 == 0 && ctx->op2 == 3 && HaveUAO())
                        sr = REG_UAO;  // "UAO";
                else if (ctx->op1 == 0 && ctx->op2 == 4 && HavePAN())
                        sr = REG_PAN;  // "PAN";
                else if (ctx->op1 == 0 && ctx->op2 == 5)
                        sr = REG_PSTATE_SPSEL;  // "SPSel";
                else if (ctx->op1 == 3 && ctx->op2 == 1 && HaveSSBS())
                        sr = REG_SSBS;  // "SSBS"; 
                else if (ctx->op1 == 3 && ctx->op2 == 2 && HaveDIT())
                        sr = REG_DIT;  // "DIT";
                else if (ctx->op1 == 3 && ctx->op2 == 4 && HasMTE())
                        sr = REG_TCO;  // "TCO";
                else if (ctx->op1 == 3 && ctx->op2 == 6 && HasMTE())
                        sr = REG_DAIFSET;  // "DAIFSet";
                else if (ctx->op1 == 3 && ctx->op2 == 7 && HasMTE())
                        sr = REG_DAIFCLR;  // "DAIFClr";

Where it's setting sr to REG_PSTATE_SPSEL instead of REG_SPSEL.

From what I could find in the documentation the test case is correct and the instruction should decode to msr spsel, #0x9.

Thanks for a great aarch64 disassembler library!

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in decode_scratchpad.c at the ENC_MSR_SI_PSTATE case and inspect how the SPSel system register is selected. Reproduce the aarch64 disassembler test failure for D50049BF, then verify that the decoded output matches the expected msr spsel, #0x9 rather than pstate_spsel, #0x9.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
reverse-engineering
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.