Vector35 / Vector35/binaryninja-api

Inconsistent lifting of aarch64 str/stp/strb to high-level IR

Open
#8,368 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 5.4.10202-dev Personal, 1b846134
  • OS: fedora-asahi-remix
  • OS Version: 44
  • CPU Architecture: arm64

Bug Description:

Binary Ninja is using array[N] = X and *(array + N) = X seemingly at random when lifting str/stp/strb aarch64 instructions to high-level IR. This behaviour is even more puzzling when looking at the medium-level IR, as there doesn't seem to be any inconsistencies there.

Steps To Reproduce:

  1. Open a binary containing a function using str/stp/strb instructions to move characters into an array
  2. Notice that Binary Ninja is using array[N] = X and *(array + N) = X seemingly at random, instead of picking one.

Expected Behavior:

Binary Ninja should pick either array[N] = X or *(array + N) = X (with a personal preference for the former) and stick to it.

Screenshots:

High-level IR vs. Dissasembly

Image

High-level IR vs. Medium-level IR

Image

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the inconsistent high-level IR output using a binary function with AArch64 str, stp, and strb instructions, then compare the high-level and medium-level IR as shown in the screenshots. Trace the lifting path for these instructions and verify that equivalent stores consistently use one representation. Done means the affected instructions produce consistent high-level IR while preserving the existing medium-level behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers, reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.