Vector35 / Vector35/binaryninja-api
Inconsistent lifting of aarch64 str/stp/strb to high-level IR
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Version and Platform (required):
- Binary Ninja Version: 5.4.10202-dev Personal, 1b846134
- OS: fedora-asahi-remix
- OS Version: 44
- CPU Architecture: arm64
Bug Description:
Binary Ninja is using array[N] = X and *(array + N) = X seemingly at random when lifting str/stp/strb aarch64 instructions to high-level IR. This behaviour is even more puzzling when looking at the medium-level IR, as there doesn't seem to be any inconsistencies there.
Steps To Reproduce:
- Open a binary containing a function using str/stp/strb instructions to move characters into an array
- Notice that Binary Ninja is using
array[N] = Xand*(array + N) = Xseemingly at random, instead of picking one.
Expected Behavior:
Binary Ninja should pick either array[N] = X or *(array + N) = X (with a personal preference for the former) and stick to it.
Screenshots:
High-level IR vs. Dissasembly
High-level IR vs. Medium-level IR
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the inconsistent high-level IR output using a binary function with AArch64 str, stp, and strb instructions, then compare the high-level and medium-level IR as shown in the screenshots. Trace the lifting path for these instructions and verify that equivalent stores consistently use one representation. Done means the affected instructions produce consistent high-level IR while preserving the existing medium-level behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers, reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100