Vector35 / Vector35/binaryninja-api

Duplicate HighIL statement when lifting `fsbase + 0x28`

Open
#8,439 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 5.4.10466-dev Personal (42e25af5)
  • Edition: Non-Commercial
  • OS: Fedora Linux
  • OS Version: 44
  • CPU Architecture: M2

Bug Description:

The following assembly:

00402f38  488b55f8            mov     rdx, qword [rbp-0x8 {var_10}]
00402f3c  64482b142528000000  sub     rdx, qword [fs:0x28]
00402f45  7405                je      0x402f4c

is lifted to HighIL:

00402f3c        *(fsbase + 0x28)
00402f3c        
00402f45        if (rax != *(fsbase + 0x28))

instead of being correctly lifted to HighIL

00402f45        if (rax != *(fsbase + 0x28))

Steps To Reproduce:
Please provide all steps required to reproduce the behavior:

  1. Open the binary
  2. Go to 0x402f3c
  3. Notice the incorrect lifting

Expected Behavior:

I expect the following assembly:

00402f38  488b55f8            mov     rdx, qword [rbp-0x8 {var_10}]
00402f3c  64482b142528000000  sub     rdx, qword [fs:0x28]
00402f45  7405                je      0x402f4c

to be correctly lifted to HighIL:

00402f45        if (rax != *(fsbase + 0x28))

Screenshots/Video Recording:

Image

Binary:

Reference phrase: celestial system cycles delicately

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the case at 0x402f3c using the assembly and HighIL shown in the issue, then trace the lifting path for the fsbase + 0x28 operand. Done means the standalone duplicate expression is absent and the conditional retains the expected HighIL form.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.