Vector35 / Vector35/binaryninja-api

Sound variable merge in HLIL results in incorrect decompilation

Open
#8,440 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Core Core: HLIL Core: MLIL Impact: Low
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform:

  • Binary Ninja Version: 6.0.10501-dev
  • Edition: Ultimate
  • OS: OSX
  • OS Version: 26.5.2
  • CPU Architecture: M3

Bug Description:
Merging two variables used as i in consecutive for loops results in semantically incorrect code when merging in the wrong order. When merging the second variable into the first, it loses that variable's first initialization. There might be another bug here that the initialization is not inside the for loop's initialization slot. Merging the second variable into the first seems to work how I expect it to.

Steps To Reproduce:

  1. Merge i_1 in the second for loop with i from the first
  2. See error

Expected Behavior:
I expect to see the initialization of i to zero before/inside the first for loop regardless of variable merge order (or for this behavior to be documented plus a warning when merging in the incorrect order, and probably not labeling them as sound merges).

Screenshots/Video Recording:
i merged with i_1, correctly clears value to zero before each loop
Image

i_1 merged with i, doesn't initialize i to zero
Image

Binary:
phoenix index traces logarithmically

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue in Binary Ninja's HLIL using the provided “phoenix index traces logarithmically” binary. Compare merging i_1 into i with the reverse order, then inspect the resulting initialization around both for loops. Done means the merged result preserves initialization to zero regardless of merge order, or the behavior is documented with an appropriate warning.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.