binaryninja-api icon indicating copy to clipboard operation
binaryninja-api copied to clipboard

64bit load to two 32bit variables does not correctly split across inherited boundary

Open wildex999 opened this issue 2 years ago • 0 comments

Version and Platform (required):

  • Binary Ninja Version: 3.6.4594-dev, but also seen on latest stable
  • OS: Windows 10
  • CPU Architecture: AArch64 and x64

Bug Description: An optimized 64bit write across two 32bit variables is usually recognized by Binary Ninja and split up into two assigns in the IL. However, when this crosses an inherited boundary, such that one 32bit variable is inherited, while the other is not, it will simply show it as a 64bit write to the first 32bit variable, which is incorrect!

This makes it quite annoying in cases where one of the variables contains the size of a buffer, or an offset etc. which I base other decisions on.

Steps To Reproduce:

  1. Create two classes, one inheriting the other:
class Class1
{
    void* ptr;
    int32_t length;
};
class __base(Class1, 0) Class2
{
    __inherited void* `Class1::ptr`;
    __inherited int32_t `Class1::length`;
    int32_t bufferSize;
};
  1. Apply to a location(Usually constructor) where it sets both Class1::length and Class2::bufferSize as a single 64bit load.
  2. Observe how it just shows a single 64bit assign to Class1::length.
  3. Remove the __inherited tag from Class1::length in Class2, and observe how it now correctly splits them into two assigns.

Expected Behavior: It should always recognize and split it up into multiple assigns, even in cases of inherited structs.

Screenshots: variable_split_bug_1

variable_split_bug_2

Additional Information: Here is a bndb showing the problem at location 0x140012579: bug_split_variable_inherited.zip

wildex999 avatar Oct 26 '23 20:10 wildex999