binaryninja-api
binaryninja-api copied to clipboard
RISC-V: Lifting bug in `JALR rd, rs1, imm` when `rd == rs1`
See here: https://github.com/Vector35/binaryninja-api/blob/7d0b6bc3f49070a10d6257628bbdf93e52d87fed/arch/riscv/src/lib.rs#L1220-L1234
If rd == rs1, but is neither zero or ra (x0 or x1 resp.), the above code will lift the jalr rd, rs1, imm instruction as follows:
# let's say rd == rs1 == t1
# target = t1 + imm
t1 = pc + 4 # inst_len==4
jump(target) <=> jump(t1 + imm) <=> jump(pc + 4 + imm)
Whereas the intended code should be lifted as:
tmp_register = t1 + imm
t1 = pc + 4
jump(tmp_register)