Skip to content

MediumLevelILSSAForm: use of undefined variable #4504

@mm4rks

Description

@mm4rks

Version and Platform (required):

  • Binary Ninja Version: stable 3.4 and 3.5.4402-dev (c2f291a7)
  • OS: Ubuntu Linux
  • OS Version: 22.04
  • CPU Architecture: x64

Bug Description:
In Medium Level IL SSA-form: Field read of variable increments its SSA-label on subsequent reads, but new variable version is not explicitly defined. By definition SSA-form must define each variable exactly once before use.

   0 @ 00009068  rax#1, mem#1 = ibnd_find_port_dr(arg1#0, arg2#0) @ mem#0
   1 @ 0000906d  rax_1#2.ax = rax#1->type @ mem#1 @ rax_1#1
   2 @ 0000906d  rax_1#3:2.w = rax#2->machine @ mem#1 @ rax_1#2
   3 @ 0000906d  rax_1#4:4.d = rax#3->version @ mem#1 @ rax_1#3
   4 @ 00009075  return rax_1#4

Line 0 defines rax#1, line 2 uses rax#2 which is not defined. I recognize that the higher ILs can deal with the flawed SSA-form, however we initiate decompilation at MLIL-SSA and assume it to be correct.

Steps To Reproduce:
sample:
sample.zip

Reproduce with sample:

  1. open sample ff7dd0d1646de41634a8f9e35c8cf6d7afd360e74e380cb2ea57910a74d91892 in BN
  2. function symbol: ibnd_find_node_dr

Expected Behavior:
We expect either, memory reads to not increment SSA-label, or, add definition of new variable versions.

Screenshots:
image

Best regards

Metadata

Metadata

Assignees

No one assigned

    Labels

    Component: CoreIssue needs changes to the coreCore: MLILIssue involves Medium Level ILEffort: MediumIssues require < 1 month of workImpact: MediumIssue is impactful with a bad, or no, workaround

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions