-
Notifications
You must be signed in to change notification settings - Fork 267
Open
Labels
Component: CoreIssue needs changes to the coreIssue needs changes to the coreCore: MLILIssue involves Medium Level ILIssue involves Medium Level ILEffort: MediumIssues require < 1 month of workIssues require < 1 month of workImpact: MediumIssue is impactful with a bad, or no, workaroundIssue is impactful with a bad, or no, workaround
Description
Version and Platform (required):
- Binary Ninja Version: stable 3.4 and 3.5.4402-dev (c2f291a7)
- OS: Ubuntu Linux
- OS Version: 22.04
- CPU Architecture: x64
Bug Description:
In Medium Level IL SSA-form: Field read of variable increments its SSA-label on subsequent reads, but new variable version is not explicitly defined. By definition SSA-form must define each variable exactly once before use.
0 @ 00009068 rax#1, mem#1 = ibnd_find_port_dr(arg1#0, arg2#0) @ mem#0
1 @ 0000906d rax_1#2.ax = rax#1->type @ mem#1 @ rax_1#1
2 @ 0000906d rax_1#3:2.w = rax#2->machine @ mem#1 @ rax_1#2
3 @ 0000906d rax_1#4:4.d = rax#3->version @ mem#1 @ rax_1#3
4 @ 00009075 return rax_1#4
Line 0 defines rax#1, line 2 uses rax#2 which is not defined. I recognize that the higher ILs can deal with the flawed SSA-form, however we initiate decompilation at MLIL-SSA and assume it to be correct.
Steps To Reproduce:
sample:
sample.zip
Reproduce with sample:
- open sample ff7dd0d1646de41634a8f9e35c8cf6d7afd360e74e380cb2ea57910a74d91892 in BN
- function symbol:
ibnd_find_node_dr
Expected Behavior:
We expect either, memory reads to not increment SSA-label, or, add definition of new variable versions.
Best regards
Metadata
Metadata
Assignees
Labels
Component: CoreIssue needs changes to the coreIssue needs changes to the coreCore: MLILIssue involves Medium Level ILIssue involves Medium Level ILEffort: MediumIssues require < 1 month of workIssues require < 1 month of workImpact: MediumIssue is impactful with a bad, or no, workaroundIssue is impactful with a bad, or no, workaround
