binaryninja-api icon indicating copy to clipboard operation
binaryninja-api copied to clipboard

ARMv7 ARM rev instruction not lifted correctly: initial MSB is lost

Open MartijnB opened this issue 4 years ago • 1 comments

The rev instruction (rev r11, r11) is lifted to the following LL code:

45 @ 0001070c temp0.d = 0 46 @ 0001070c temp1.d = r11 47 @ 0001070c temp2.d = 0 48 @ 0001070c goto 49

49 @ 0001070c if (temp0.d != 3) then 50 else 55

50 @ 0001070c temp2.d = temp2.d | (temp1.d & 0xff) 51 @ 0001070c temp2.d = temp2.d << 8 52 @ 0001070c temp1.d = temp1.d u>> 8 53 @ 0001070c temp0.d = temp0.d + 1 54 @ 0001070c goto 49

55 @ 0001070c r11 = temp2.d

This looses the initial MSB (LSB of the output). So, when the input is 0x43424140 the output is 0x40414200 while I expect it to be 0x40414243.

Also, is there a particular reason why in this case a LL loop is used? Using bitwise operations seems to me to give a much nicer output, especially also in the HLIL.

MartijnB avatar May 29 '20 09:05 MartijnB