binaryninja-api
binaryninja-api copied to clipboard
ARMv7 ARM rev instruction not lifted correctly: initial MSB is lost
The rev instruction (rev r11, r11) is lifted to the following LL code:
45 @ 0001070c temp0.d = 0 46 @ 0001070c temp1.d = r11 47 @ 0001070c temp2.d = 0 48 @ 0001070c goto 49
49 @ 0001070c if (temp0.d != 3) then 50 else 55
50 @ 0001070c temp2.d = temp2.d | (temp1.d & 0xff) 51 @ 0001070c temp2.d = temp2.d << 8 52 @ 0001070c temp1.d = temp1.d u>> 8 53 @ 0001070c temp0.d = temp0.d + 1 54 @ 0001070c goto 49
55 @ 0001070c r11 = temp2.d
This looses the initial MSB (LSB of the output). So, when the input is 0x43424140 the output is 0x40414200 while I expect it to be 0x40414243.
Also, is there a particular reason why in this case a LL loop is used? Using bitwise operations seems to me to give a much nicer output, especially also in the HLIL.