binaryninja-api icon indicating copy to clipboard operation
binaryninja-api copied to clipboard

Variables with scattered backing

Open ehntoo opened this issue 4 months ago • 3 comments

Version and Platform (required):

  • Binary Ninja Version: 4.2.6187-dev
  • OS: Ubuntu
  • OS Version: 24.04.1
  • CPU Architecture: x64

Bug Description: While working on a custom architecture, I was having issues with 64-bit returns from functions only showing the 32-bit primary return register value in MLIL and HLIL. After some investigation, it seems this also applies to other architectures like ARMv7 - even after setting the return type for a trivial function to uint64_t, Binary Ninja only presents the value in r0 as the value returned from the function.

Steps To Reproduce:

  1. Save the hex 01 00 a0 e3 02 10 a0 e3 1e ff 2f e1 into a new .bin file (also provided in the .zip attached to the issue)
  2. Load the .bin file in Binary Ninja with the architecture set to armv7
  3. Switch to mapped view
  4. Create a function at the start of the file
  5. Change the return type of the function to uint64_t
  6. Switch to MLIL or HLIL views
  7. Observe that the return value is shown as 1 rather than 0x200000001

Even if the function properties are edited to include r1 in the return registers, the HLIL still does not return 0x200000001 as expected, showing return 1, 2 instead.

Expected Behavior: HLIL should show a return value of 0x200000001 since the calling convention has high_int_return_reg = 'r1' and the return type is wider than the normal return value register.

Screenshots/Video Recording: Screenshot 2024-10-11 at 6 24 16 PM Screenshot 2024-10-11 at 6 24 32 PM

Binary: test.zip

ehntoo avatar Oct 11 '24 22:10 ehntoo