binaryninja-api
binaryninja-api copied to clipboard
Lifting for PC-relative `vldr` instruction does not align PC when calculating address
Version and Platform (required):
- Binary Ninja Version: 5.1.7598-test Ultimate (0e5168d7)
- Edition: Ultimate
- OS: Debian Linux
- OS Version: 13
- CPU Architecture: x86_64
Bug Description:
This vldr instruction:
Loads from 802808a:
However, consulting the ARM ARM for VLDR, it's clear that the base address is word aligned when PC is the base register:
Since the address expression is [pc, 0x58], where the displacement is a multiple of 4, the instruction cannot be loading anything from an address ending in ...a.
Steps To Reproduce:
- Open attached BNDB
Expected Behavior: Load from the correct address.
Binary: bug_vfp.zip
The actual literal it's loading is 100.0, from 8028088.
Broken lifting is here:
Armv7: https://github.com/Vector35/binaryninja-api/blob/5320c6967cd380fd73be079675a960f22ba53b40/arch/armv7/il.cpp#L4962 Thumb2: https://github.com/Vector35/binaryninja-api/blob/5320c6967cd380fd73be079675a960f22ba53b40/arch/armv7/thumb2_disasm/il_thumb2.cpp#L2041
I have a fix for this for thumb2 on a local branch. AFAICT, it's a non-issue for ARMv7, because the PC will always be 4-byte aligned anyway (and if it isn't, that means disassembly is happening in the wrong place, so there are bigger problems going on than this).
I will merge after the release.
I got this code out of a firmware for STM32H743, so v7m.
edit: oh, you meant ARMv7 as in "ARM mode", nevermind.