binaryninja-api icon indicating copy to clipboard operation
binaryninja-api copied to clipboard

Lifting for PC-relative `vldr` instruction does not align PC when calculating address

Open whitequark opened this issue 5 months ago • 2 comments

Version and Platform (required):

  • Binary Ninja Version: 5.1.7598-test Ultimate (0e5168d7)
  • Edition: Ultimate
  • OS: Debian Linux
  • OS Version: 13
  • CPU Architecture: x86_64

Bug Description: This vldr instruction:

Image

Loads from 802808a:

Image

However, consulting the ARM ARM for VLDR, it's clear that the base address is word aligned when PC is the base register:

Image

Since the address expression is [pc, 0x58], where the displacement is a multiple of 4, the instruction cannot be loading anything from an address ending in ...a.

Steps To Reproduce:

  1. Open attached BNDB

Expected Behavior: Load from the correct address.

Binary: bug_vfp.zip

whitequark avatar Jun 11 '25 23:06 whitequark

The actual literal it's loading is 100.0, from 8028088.

whitequark avatar Jun 11 '25 23:06 whitequark

Broken lifting is here:

Armv7: https://github.com/Vector35/binaryninja-api/blob/5320c6967cd380fd73be079675a960f22ba53b40/arch/armv7/il.cpp#L4962 Thumb2: https://github.com/Vector35/binaryninja-api/blob/5320c6967cd380fd73be079675a960f22ba53b40/arch/armv7/thumb2_disasm/il_thumb2.cpp#L2041

plafosse avatar Jun 17 '25 13:06 plafosse

I have a fix for this for thumb2 on a local branch. AFAICT, it's a non-issue for ARMv7, because the PC will always be 4-byte aligned anyway (and if it isn't, that means disassembly is happening in the wrong place, so there are bigger problems going on than this).

I will merge after the release.

galenbwill avatar Jul 25 '25 15:07 galenbwill

I got this code out of a firmware for STM32H743, so v7m.

edit: oh, you meant ARMv7 as in "ARM mode", nevermind.

whitequark avatar Jul 26 '25 03:07 whitequark