Skip to content

64bit load to two 32bit variables does not correctly split across inherited boundary #4709

@wildex999

Description

@wildex999

Version and Platform (required):

  • Binary Ninja Version: 3.6.4594-dev, but also seen on latest stable
  • OS: Windows 10
  • CPU Architecture: AArch64 and x64

Bug Description:
An optimized 64bit write across two 32bit variables is usually recognized by Binary Ninja and split up into two assigns in the IL. However, when this crosses an inherited boundary, such that one 32bit variable is inherited, while the other is not, it will simply show it as a 64bit write to the first 32bit variable, which is incorrect!

This makes it quite annoying in cases where one of the variables contains the size of a buffer, or an offset etc. which I base other decisions on.

Steps To Reproduce:

  1. Create two classes, one inheriting the other:
class Class1
{
    void* ptr;
    int32_t length;
};
class __base(Class1, 0) Class2
{
    __inherited void* `Class1::ptr`;
    __inherited int32_t `Class1::length`;
    int32_t bufferSize;
};
  1. Apply to a location(Usually constructor) where it sets both Class1::length and Class2::bufferSize as a single 64bit load.
  2. Observe how it just shows a single 64bit assign to Class1::length.
  3. Remove the __inherited tag from Class1::length in Class2, and observe how it now correctly splits them into two assigns.

Expected Behavior:
It should always recognize and split it up into multiple assigns, even in cases of inherited structs.

Screenshots:
variable_split_bug_1

variable_split_bug_2

Additional Information:
Here is a bndb showing the problem at location 0x140012579:
bug_split_variable_inherited.zip

Metadata

Metadata

Assignees

Labels

Component: CoreIssue needs changes to the coreEffort: TrivialIssues require < 1 day of workImpact: MediumIssue is impactful with a bad, or no, workaround

Type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions