Vector35 / binaryninja-api

Public API, examples, documentation and issues for Binary Ninja
https://binary.ninja/
MIT License
875 stars 196 forks source link

Incorrectly lifted conditional ARM instruction involving hs/cs flag #3991

Open MartijnB opened 4 years ago

MartijnB commented 4 years ago

The ASM:

00010414 482015e5 ldr r2, [r5, #-0x48] {var_1068} 00010418 023992e2 add.s r3, r2, #0x8000 0001041c 483005e5 str r3, [r5, #-0x48] {var_1068} 00010420 44301525 ldrhs r3, [r5, #-0x44] {var_1064} 00010424 01308322 addhs r3, r3, #0x1 00010428 44300525 strhs r3, [r5, #-0x44] {var_1064}

IDA decompiles this to:
v6 = ctx.count[0]; ctx.count[0] += 0x8000; if ( v6 >= 0xFFFF8000 ) ++ctx.count[1];

Which I think is correct.

BINJA however seems to invert the condition:

00010414 r2_1 = var_1068 00010418 int32_t r3_2 = r2_1 + 0x8000 00010418 bool c_1 = r2_1 u>= 0xffff8000 0001041c var_1068 = r3_2 00010420 if (not(c_1)) 00010420 r3_2 = var_1064 00010424 r3_2 = r3_2 + 1 00010428 var_1064 = r3_2

I THINK if (not(c_1)) should be if (c_1).

However, analysing the lifted IR, I cannot explain why this happens:

afbeelding

Lifted:

afbeelding

LL:

afbeelding

xusheng6 commented 1 year ago

yeah it does seem to me that the condition is reversed. Not sure if this is a bug in the lifter, or the flag resolver.