Closed D0ntPanic closed 11 months ago
All of the multiplication operations need to verified and fixed so that the operand sizes match the operation size.
Isn't the size of the multiplication operation the size of the result, and should therefore be the sum of the operands' sizes? relevant docs
Actual fix is at https://github.com/Vector35/arch-armv7/commit/8fb4292d846bdfc6818169f5abf9f7ca0a64f1ea.
We agreed in meeting:
LLIL_MUL
is truncating multiply, operand signs unimportantLLIL_MULS_DP
signed, output is double width of inputLLIL_MULU_DP
unsigned, output is double width of inputLLIL_MUL
)Which was clarified in our documentation at https://github.com/Vector35/binaryninja-api/commit/2f415e3da3a417160c07928cc8b91f42eddbac3f
A few additional multiply instructions were fixed in https://github.com/Vector35/arch-armv7/commit/8fb4292d846bdfc6818169f5abf9f7ca0a64f1ea and https://github.com/Vector35/arch-armv7/commit/59f92c3c551f65f04d5c10920e2625930a5b3faf but they don't seem to be critical for these magic constant division situations.
The armv7 lifter produces IL expressions where the size of a multiply operation does not match either of the input operands. This causes the analysis of optimized division to always fail to simplify into a division expression in armv7 binaries.
Several mulitply instructions are lifted in this way. All of the multiplication operations need to verified and fixed so that the operand sizes match the operation size.
Example binary:
armv7.zip