Jump to a function pointer struct field is treated as unresolved control flow

[VisualEhrmanntraut]

Version and Platform (required):

• Binary Ninja Version: 4.1.4942-dev
• OS: macOS
• OS Version: 14.4 (23E214)
• CPU Architecture: M1

Bug Description: Jump to a function pointer struct field is treated as unresolved control flow, wrecking analysis.

Expected Behavior: It's supposed to look something like this

Additional Information: The jumps (braa) is what I would assume a compiler optimisation. The issue doesn't seem to happen if it's using an instruction like blraa.

[xusheng6]

I am not expecting this to happen -- is the vt variable global? Could you please share the binary so that we can make sure of the cause of the issue?

[VisualEhrmanntraut]

is the vt variable global?

(pointer to struct for dynamic dispatch, so the values are defined globally, but the field is instantiated in runtime at type construction)

[xusheng6]

is the vt variable global?

(pointer to struct for dynamic dispatch, so the values are defined globally, but the field is instantiated in runtime at type construction)

Could you please also show the disassembly?

[VisualEhrmanntraut]

Could you please also show the disassembly?

Certainly.

[VisualEhrmanntraut]

(IOCommandGate_vt is a struct with __ptr_offset(0x10))

[xusheng6]

Thx for all the info!

[plafosse]

This might be related to https://github.com/Vector35/binaryninja-api/issues/1060