Vector35 / binaryninja-api

Public API, examples, documentation and issues for Binary Ninja
https://binary.ninja/
MIT License
887 stars 198 forks source link

The order of function's argument recovered is inconsistent with that in source code #5213

Open CupCupRay opened 5 months ago

CupCupRay commented 5 months ago

Version and Platform (required):

Bug Description: When I disassemble a function and try to recover its function prototypes, I find the argument information (mainly its order) is inconsistent with the source code. For example, in the function ConvertXYZtoLMS, the definition of argument arg1, 2, 3 in MLIL and pseudo code should be arg4, 5, 6 in source code. Are there any special settings that force BN to exchange arg1, 2, and 3 with arg4, 5, and 6?

Test project: ImageMagick-7.0.10-27 Source file: ImageMagick-7.0.10-27/MagickCore/colorspace.c

Expected Behavior: The recovered arg1 should be indicated by the instruction 0x08b3aa instead of 0x08b3b9. Same as other arguments.

Screenshots: BN_ConvertXYZToLMS-Copy

xusheng6 commented 5 months ago

It seems we are putting the xmm registers ahead of the rdi/rsi/rdx registers. The resulting decompilation is not technically wrong, but it would be better if we can change the order to match that in the source code.