Repository navigation
[ppc64] Incorrect decompilation as a result of incorrect instruction width #8671
Description
Version and Platform (required):
- Binary Ninja Version: 6.1.10926-dev Ultimate, 479fee2a
- OS: macos
- OS Version: 27.0.1
- CPU Architecture: arm64
Bug Description:
10010158 0 38600001 li r3, 0x1
1001015c 0 786307c6 sldi r3, r3, 0x20 {0x100000000} ; r3 = 0x0000_0001_0000_0000
10010160 0 38800001 li r4, 0x1 ; r4 = 1
10010164 0 7f832000 cmpw cr7, r3, r4 ; 32-bit signed compare of the low words
10010168 0 4fdcf382 cror cr7eq, cr7lt, cr7eq ; cr7.eq = cr7.lt | cr7.eq (i.e. "<=")
1001016c 0 38e0000a li r7, 0xa
10010170 0 39000014 li r8, 0x14
10010174 0 7c67479e isel r3, r7, r8, 0x1e {0x0} {0xa} {0x14} ; r3 = cr7.eq ? r7 : r8
10010178 0 4e800020 blr
This is incorrectly folded to the following by HLIL:
10010174 return 0x14
The expected result is 0xa, not 0x14.
Steps To Reproduce:
Open this binary ppc64_cmpw_cror.zip and let it analyze.
Additional Information:
I think this is due to cmpw being lifted to a 64-bit subtraction despite the operands only being 32-bits in size:
0 @ 10010158 0 (LLIL_SET_REG.q r3 = (LLIL_CONST.q 1))
1 @ 1001015c 0 (LLIL_SET_REG.q r3 = (LLIL_LSL.q (LLIL_REG.q r3) << (LLIL_CONST.q 0x20)))
2 @ 10010160 0 (LLIL_SET_REG.q r4 = (LLIL_CONST.q 1))
3 @ 10010164 0 (LLIL_SUB.q sub.q{cr7_signed}((LLIL_REG.d r3.d), (LLIL_REG.d r4.d)))
You can see that the lifter uses the address size for the size of the subtraction, despite the instruction being a 32-bit comparison:
https://github.com/Vector35/binaryninja-api/blob/dev/arch/powerpc/il.cpp#L766-L772
Activity