Thumb2: Recognizing doubles

[joelreymont]

Version and Platform (required):

• Binary Ninja Version: 3.4.4251-dev, 3f761e0a
• OS: ubuntu
• OS Version: 22.10
• CPU Architecture: x86_64

Code below is loading an 8-byte value into a floating point register.

000020792  93ed047b   vldr    d7, [r3, #0x10]  {data_dd908}  {0xfefa0000}

Why doesn't BN automatically define a double at data_dd908?

\x00\x00\x00\x00\x00\x008C\x00\x00\xfa\xfeB.v\xbf:;\x9e\xbc\x9a\xf7\x0c\xbd\xbd\xfd\xff\xff\xff\xff\xdf?

HLIL thinks I'm dealing with integers

00002078e          q1 = (0 - *(int64_t*)((char*)q1)[8]);

Is this because I implemented VLDR as a regular register load?

	case armv7::ARMV7_VLDR:
		if (instr->format->operandCount == 3)
		{
			uint32_t reg = GetRegisterByIndex(instr->fields[instr->format->operands[1].field0]);
			il.AddInstruction(WriteILOperand(il, instr, 0, il.Load(4, GetMemoryAddress(il, instr, 1, 4, false))));
			il.AddInstruction(il.SetRegister(4, reg, il.Add(4, il.Register(4, reg), ReadILOperand(il, instr, 2))));
		}
		else
		{
			il.AddInstruction(WriteILOperand(il, instr, 0, il.Load(4, GetMemoryAddress(il, instr, 1, 4))));
		}
		break;

[plafosse]

Yes I would assume because the IL isn't loading it as a float

[joelreymont]

How do I make IL treat it as a float then?

…

On Mon, Apr 24, 2023 at 4:03 PM Peter LaFosse ***@***.***> wrote: Yes I would assume because the IL isn't loading it as a float — Reply to this email directly, view it on GitHub <#4262 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAESZ2QU6WJZEXVLLPPWGDXCZ2Y7ANCNFSM6AAAAAAXJRSCK4> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[plafosse]

Something like

il.AddInstruction(WriteILOperand(il, instr, 0, il.FloatConvert(4, il.Load(4, GetMemoryAddress(il, instr, 1, 4)))));

I think.

[plafosse]

For an example of this see: https://github.com/Vector35/arch-x86/blob/5b134ac7da45c009094faf654f613a9ecd11cae8/il.cpp#L286

[joelreymont]

Where does the float conversion go in VSTR, VPOP and VPUSH?

[plafosse]

As those are only storing and retrieving from memory I don't think we'd necessarily want to convert them to floating point. In fact I don' t know that my original answer is correct since the destination register is a vector register we don't know what the size of the elements are in it, and we won't know until some other operation is performed on the register.

[joelreymont]

Yes, the original answer doesn't seem to do anything.

The assembler code looks like this.

000020774  6e4b       ldr     r3, [pc, #0x1b8]  {data_20930}
000020776  9ded005b   vldr    d5, [sp] {var_38}
00002077a  93ed026b   vldr    d6, [r3, #8]  {0xdd900}
00002077e  93ed007b   vldr    d7, [r3]  {data_dd8f8}  {0x652b82fe}
000020782  b0ee464b   vmov.f64.F64 d4, d6
🚫000020786  a7ee054b   vfma.f64.F64 d4, d7, d5
00002078a  14ee107a   vmov    r7, s8
00002078e  34ee464b   vsub.f64.F64 d4, d4, d6
000020792  93ed047b   vldr    d7, [r3, #0x10]  {0xdd908}  {0xfefa0000}
000020796  93ed066b   vldr    d6, [r3, #0x18]  {0xdd910}
🚫00002079a  a7ee045b   vfma.f64.F64 d5, d7, d4
00002079e  b0ee457b   vmov.f64.F64 d7, d5

[joelreymont]

Just recognizing VLDR into a double and single float registers would be a huge leg up over the current situation where I have to look at BN and IDA side-by-side and define doubles per IDA.

Also, this causes BN to generate wrong disassembly, e.g.

000008df8  int32_t* data_8df8 = data_2005b7b4

000008dfc  int32_t sub_8dfc(int32_t* arg1 @ r4, int32_t arg2 @ r5, int32_t arg3 @ r7, int32_t arg4 @ r8, int32_t arg5 @ r9, int32_t arg6 @ r10, int32_t arg7 @ r11, 
000008dfc      int32_t arg8, int32_t arg9, int32_t arg10, int32_t arg11, int32_t arg12, int32_t arg13, int32_t arg14, int32_t arg15, int32_t arg16, int32_t arg17, 
000008dfc      int32_t arg18, int32_t arg19, char arg20, char arg21, int32_t arg22, int32_t arg23, int32_t arg24, int32_t arg25, int32_t arg26, int32_t arg27, 
000008dfc      int32_t arg28, int32_t arg29, int32_t* arg30, int32_t arg31)

000008dfc  bd37       adds    r7, #0xbd
000008dfe  86b5       push    {r1, r2, r7, lr} {var_4} {var_8} {var_c} {var_10}
000008e00  cdcc       ldm     r4!, {r0, r2, r3, r6, r7}
000008e02  cc3d       subs    r5, #0xcc
000008e04  0000       movs    r0, r0
000008e06  0000       movs    r0, r0

instead of

000008df8  int32_t* data_8df8 = data_2005b7b4
000008dfc  float data_8dfc = -9.99999997e-07
000008e00  float data_8e00 = 0.100000001
000008e04  float data_8e04 = 0

[joelreymont]

How do I recognize that I'm loading into a double register as opposed to a float one so that BN types my data as double and float respectively? For example,

0000086cc  9fed760b   vldr    d0, [pc, #0x1d8]  {data_88a8}

vs

000008674  dfed916a   vldr    s13, [pc, #0x244]  {data_88bc}  {0x42652ee1}

[joelreymont]

I tried adding the FloatConvert. It shows up in the LLIL but does nothing to create a double at the memory location VLDR refers to. There's still an int32_t variable at that location.

[plafosse]

I believe the root cause here is that we aren't doing this: #4400