Skip to content

Improve lifting of ARMv7 logical not instruction #5097

@raminri

Description

@raminri

Version and Platform (required):

  • Binary Ninja Version: 3.6.4822-dev
  • OS: Windows
  • OS Version: 10
  • CPU Architecture: x64

Bug Description:
Consider the following C code:

int logical_not(int x)
{
    return !x;
}

I often see this pattern compiled into the following ARM assembly:

push {lr}
clz r0, r0
lsr r0, r0, #0x5
pop {pc}

In Binary Ninja, this decompiles into this HLIL:

uint32_t logical_not(uint32_t x)
    int32_t temp0 = 0
    uint32_t i = x
    while (i != 0)
        i = i u>> 1
        temp0 = temp0 + 1
    return (0x20 - temp0) u>> 5

For comparison, IDA decompiles this to:

bool logical_not(int x)
{
    return x == 0;
}

Steps To Reproduce:

  1. Create new blank view with Ctrl+N
  2. Paste in the following bytes: \x04\xe0\x2d\xe5\x10\x0f\x6f\xe1\xa0\x02\xa0\xe1\x04\xf0\x9d\xe4
  3. Create ARM function and view HLIL

Expected Behavior:
That code pattern should decompile more cleanly, since having the 5 extra lines and the loop makes code harder to understand.

Metadata

Metadata

Assignees

Labels

Arch: ARM/ThumbIssues with the ARM/Thumb architecture pluginComponent: ArchitectureIssue needs changes to an architecture pluginEffort: LowIssue should take < 1 weekImpact: HighIssue adds or blocks important functionalityLiftingissues related to LLIL lifting

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions