Block has wrong return value if it is reused by cascading math beforehand

[VisualEhrmanntraut]

Version and Platform (required):

• Binary Ninja Version: 4.3.6468-dev
• OS: macOS
• OS Version: 15.2 Beta (24C5089c)
• CPU Architecture: M3

Bug Description:
See below:


Result:

Expected Behavior:
Should be return 2

[xusheng6]

@VisualEhrmanntraut Any chance you can share the binary? Sorry that I am not connecting the dots

[VisualEhrmanntraut]

@xusheng6 No, sorry, but I can share any further information needed. Just tell me what you need.

[xusheng6]

@xusheng6 No, sorry, but I can share any further information needed. Just tell me what you need.

Sure, that is totally fine.

Can you show me the LLIL and MLIL as well? I am having some difficulty understanding what is going on

[VisualEhrmanntraut]

@xusheng6 Here,
LLIL

MLIL

[xusheng6]

So it seems to me the switch-case is using r8 as the control variable. However, I see it is compared against 0x2, which indicates some oddly looking code like this:

case 0x2:
    return 0x2;

where does the 0xb0007 come from?

[VisualEhrmanntraut]

It's a very weird function

[VisualEhrmanntraut]

essentially what this function does is convert a version number to an enumerator
i.e. 11.0.5 -> 1, 11.0.7 -> 2, etc

[xusheng6]

OK I now see how it works. Where is the result variable stored?

[xusheng6]

The code uses cascaded subtractions to take values off the incoming r8 register, and return rax values based on that. It seems we somehow screw up the return value tracking

[VisualEhrmanntraut]

@xusheng6 eax, afaict

[xusheng6]

Also @VisualEhrmanntraut , what about other cases after the one which should return 0x2? I see there should be quite a few more of them. Do we deal with it correctly?

[VisualEhrmanntraut]

@xusheng6 All of them seem correct except two, the "2" one and this

that one should be return 0x10

Full function:

[xusheng6]

I understand what is happening, but do not know why it is happening. Will need someone else to look into it

[SlidyBat]

I think this may be a duplicate of this issue: #6101

[VisualEhrmanntraut]

Hm, maybe. I didn't really know what to look for when creating the issue (or look through 1.5k issues).