Changing return type to one requiring indirect return does not update parameter locations

Open

#8,429 opened on Aug 18, 2026 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 48/100

Issue type: Bug
Clarity: Mostly clear
Activity status: Quiet
Tech stack: cpp
Domain: reverse-engineering

Research direction

Start by reproducing the behavior in Binary Ninja 5.4.10468-dev using the supplied binary, type definitions, and return-type changes. Verify the parameter locations for Class::small, Class::pair, Class::big, and Class::huge; done means this is not explicitly pinned to rdi for big or huge and indirect returns update the locations correctly.

Written by the indexing model from the issue text.

Description

Core: Calling Convention

Version and Platform (required):

Binary Ninja Version: 5.4.10468-dev Ultimate, 32fed8b7
OS: macos
OS Version: 26.5.2
CPU Architecture: arm64

Bug Description:
Changing the return type of a function in a mac-x86_64 binary:

100000390    struct Class* Class::big(struct Class* this)

to Big results in:

100000390    struct Big Class::big(struct Class* this @ rdi)

Big is:

struct Big
{
    int64_t a;
    int64_t b;
    int64_t c;
    int64_t d;
};

and causes the return value to be passed indirectly. this should move to rsi, but becomes explicitly pinned to rdi.

Steps To Reproduce:

Download dynamic mountain raises freely.
Define these types:

struct Big
{
    int64_t a;
    int64_t b;
    int64_t c;
    int64_t d;
};

struct Class
{
    int64_t x;
};

struct Huge
{
    int64_t v[0x10];
};

struct Pair
{
    int64_t a;
    int64_t b;
};

struct Small
{
    int64_t a;
};

Change the return types of each of Class::small, Class::pair, Class::big, and Class:huge to their matching type.

Expected Behavior:
this does not grow an explicit location in Class::big or Class::huge.

Binary:
dynamic mountain raises freely

Dominant language: C++
Stars: 1.3k
Forks: 298
Avg merge: 4d 13h
Merged PRs (30d): 20

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

Fix locale comparison when loading system translations Open

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

rizinorg/cutter#3664 · Opened Sep 23, 2026
Request headers and POST/PUT bodies silently corrupted once the wasm heap passes 2 GiB (signed pointers in http_wasm.cc) Open

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

duckdb/duckdb-wasm#2258 · Opened Sep 23, 2026
Dijkstra entry point crashes with ArrayIndexOutOfBoundsException when a vertex id exceeds the argument count Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

objectionary/eo-graphs#75 · Opened Sep 23, 2026
Coarray integration tests carry no LABELS, so run_tests.py silently skips them under every backend Open

coarray

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

lfortran/lfortran#13405 · Opened Sep 23, 2026
op-genesis-to-allocs.py: merge --rollup fork times per key instead of wholesale override Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

FISCO-BCOS/FISCO-BCOS#5642 · Opened Sep 23, 2026

More C++ issues