Duplicate HighIL statement when lifting `fsbase + 0x28`

Open

#8,439 opened on Aug 19, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 45/100

Issue type: Bug
Clarity: Mostly clear
Activity status: Quiet
Tech stack: cpp
Domain: reverse-engineering

Research direction

Reproduce the case at 0x402f3c using the assembly and HighIL shown in the issue, then trace the lifting path for the fsbase + 0x28 operand. Done means the standalone duplicate expression is absent and the conditional retains the expected HighIL form.

Written by the indexing model from the issue text.

Description

Version and Platform (required):

Binary Ninja Version: 5.4.10466-dev Personal (42e25af5)
Edition: Non-Commercial
OS: Fedora Linux
OS Version: 44
CPU Architecture: M2

Bug Description:

The following assembly:

00402f38  488b55f8            mov     rdx, qword [rbp-0x8 {var_10}]
00402f3c  64482b142528000000  sub     rdx, qword [fs:0x28]
00402f45  7405                je      0x402f4c

is lifted to HighIL:

00402f3c        *(fsbase + 0x28)
00402f3c        
00402f45        if (rax != *(fsbase + 0x28))

instead of being correctly lifted to HighIL

00402f45        if (rax != *(fsbase + 0x28))

Steps To Reproduce:
Please provide all steps required to reproduce the behavior:

Open the binary
Go to 0x402f3c
Notice the incorrect lifting

Expected Behavior:

I expect the following assembly:

00402f38  488b55f8            mov     rdx, qword [rbp-0x8 {var_10}]
00402f3c  64482b142528000000  sub     rdx, qword [fs:0x28]
00402f45  7405                je      0x402f4c

to be correctly lifted to HighIL:

00402f45        if (rax != *(fsbase + 0x28))

Screenshots/Video Recording:

Binary:

Reference phrase: celestial system cycles delicately

Dominant language: C++
Stars: 1.3k
Forks: 298
Avg merge: 4d 13h
Merged PRs (30d): 20

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

Use 4:4:4 for multichannel AVIF and HEIF gain maps Open

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

google/libultrahdr#485 · Opened Sep 24, 2026
Missing tile warnings in TileMap dock display with wrong texture filter Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

godotengine/godot#123776 · Opened Sep 23, 2026
if(cond,a,b) treats any nonzero cond as true in every bngsim backend (ExprTk interpreter, C codegen, SSA), which contradicts docs/reference/expressions.md ('true when > 0.5') and BNG's run_network. A non-boolean condition in (-inf,0) or... Open

bug

Difficulty 1/5 Under an hour Newbie friendliness 60/100

lanl/bngsim#774 · Opened Sep 23, 2026
Delete ament_export_include_directories() and ament_export_libraries() calls Open

good first issue

Difficulty 1/5 Under an hour Newbie friendliness 90/100

ros2/rosbag2#2509 · Opened Sep 23, 2026
Delete ament_export_include_directories() and ament_export_libraries() calls Open

good first issue

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

ros2/common_interfaces#344 · Opened Sep 23, 2026

More C++ issues