MSP430: Sub lifts operands in reverse order (inconsistent with Cmp)

Open Beginner friendly
#8,503 0 comments 0 reactions 1 assignee View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
Under an hour
Newbie friendliness
92/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
rust
Domain
reverse-engineering

Research direction

Open arch/msp430/src/lift.rs and inspect the Instruction::Sub case alongside Instruction::Cmp. Reproduce with printf '\x3b\x80\x02\x24' > sub_repro.bin and load it as MSP430. Done means sub #0x2402, r11 produces LLIL r11 = r11 - 0x2402 while constant-generator forms remain unaffected.

Written by the indexing model from the issue text.

Description

Arch: MSP430

Version and Platform (required):

  • Binary Ninja Version: 5.0.7648
  • Edition: Non-Commercial
  • OS: Ubuntu Linux
  • OS Version: 24.04
  • CPU Architecture: x64

Bug Description:
The MSP430 lifter emits sub with its operands reversed. MSP430 defines sub src, dst as computing dst - src, but the lifter produces src - dst.

Cmp in the same file (arch/msp430/src/lift.rs) is correct, and the two are inconsistent:

// Instruction::Sub
il.sub(size, src, dest)
// Instruction::Cmp
il.sub(size, dest, src)

Steps To Reproduce:
Load 3b 80 02 24 as msp430 (sub #0x2402, r11).

Expected LLIL: r11 = r11 - 0x2402
Actual LLIL: r11 = 0x2402 - r11

Binary:
printf '\x3b\x80\x02\x24' > sub_repro.bin in a terminal.

Possible solution:
Switch src and dest in il.sub(size, src, dest), in the case Instruction::Sub(inst) of the file arch/msp430/src/lift.rs.

Notes:
Constant-generator forms (dec, decd) are unaffected -- they take a different code path, which lifts correctly.

Impact:
Produces plausible but incorrect decompilation for any length or offset computation using sub

Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Vector35/binaryninja-api

All issues in Vector35/binaryninja-api

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.