Add LLIL/MLIL instructions to describe integer vs. floating point argument usage

13 files changed, 432 insertions, 143 deletions

diff --git a/binaryninjaapi.h b/binaryninjaapi.h
index ff83f295..a9739ecd 100644
--- a/binaryninjaapi.h
+++ b/binaryninjaapi.h
@@ -11258,6 +11258,10 @@ namespace BinaryNinja {
 		    const SSARegister& stack, size_t newMemoryVer, size_t prevMemoryVer,
 		    const ILSourceLocation& loc = ILSourceLocation());
 
+		ExprId SeparateParamListSSA(
+			const std::vector<ExprId>& params, const ILSourceLocation& loc = ILSourceLocation());
+		ExprId SharedParamSlotSSA(const std::vector<ExprId>& params, const ILSourceLocation& loc = ILSourceLocation());
+
 		/*! Returns an expression which jumps (branches) to the expression \c dest . \c ret is a special alias for
 			jump that makes the disassembler stop disassembling.
 
@@ -12025,31 +12029,33 @@ namespace BinaryNinja {
 		ExprId ReturnHint(ExprId dest, const ILSourceLocation& loc = ILSourceLocation());
 		ExprId Call(const std::vector<Variable>& output, ExprId dest, const std::vector<ExprId>& params,
 		    const ILSourceLocation& loc = ILSourceLocation());
-		ExprId CallUntyped(const std::vector<Variable>& output, ExprId dest, const std::vector<Variable>& params,
-		    ExprId stack, const ILSourceLocation& loc = ILSourceLocation());
+		ExprId CallUntyped(const std::vector<Variable>& output, ExprId dest, const std::vector<ExprId>& params,
+			ExprId stack, const ILSourceLocation& loc = ILSourceLocation());
 		ExprId Syscall(const std::vector<Variable>& output, const std::vector<ExprId>& params,
 		    const ILSourceLocation& loc = ILSourceLocation());
-		ExprId SyscallUntyped(const std::vector<Variable>& output, const std::vector<Variable>& params, ExprId stack,
-		    const ILSourceLocation& loc = ILSourceLocation());
+		ExprId SyscallUntyped(const std::vector<Variable>& output, const std::vector<ExprId>& params, ExprId stack,
+			const ILSourceLocation& loc = ILSourceLocation());
 		ExprId TailCall(const std::vector<Variable>& output, ExprId dest, const std::vector<ExprId>& params,
 		    const ILSourceLocation& loc = ILSourceLocation());
-		ExprId TailCallUntyped(const std::vector<Variable>& output, ExprId dest, const std::vector<Variable>& params,
-		    ExprId stack, const ILSourceLocation& loc = ILSourceLocation());
+		ExprId TailCallUntyped(const std::vector<Variable>& output, ExprId dest, const std::vector<ExprId>& params,
+			ExprId stack, const ILSourceLocation& loc = ILSourceLocation());
 		ExprId CallSSA(const std::vector<SSAVariable>& output, ExprId dest, const std::vector<ExprId>& params,
 		    size_t newMemVersion, size_t prevMemVersion, const ILSourceLocation& loc = ILSourceLocation());
-		ExprId CallUntypedSSA(const std::vector<SSAVariable>& output, ExprId dest,
-		    const std::vector<SSAVariable>& params, size_t newMemVersion, size_t prevMemVersion, ExprId stack,
-		    const ILSourceLocation& loc = ILSourceLocation());
+		ExprId CallUntypedSSA(const std::vector<SSAVariable>& output, ExprId dest, const std::vector<ExprId>& params,
+			size_t newMemVersion, size_t prevMemVersion, ExprId stack,
+			const ILSourceLocation& loc = ILSourceLocation());
 		ExprId SyscallSSA(const std::vector<SSAVariable>& output, const std::vector<ExprId>& params,
 		    size_t newMemVersion, size_t prevMemVersion, const ILSourceLocation& loc = ILSourceLocation());
-		ExprId SyscallUntypedSSA(const std::vector<SSAVariable>& output, const std::vector<SSAVariable>& params,
-		    size_t newMemVersion, size_t prevMemVersion, ExprId stack,
-		    const ILSourceLocation& loc = ILSourceLocation());
+		ExprId SyscallUntypedSSA(const std::vector<SSAVariable>& output, const std::vector<ExprId>& params,
+			size_t newMemVersion, size_t prevMemVersion, ExprId stack,
+			const ILSourceLocation& loc = ILSourceLocation());
 		ExprId TailCallSSA(const std::vector<SSAVariable>& output, ExprId dest, const std::vector<ExprId>& params,
 		    size_t newMemVersion, size_t prevMemVersion, const ILSourceLocation& loc = ILSourceLocation());
 		ExprId TailCallUntypedSSA(const std::vector<SSAVariable>& output, ExprId dest,
-		    const std::vector<SSAVariable>& params, size_t newMemVersion, size_t prevMemVersion, ExprId stack,
-		    const ILSourceLocation& loc = ILSourceLocation());
+			const std::vector<ExprId>& params, size_t newMemVersion, size_t prevMemVersion, ExprId stack,
+			const ILSourceLocation& loc = ILSourceLocation());
+		ExprId SeparateParamList(const std::vector<ExprId>& params, const ILSourceLocation& loc = ILSourceLocation());
+		ExprId SharedParamSlot(const std::vector<ExprId>& params, const ILSourceLocation& loc = ILSourceLocation());
 		ExprId Return(const std::vector<ExprId>& sources, const ILSourceLocation& loc = ILSourceLocation());
 		ExprId NoReturn(const ILSourceLocation& loc = ILSourceLocation());
 		ExprId CompareEqual(size_t size, ExprId left, ExprId right, const ILSourceLocation& loc = ILSourceLocation());
diff --git a/binaryninjacore.h b/binaryninjacore.h
index 2bad8b38..037eecee 100644
--- a/binaryninjacore.h
+++ b/binaryninjacore.h
@@ -37,14 +37,14 @@
 // Current ABI version for linking to the core. This is incremented any time
 // there are changes to the API that affect linking, including new functions,
 // new types, or modifications to existing functions or types.
-#define BN_CURRENT_CORE_ABI_VERSION 42
+#define BN_CURRENT_CORE_ABI_VERSION 43
 
 // Minimum ABI version that is supported for loading of plugins. Plugins that
 // are linked to an ABI version less than this will not be able to load and
 // will require rebuilding. The minimum version is increased when there are
 // incompatible changes that break binary compatibility, such as changes to
 // existing types or functions.
-#define BN_MINIMUM_CORE_ABI_VERSION 42
+#define BN_MINIMUM_CORE_ABI_VERSION 43
 
 #ifdef __GNUC__
 	#ifdef BINARYNINJACORE_LIBRARY
@@ -583,10 +583,13 @@ extern "C"
 		LLIL_CALL_SSA,
 		LLIL_SYSCALL_SSA,
 		LLIL_TAILCALL_SSA,
-		LLIL_CALL_PARAM,  // Only valid within the LLIL_CALL_SSA, LLIL_SYSCALL_SSA, LLIL_INTRINSIC, LLIL_INTRINSIC_SSA
-		                  // instructions
-		LLIL_CALL_STACK_SSA,   // Only valid within the LLIL_CALL_SSA or LLIL_SYSCALL_SSA instructions
-		LLIL_CALL_OUTPUT_SSA,  // Only valid within the LLIL_CALL_SSA or LLIL_SYSCALL_SSA instructions
+		LLIL_CALL_PARAM,  // Only valid within the LLIL_CALL_SSA, LLIL_SYSCALL_SSA, LLIL_INTRINSIC, LLIL_INTRINSIC_SSA,
+		                  // LLIL_TAILCALL, LLIL_TAILCALL_SSA instructions
+		LLIL_CALL_STACK_SSA,           // Only valid within the LLIL_CALL_SSA or LLIL_SYSCALL_SSA instructions
+		LLIL_CALL_OUTPUT_SSA,          // Only valid within the LLIL_CALL_SSA or LLIL_SYSCALL_SSA instructions
+		LLIL_SEPARATE_PARAM_LIST_SSA,  // Only valid within the LLIL_CALL_PARAM instruction
+		LLIL_SHARED_PARAM_SLOT_SSA,    // Only valid within the LLIL_CALL_PARAM or LLIL_SEPARATE_PARAM_LIST_SSA
+		                               // instructions
 		LLIL_LOAD_SSA,
 		LLIL_STORE_SSA,
 		LLIL_INTRINSIC_SSA,
@@ -1136,11 +1139,15 @@ extern "C"
 		MLIL_LOW_PART,
 		MLIL_JUMP,
 		MLIL_JUMP_TO,
-		MLIL_RET_HINT,      // Intermediate stages, does not appear in final forms
-		MLIL_CALL,          // Not valid in SSA form (see MLIL_CALL_SSA)
-		MLIL_CALL_UNTYPED,  // Not valid in SSA form (see MLIL_CALL_UNTYPED_SSA)
-		MLIL_CALL_OUTPUT,   // Only valid within MLIL_CALL, MLIL_SYSCALL, MLIL_TAILCALL family instructions
-		MLIL_CALL_PARAM,    // Only valid within MLIL_CALL, MLIL_SYSCALL, MLIL_TAILCALL family instructions
+		MLIL_RET_HINT,             // Intermediate stages, does not appear in final forms
+		MLIL_CALL,                 // Not valid in SSA form (see MLIL_CALL_SSA)
+		MLIL_CALL_UNTYPED,         // Not valid in SSA form (see MLIL_CALL_UNTYPED_SSA)
+		MLIL_CALL_OUTPUT,          // Only valid within MLIL_CALL, MLIL_SYSCALL, MLIL_TAILCALL family instructions
+		MLIL_CALL_PARAM,           // Only valid within MLIL_CALL, MLIL_SYSCALL, MLIL_TAILCALL family instructions
+		MLIL_SEPARATE_PARAM_LIST,  // Only valid within the MLIL_CALL_PARAM or MLIL_CALL_PARAM_SSA instructions inside
+		                           // untyped call variants
+		MLIL_SHARED_PARAM_SLOT,    // Only valid within the MLIL_CALL_PARAM, MLIL_CALL_PARAM_SSA, or
+		                           // MLIL_SEPARATE_PARAM_LIST instructions inside untyped call variants
 		MLIL_RET,
 		MLIL_NORET,
 		MLIL_IF,
diff --git a/examples/mlil_parser/src/mlil_parser.cpp b/examples/mlil_parser/src/mlil_parser.cpp
index c5b077ab..ae0a0df3 100644
--- a/examples/mlil_parser/src/mlil_parser.cpp
+++ b/examples/mlil_parser/src/mlil_parser.cpp
@@ -97,6 +97,8 @@ static void PrintOperation(BNMediumLevelILOperation operation)
 		ENUM_PRINTER(MLIL_SYSCALL_UNTYPED)
 		ENUM_PRINTER(MLIL_TAILCALL)
 		ENUM_PRINTER(MLIL_TAILCALL_UNTYPED)
+		ENUM_PRINTER(MLIL_SEPARATE_PARAM_LIST)
+		ENUM_PRINTER(MLIL_SHARED_PARAM_SLOT)
 		ENUM_PRINTER(MLIL_BP)
 		ENUM_PRINTER(MLIL_TRAP)
 		ENUM_PRINTER(MLIL_UNDEF)
diff --git a/lowlevelilinstruction.cpp b/lowlevelilinstruction.cpp
index a1ec2f92..e85c58b0 100644
--- a/lowlevelilinstruction.cpp
+++ b/lowlevelilinstruction.cpp
@@ -149,6 +149,8 @@ unordered_map<BNLowLevelILOperation, vector<LowLevelILOperandUsage>> LowLevelILI
         {LLIL_TAILCALL_SSA, {OutputSSARegistersLowLevelOperandUsage, OutputMemoryVersionLowLevelOperandUsage,
                                 DestExprLowLevelOperandUsage, StackSSARegisterLowLevelOperandUsage,
                                 StackMemoryVersionLowLevelOperandUsage, ParameterExprsLowLevelOperandUsage}},
+		{LLIL_SEPARATE_PARAM_LIST_SSA, {ParameterExprsLowLevelOperandUsage}},
+		{LLIL_SHARED_PARAM_SLOT_SSA, {ParameterExprsLowLevelOperandUsage}},
         {LLIL_REG_PHI, {DestSSARegisterLowLevelOperandUsage, SourceSSARegistersLowLevelOperandUsage}},
         {LLIL_REG_STACK_PHI, {DestSSARegisterStackLowLevelOperandUsage, SourceSSARegisterStacksLowLevelOperandUsage}},
         {LLIL_FLAG_PHI, {DestSSAFlagLowLevelOperandUsage, SourceSSAFlagsLowLevelOperandUsage}},
@@ -245,8 +247,16 @@ static unordered_map<BNLowLevelILOperation, unordered_map<LowLevelILOperandUsage
 				operand++;
 				break;
 			case ParameterExprsLowLevelOperandUsage:
-				// Represented as subexpression, so only takes one slot even though it is a list
-				operand++;
+				if (operand == 0)
+				{
+					// Represented as a counted list
+					operand += 2;
+				}
+				else
+				{
+					// Represented as subexpression, so only takes one slot even though it is a list
+					operand++;
+				}
 				break;
 			case OutputSSARegistersLowLevelOperandUsage:
 				// OutputMemoryVersionLowLevelOperandUsage follows at same operand
@@ -2010,6 +2020,14 @@ void LowLevelILInstruction::VisitExprs(const std::function<bool(const LowLevelIL
 		for (auto i : GetParameterExprs<LLIL_INTRINSIC_SSA>())
 			i.VisitExprs(func);
 		break;
+	case LLIL_SEPARATE_PARAM_LIST_SSA:
+		for (auto i : GetParameterExprs<LLIL_SEPARATE_PARAM_LIST_SSA>())
+			i.VisitExprs(func);
+		break;
+	case LLIL_SHARED_PARAM_SLOT_SSA:
+		for (auto i : GetParameterExprs<LLIL_SHARED_PARAM_SLOT_SSA>())
+			i.VisitExprs(func);
+		break;
 	default:
 		break;
 	}
@@ -2304,6 +2322,14 @@ ExprId LowLevelILInstruction::CopyTo(
 			params.push_back(subExprHandler(i));
 		return dest->IntrinsicSSA(
 		    GetOutputSSARegisterOrFlagList<LLIL_INTRINSIC_SSA>(), GetIntrinsic<LLIL_INTRINSIC_SSA>(), params, *this);
+	case LLIL_SEPARATE_PARAM_LIST_SSA:
+		for (auto i : GetParameterExprs<LLIL_SEPARATE_PARAM_LIST_SSA>())
+			params.push_back(subExprHandler(i));
+		return dest->SeparateParamListSSA(params, *this);
+	case LLIL_SHARED_PARAM_SLOT_SSA:
+		for (auto i : GetParameterExprs<LLIL_SHARED_PARAM_SLOT_SSA>())
+			params.push_back(subExprHandler(i));
+		return dest->SharedParamSlotSSA(params, *this);
 	default:
 		throw LowLevelILInstructionAccessException();
 	}
@@ -2693,7 +2719,11 @@ LowLevelILInstructionList LowLevelILInstruction::GetParameterExprs() const
 {
 	size_t operandIndex;
 	if (GetOperandIndexForUsage(ParameterExprsLowLevelOperandUsage, operandIndex))
+	{
+		if (operandIndex == 0)
+			return GetRawOperandAsExprList(0);
 		return GetRawOperandAsExpr(operandIndex).GetRawOperandAsExprList(0);
+	}
 	throw LowLevelILInstructionAccessException();
 }
 
@@ -3315,6 +3345,18 @@ ExprId LowLevelILFunction::TailCallSSA(const vector<SSARegister>& output, ExprId
 }
 
 
+ExprId LowLevelILFunction::SeparateParamListSSA(const vector<ExprId>& params, const ILSourceLocation& loc)
+{
+	return AddExprWithLocation(LLIL_SEPARATE_PARAM_LIST_SSA, loc, 0, 0, params.size(), AddOperandList(params));
+}
+
+
+ExprId LowLevelILFunction::SharedParamSlotSSA(const vector<ExprId>& params, const ILSourceLocation& loc)
+{
+	return AddExprWithLocation(LLIL_SHARED_PARAM_SLOT_SSA, loc, 0, 0, params.size(), AddOperandList(params));
+}
+
+
 ExprId LowLevelILFunction::Return(size_t dest, const ILSourceLocation& loc)
 {
 	return AddExprWithLocation(LLIL_RET, loc, 0, 0, dest);
diff --git a/lowlevelilinstruction.h b/lowlevelilinstruction.h
index 99aba8ad..1e8132ca 100644
--- a/lowlevelilinstruction.h
+++ b/lowlevelilinstruction.h
@@ -1703,6 +1703,17 @@ namespace BinaryNinja
 	};
 
 	template <>
+	struct LowLevelILInstructionAccessor<LLIL_SEPARATE_PARAM_LIST_SSA> : public LowLevelILInstructionBase
+	{
+		LowLevelILInstructionList GetParameterExprs() const { return GetRawOperandAsExprList(0); }
+	};
+	template <>
+	struct LowLevelILInstructionAccessor<LLIL_SHARED_PARAM_SLOT_SSA> : public LowLevelILInstructionBase
+	{
+		LowLevelILInstructionList GetParameterExprs() const { return GetRawOperandAsExprList(0); }
+	};
+
+	template <>
 	struct LowLevelILInstructionAccessor<LLIL_REG_PHI> : public LowLevelILInstructionBase
 	{
 		SSARegister GetDestSSARegister() const { return GetRawOperandAsSSARegister(0); }
diff --git a/mediumlevelilinstruction.cpp b/mediumlevelilinstruction.cpp
index f16d160e..bbf5988b 100644
--- a/mediumlevelilinstruction.cpp
+++ b/mediumlevelilinstruction.cpp
@@ -72,8 +72,8 @@ unordered_map<MediumLevelILOperandUsage, MediumLevelILOperandType> MediumLevelIL
     {OutputSSAMemoryVersionMediumLevelOperandUsage, IndexMediumLevelOperand},
     {ParameterExprsMediumLevelOperandUsage, ExprListMediumLevelOperand},
     {SourceExprsMediumLevelOperandUsage, ExprListMediumLevelOperand},
-    {ParameterVariablesMediumLevelOperandUsage, VariableListMediumLevelOperand},
-    {ParameterSSAVariablesMediumLevelOperandUsage, SSAVariableListMediumLevelOperand},
+    {UntypedParameterExprsMediumLevelOperandUsage, ExprListMediumLevelOperand},
+    {UntypedParameterSSAExprsMediumLevelOperandUsage, ExprListMediumLevelOperand},
     {ParameterSSAMemoryVersionMediumLevelOperandUsage, IndexMediumLevelOperand},
     {SourceSSAVariablesMediumLevelOperandUsages, SSAVariableListMediumLevelOperand}};
 
@@ -126,35 +126,37 @@ unordered_map<BNMediumLevelILOperation, vector<MediumLevelILOperandUsage>>
         {MLIL_CALL, {OutputVariablesMediumLevelOperandUsage, DestExprMediumLevelOperandUsage,
                         ParameterExprsMediumLevelOperandUsage}},
         {MLIL_CALL_UNTYPED, {OutputVariablesSubExprMediumLevelOperandUsage, DestExprMediumLevelOperandUsage,
-                                ParameterVariablesMediumLevelOperandUsage}},
+                                UntypedParameterExprsMediumLevelOperandUsage}},
         {MLIL_SYSCALL, {OutputVariablesMediumLevelOperandUsage, ParameterExprsMediumLevelOperandUsage}},
         {MLIL_SYSCALL_UNTYPED, {OutputVariablesSubExprMediumLevelOperandUsage,
-                                   ParameterVariablesMediumLevelOperandUsage, StackExprMediumLevelOperandUsage}},
+                                   UntypedParameterExprsMediumLevelOperandUsage, StackExprMediumLevelOperandUsage}},
         {MLIL_TAILCALL, {OutputVariablesMediumLevelOperandUsage, DestExprMediumLevelOperandUsage,
                             ParameterExprsMediumLevelOperandUsage}},
         {MLIL_TAILCALL_UNTYPED, {OutputVariablesSubExprMediumLevelOperandUsage, DestExprMediumLevelOperandUsage,
-                                    ParameterVariablesMediumLevelOperandUsage}},
+                                    UntypedParameterExprsMediumLevelOperandUsage}},
         {MLIL_CALL_SSA, {OutputSSAVariablesSubExprMediumLevelOperandUsage,
                             OutputSSAMemoryVersionMediumLevelOperandUsage, DestExprMediumLevelOperandUsage,
                             ParameterExprsMediumLevelOperandUsage, SourceMemoryVersionMediumLevelOperandUsage}},
         {MLIL_CALL_UNTYPED_SSA,
             {OutputSSAVariablesSubExprMediumLevelOperandUsage, OutputSSAMemoryVersionMediumLevelOperandUsage,
-                DestExprMediumLevelOperandUsage, ParameterSSAVariablesMediumLevelOperandUsage,
+                DestExprMediumLevelOperandUsage, UntypedParameterSSAExprsMediumLevelOperandUsage,
                 ParameterSSAMemoryVersionMediumLevelOperandUsage, StackExprMediumLevelOperandUsage}},
         {MLIL_SYSCALL_SSA,
             {OutputSSAVariablesSubExprMediumLevelOperandUsage, OutputSSAMemoryVersionMediumLevelOperandUsage,
                 ParameterExprsMediumLevelOperandUsage, SourceMemoryVersionMediumLevelOperandUsage}},
         {MLIL_SYSCALL_UNTYPED_SSA,
             {OutputSSAVariablesSubExprMediumLevelOperandUsage, OutputSSAMemoryVersionMediumLevelOperandUsage,
-                ParameterSSAVariablesMediumLevelOperandUsage, ParameterSSAMemoryVersionMediumLevelOperandUsage,
+                UntypedParameterSSAExprsMediumLevelOperandUsage, ParameterSSAMemoryVersionMediumLevelOperandUsage,
                 StackExprMediumLevelOperandUsage}},
         {MLIL_TAILCALL_SSA, {OutputSSAVariablesSubExprMediumLevelOperandUsage,
                                 OutputSSAMemoryVersionMediumLevelOperandUsage, DestExprMediumLevelOperandUsage,
                                 ParameterExprsMediumLevelOperandUsage, SourceMemoryVersionMediumLevelOperandUsage}},
         {MLIL_TAILCALL_UNTYPED_SSA,
             {OutputSSAVariablesSubExprMediumLevelOperandUsage, OutputSSAMemoryVersionMediumLevelOperandUsage,
-                DestExprMediumLevelOperandUsage, ParameterSSAVariablesMediumLevelOperandUsage,
+                DestExprMediumLevelOperandUsage, UntypedParameterSSAExprsMediumLevelOperandUsage,
                 ParameterSSAMemoryVersionMediumLevelOperandUsage, StackExprMediumLevelOperandUsage}},
+		{MLIL_SEPARATE_PARAM_LIST, {ParameterExprsMediumLevelOperandUsage}},
+		{MLIL_SHARED_PARAM_SLOT, {ParameterExprsMediumLevelOperandUsage}},
         {MLIL_RET, {SourceExprsMediumLevelOperandUsage}},
         {MLIL_IF, {ConditionExprMediumLevelOperandUsage, TrueTargetMediumLevelOperandUsage,
                       FalseTargetMediumLevelOperandUsage}},
@@ -260,14 +262,14 @@ static unordered_map<BNMediumLevelILOperation, unordered_map<MediumLevelILOperan
 				operand++;
 				break;
 			case OutputVariablesSubExprMediumLevelOperandUsage:
-			case ParameterVariablesMediumLevelOperandUsage:
+			case UntypedParameterExprsMediumLevelOperandUsage:
 				// Represented as subexpression, so only takes one slot even though it is a list
 				operand++;
 				break;
 			case OutputSSAVariablesSubExprMediumLevelOperandUsage:
 				// OutputSSAMemoryVersionMediumLevelOperandUsage follows at same operand
 				break;
-			case ParameterSSAVariablesMediumLevelOperandUsage:
+			case UntypedParameterSSAExprsMediumLevelOperandUsage:
 				// ParameterSSAMemoryVersionMediumLevelOperandUsage follows at same operand
 				break;
 			default:
@@ -806,8 +808,7 @@ MediumLevelILVariableList MediumLevelILOperand::GetVariableList() const
 {
 	if (m_type != VariableListMediumLevelOperand)
 		throw MediumLevelILInstructionAccessException();
-	if ((m_usage == OutputVariablesSubExprMediumLevelOperandUsage)
-	    || (m_usage == ParameterVariablesMediumLevelOperandUsage))
+	if (m_usage == OutputVariablesSubExprMediumLevelOperandUsage)
 		return m_instr.GetRawOperandAsExpr(m_operandIndex).GetRawOperandAsVariableList(0);
 	return m_instr.GetRawOperandAsVariableList(m_operandIndex);
 }
@@ -817,8 +818,7 @@ MediumLevelILSSAVariableList MediumLevelILOperand::GetSSAVariableList() const
 {
 	if (m_type != SSAVariableListMediumLevelOperand)
 		throw MediumLevelILInstructionAccessException();
-	if ((m_usage == OutputSSAVariablesSubExprMediumLevelOperandUsage)
-	    || (m_usage == ParameterSSAVariablesMediumLevelOperandUsage))
+	if (m_usage == OutputSSAVariablesSubExprMediumLevelOperandUsage)
 		return m_instr.GetRawOperandAsExpr(m_operandIndex).GetRawOperandAsSSAVariableList(1);
 	return m_instr.GetRawOperandAsSSAVariableList(m_operandIndex);
 }
@@ -828,6 +828,10 @@ MediumLevelILInstructionList MediumLevelILOperand::GetExprList() const
 {
 	if (m_type != ExprListMediumLevelOperand)
 		throw MediumLevelILInstructionAccessException();
+	if (m_usage == UntypedParameterExprsMediumLevelOperandUsage)
+		return m_instr.GetRawOperandAsExpr(m_operandIndex).GetRawOperandAsExprList(0);
+	if (m_usage == UntypedParameterSSAExprsMediumLevelOperandUsage)
+		return m_instr.GetRawOperandAsExpr(m_operandIndex).GetRawOperandAsExprList(1);
 	return m_instr.GetRawOperandAsExprList(m_operandIndex);
 }
 
@@ -1421,6 +1425,8 @@ void MediumLevelILInstruction::VisitExprs(const std::function<bool(const MediumL
 		break;
 	case MLIL_CALL_UNTYPED:
 		GetDestExpr<MLIL_CALL_UNTYPED>().VisitExprs(func);
+		for (auto i : GetParameterExprs<MLIL_CALL_UNTYPED>())
+			i.VisitExprs(func);
 		break;
 	case MLIL_CALL_SSA:
 		GetDestExpr<MLIL_CALL_SSA>().VisitExprs(func);
@@ -1429,15 +1435,25 @@ void MediumLevelILInstruction::VisitExprs(const std::function<bool(const MediumL
 		break;
 	case MLIL_CALL_UNTYPED_SSA:
 		GetDestExpr<MLIL_CALL_UNTYPED_SSA>().VisitExprs(func);
+		for (auto i : GetParameterExprs<MLIL_CALL_UNTYPED_SSA>())
+			i.VisitExprs(func);
 		break;
 	case MLIL_SYSCALL:
 		for (auto i : GetParameterExprs<MLIL_SYSCALL>())
 			i.VisitExprs(func);
 		break;
+	case MLIL_SYSCALL_UNTYPED:
+		for (auto i : GetParameterExprs<MLIL_SYSCALL_UNTYPED>())
+			i.VisitExprs(func);
+		break;
 	case MLIL_SYSCALL_SSA:
 		for (auto i : GetParameterExprs<MLIL_SYSCALL_SSA>())
 			i.VisitExprs(func);
 		break;
+	case MLIL_SYSCALL_UNTYPED_SSA:
+		for (auto i : GetParameterExprs<MLIL_SYSCALL_UNTYPED_SSA>())
+			i.VisitExprs(func);
+		break;
 	case MLIL_TAILCALL:
 		GetDestExpr<MLIL_TAILCALL>().VisitExprs(func);
 		for (auto i : GetParameterExprs<MLIL_TAILCALL>())
@@ -1445,6 +1461,8 @@ void MediumLevelILInstruction::VisitExprs(const std::function<bool(const MediumL
 		break;
 	case MLIL_TAILCALL_UNTYPED:
 		GetDestExpr<MLIL_TAILCALL_UNTYPED>().VisitExprs(func);
+		for (auto i : GetParameterExprs<MLIL_TAILCALL_UNTYPED>())
+			i.VisitExprs(func);
 		break;
 	case MLIL_TAILCALL_SSA:
 		GetDestExpr<MLIL_TAILCALL_SSA>().VisitExprs(func);
@@ -1453,6 +1471,16 @@ void MediumLevelILInstruction::VisitExprs(const std::function<bool(const MediumL
 		break;
 	case MLIL_TAILCALL_UNTYPED_SSA:
 		GetDestExpr<MLIL_TAILCALL_UNTYPED_SSA>().VisitExprs(func);
+		for (auto i : GetParameterExprs<MLIL_TAILCALL_UNTYPED_SSA>())
+			i.VisitExprs(func);
+		break;
+	case MLIL_SEPARATE_PARAM_LIST:
+		for (auto i : GetParameterExprs<MLIL_SEPARATE_PARAM_LIST>())
+			i.VisitExprs(func);
+		break;
+	case MLIL_SHARED_PARAM_SLOT:
+		for (auto i : GetParameterExprs<MLIL_SHARED_PARAM_SLOT>())
+			i.VisitExprs(func);
 		break;
 	case MLIL_RET:
 		for (auto i : GetSourceExprs<MLIL_RET>())
@@ -1647,8 +1675,10 @@ ExprId MediumLevelILInstruction::CopyTo(MediumLevelILFunction* dest,
 			params.push_back(subExprHandler(i));
 		return dest->Call(GetOutputVariables<MLIL_CALL>(), subExprHandler(GetDestExpr<MLIL_CALL>()), params, *this);
 	case MLIL_CALL_UNTYPED:
+		for (auto i : GetParameterExprs<MLIL_CALL_UNTYPED>())
+			params.push_back(subExprHandler(i));
 		return dest->CallUntyped(GetOutputVariables<MLIL_CALL_UNTYPED>(),
-		    subExprHandler(GetDestExpr<MLIL_CALL_UNTYPED>()), GetParameterVariables<MLIL_CALL_UNTYPED>(),
+		    subExprHandler(GetDestExpr<MLIL_CALL_UNTYPED>()), params,
 		    subExprHandler(GetStackExpr<MLIL_CALL_UNTYPED>()), *this);
 	case MLIL_CALL_SSA:
 		for (auto i : GetParameterExprs<MLIL_CALL_SSA>())
@@ -1656,8 +1686,10 @@ ExprId MediumLevelILInstruction::CopyTo(MediumLevelILFunction* dest,
 		return dest->CallSSA(GetOutputSSAVariables<MLIL_CALL_SSA>(), subExprHandler(GetDestExpr<MLIL_CALL_SSA>()),
 		    params, GetDestMemoryVersion<MLIL_CALL_SSA>(), GetSourceMemoryVersion<MLIL_CALL_SSA>(), *this);
 	case MLIL_CALL_UNTYPED_SSA:
+		for (auto i : GetParameterExprs<MLIL_CALL_UNTYPED_SSA>())
+			params.push_back(subExprHandler(i));
 		return dest->CallUntypedSSA(GetOutputSSAVariables<MLIL_CALL_UNTYPED_SSA>(),
-		    subExprHandler(GetDestExpr<MLIL_CALL_UNTYPED_SSA>()), GetParameterSSAVariables<MLIL_CALL_UNTYPED_SSA>(),
+		    subExprHandler(GetDestExpr<MLIL_CALL_UNTYPED_SSA>()), params,
 		    GetDestMemoryVersion<MLIL_CALL_UNTYPED_SSA>(), GetSourceMemoryVersion<MLIL_CALL_UNTYPED_SSA>(),
 		    subExprHandler(GetStackExpr<MLIL_CALL_UNTYPED_SSA>()), *this);
 	case MLIL_SYSCALL:
@@ -1665,16 +1697,20 @@ ExprId MediumLevelILInstruction::CopyTo(MediumLevelILFunction* dest,
 			params.push_back(subExprHandler(i));
 		return dest->Syscall(GetOutputVariables<MLIL_SYSCALL>(), params, *this);
 	case MLIL_SYSCALL_UNTYPED:
+		for (auto i : GetParameterExprs<MLIL_SYSCALL_UNTYPED>())
+			params.push_back(subExprHandler(i));
 		return dest->SyscallUntyped(GetOutputVariables<MLIL_SYSCALL_UNTYPED>(),
-		    GetParameterVariables<MLIL_SYSCALL_UNTYPED>(), subExprHandler(GetStackExpr<MLIL_SYSCALL_UNTYPED>()), *this);
+		    params, subExprHandler(GetStackExpr<MLIL_SYSCALL_UNTYPED>()), *this);
 	case MLIL_SYSCALL_SSA:
 		for (auto i : GetParameterExprs<MLIL_SYSCALL_SSA>())
 			params.push_back(subExprHandler(i));
 		return dest->SyscallSSA(GetOutputSSAVariables<MLIL_SYSCALL_SSA>(), params,
 		    GetDestMemoryVersion<MLIL_SYSCALL_SSA>(), GetSourceMemoryVersion<MLIL_SYSCALL_SSA>(), *this);
 	case MLIL_SYSCALL_UNTYPED_SSA:
+		for (auto i : GetParameterExprs<MLIL_SYSCALL_UNTYPED_SSA>())
+			params.push_back(subExprHandler(i));
 		return dest->SyscallUntypedSSA(GetOutputSSAVariables<MLIL_SYSCALL_UNTYPED_SSA>(),
-		    GetParameterSSAVariables<MLIL_SYSCALL_UNTYPED_SSA>(), GetDestMemoryVersion<MLIL_SYSCALL_UNTYPED_SSA>(),
+		    params, GetDestMemoryVersion<MLIL_SYSCALL_UNTYPED_SSA>(),
 		    GetSourceMemoryVersion<MLIL_SYSCALL_UNTYPED_SSA>(),
 		    subExprHandler(GetStackExpr<MLIL_SYSCALL_UNTYPED_SSA>()), *this);
 	case MLIL_TAILCALL:
@@ -1683,8 +1719,10 @@ ExprId MediumLevelILInstruction::CopyTo(MediumLevelILFunction* dest,
 		return dest->TailCall(
 		    GetOutputVariables<MLIL_TAILCALL>(), subExprHandler(GetDestExpr<MLIL_TAILCALL>()), params, *this);
 	case MLIL_TAILCALL_UNTYPED:
+		for (auto i : GetParameterExprs<MLIL_TAILCALL_UNTYPED>())
+			params.push_back(subExprHandler(i));
 		return dest->TailCallUntyped(GetOutputVariables<MLIL_TAILCALL_UNTYPED>(),
-		    subExprHandler(GetDestExpr<MLIL_TAILCALL_UNTYPED>()), GetParameterVariables<MLIL_TAILCALL_UNTYPED>(),
+		    subExprHandler(GetDestExpr<MLIL_TAILCALL_UNTYPED>()), params,
 		    subExprHandler(GetStackExpr<MLIL_TAILCALL_UNTYPED>()), *this);
 	case MLIL_TAILCALL_SSA:
 		for (auto i : GetParameterExprs<MLIL_TAILCALL_SSA>())
@@ -1693,11 +1731,21 @@ ExprId MediumLevelILInstruction::CopyTo(MediumLevelILFunction* dest,
 		    subExprHandler(GetDestExpr<MLIL_TAILCALL_SSA>()), params, GetDestMemoryVersion<MLIL_TAILCALL_SSA>(),
 		    GetSourceMemoryVersion<MLIL_TAILCALL_SSA>(), *this);
 	case MLIL_TAILCALL_UNTYPED_SSA:
+		for (auto i : GetParameterExprs<MLIL_TAILCALL_UNTYPED_SSA>())
+			params.push_back(subExprHandler(i));
 		return dest->TailCallUntypedSSA(GetOutputSSAVariables<MLIL_TAILCALL_UNTYPED_SSA>(),
 		    subExprHandler(GetDestExpr<MLIL_TAILCALL_UNTYPED_SSA>()),
-		    GetParameterSSAVariables<MLIL_TAILCALL_UNTYPED_SSA>(), GetDestMemoryVersion<MLIL_TAILCALL_UNTYPED_SSA>(),
+		    params, GetDestMemoryVersion<MLIL_TAILCALL_UNTYPED_SSA>(),
 		    GetSourceMemoryVersion<MLIL_TAILCALL_UNTYPED_SSA>(),
 		    subExprHandler(GetStackExpr<MLIL_TAILCALL_UNTYPED_SSA>()), *this);
+	case MLIL_SEPARATE_PARAM_LIST:
+		for (auto i : GetParameterExprs<MLIL_SEPARATE_PARAM_LIST>())
+			params.push_back(subExprHandler(i));
+		return dest->SeparateParamList(params, *this);
+	case MLIL_SHARED_PARAM_SLOT:
+		for (auto i : GetParameterExprs<MLIL_SHARED_PARAM_SLOT>())
+			params.push_back(subExprHandler(i));
+		return dest->SharedParamSlot(params, *this);
 	case MLIL_RET:
 		for (auto i : GetSourceExprs<MLIL_RET>())
 			params.push_back(subExprHandler(i));
@@ -2161,6 +2209,10 @@ MediumLevelILInstructionList MediumLevelILInstruction::GetParameterExprs() const
 	size_t operandIndex;
 	if (GetOperandIndexForUsage(ParameterExprsMediumLevelOperandUsage, operandIndex))
 		return GetRawOperandAsExprList(operandIndex);
+	if (GetOperandIndexForUsage(UntypedParameterExprsMediumLevelOperandUsage, operandIndex))
+		return GetRawOperandAsExpr(operandIndex).GetRawOperandAsExprList(0);
+	if (GetOperandIndexForUsage(UntypedParameterSSAExprsMediumLevelOperandUsage, operandIndex))
+		return GetRawOperandAsExpr(operandIndex).GetRawOperandAsExprList(1);
 	throw MediumLevelILInstructionAccessException();
 }
 
@@ -2174,24 +2226,6 @@ MediumLevelILInstructionList MediumLevelILInstruction::GetSourceExprs() const
 }
 
 
-MediumLevelILVariableList MediumLevelILInstruction::GetParameterVariables() const
-{
-	size_t operandIndex;
-	if (GetOperandIndexForUsage(ParameterVariablesMediumLevelOperandUsage, operandIndex))
-		return GetRawOperandAsExpr(operandIndex).GetRawOperandAsVariableList(0);
-	throw MediumLevelILInstructionAccessException();
-}
-
-
-MediumLevelILSSAVariableList MediumLevelILInstruction::GetParameterSSAVariables() const
-{
-	size_t operandIndex;
-	if (GetOperandIndexForUsage(ParameterSSAVariablesMediumLevelOperandUsage, operandIndex))
-		return GetRawOperandAsExpr(operandIndex).GetRawOperandAsSSAVariableList(1);
-	throw MediumLevelILInstructionAccessException();
-}
-
-
 MediumLevelILSSAVariableList MediumLevelILInstruction::GetSourceSSAVariables() const
 {
 	size_t operandIndex;
@@ -2655,12 +2689,12 @@ ExprId MediumLevelILFunction::Call(
 }
 
 
-ExprId MediumLevelILFunction::CallUntyped(const vector<Variable>& output, ExprId dest, const vector<Variable>& params,
+ExprId MediumLevelILFunction::CallUntyped(const vector<Variable>& output, ExprId dest, const vector<ExprId>& params,
     ExprId stack, const ILSourceLocation& loc)
 {
 	return AddExprWithLocation(MLIL_CALL_UNTYPED, loc, 0,
 	    AddExprWithLocation(MLIL_CALL_OUTPUT, loc, 0, output.size(), AddVariableList(output)), dest,
-	    AddExprWithLocation(MLIL_CALL_PARAM, loc, 0, params.size(), AddVariableList(params)), stack);
+	    AddExprWithLocation(MLIL_CALL_PARAM, loc, 0, params.size(), AddOperandList(params)), stack);
 }
 
 
@@ -2673,11 +2707,11 @@ ExprId MediumLevelILFunction::Syscall(
 
 
 ExprId MediumLevelILFunction::SyscallUntyped(
-    const vector<Variable>& output, const vector<Variable>& params, ExprId stack, const ILSourceLocation& loc)
+    const vector<Variable>& output, const vector<ExprId>& params, ExprId stack, const ILSourceLocation& loc)
 {
 	return AddExprWithLocation(MLIL_SYSCALL_UNTYPED, loc, 0,
 	    AddExprWithLocation(MLIL_CALL_OUTPUT, loc, 0, output.size(), AddVariableList(output)),
-	    AddExprWithLocation(MLIL_CALL_PARAM, loc, 0, params.size(), AddVariableList(params)), stack);
+	    AddExprWithLocation(MLIL_CALL_PARAM, loc, 0, params.size(), AddOperandList(params)), stack);
 }
 
 
@@ -2690,11 +2724,11 @@ ExprId MediumLevelILFunction::TailCall(
 
 
 ExprId MediumLevelILFunction::TailCallUntyped(const vector<Variable>& output, ExprId dest,
-    const vector<Variable>& params, ExprId stack, const ILSourceLocation& loc)
+    const vector<ExprId>& params, ExprId stack, const ILSourceLocation& loc)
 {
 	return AddExprWithLocation(MLIL_TAILCALL_UNTYPED, loc, 0,
 	    AddExprWithLocation(MLIL_CALL_OUTPUT, loc, 0, output.size(), AddVariableList(output)), dest,
-	    AddExprWithLocation(MLIL_CALL_PARAM, loc, 0, params.size(), AddVariableList(params)), stack);
+	    AddExprWithLocation(MLIL_CALL_PARAM, loc, 0, params.size(), AddOperandList(params)), stack);
 }
 
 
@@ -2708,13 +2742,13 @@ ExprId MediumLevelILFunction::CallSSA(const vector<SSAVariable>& output, ExprId
 
 
 ExprId MediumLevelILFunction::CallUntypedSSA(const vector<SSAVariable>& output, ExprId dest,
-    const vector<SSAVariable>& params, size_t newMemVersion, size_t prevMemVersion, ExprId stack,
+    const vector<ExprId>& params, size_t newMemVersion, size_t prevMemVersion, ExprId stack,
     const ILSourceLocation& loc)
 {
 	return AddExprWithLocation(MLIL_CALL_UNTYPED_SSA, loc, 0,
 	    AddExprWithLocation(MLIL_CALL_OUTPUT_SSA, loc, 0, newMemVersion, output.size() * 2, AddSSAVariableList(output)),
 	    dest,
-	    AddExprWithLocation(MLIL_CALL_PARAM_SSA, loc, 0, prevMemVersion, params.size() * 2, AddSSAVariableList(params)),
+	    AddExprWithLocation(MLIL_CALL_PARAM_SSA, loc, 0, prevMemVersion, params.size(), AddOperandList(params)),
 	    stack);
 }
 
@@ -2728,12 +2762,12 @@ ExprId MediumLevelILFunction::SyscallSSA(const vector<SSAVariable>& output, cons
 }
 
 
-ExprId MediumLevelILFunction::SyscallUntypedSSA(const vector<SSAVariable>& output, const vector<SSAVariable>& params,
+ExprId MediumLevelILFunction::SyscallUntypedSSA(const vector<SSAVariable>& output, const vector<ExprId>& params,
     size_t newMemVersion, size_t prevMemVersion, ExprId stack, const ILSourceLocation& loc)
 {
 	return AddExprWithLocation(MLIL_SYSCALL_UNTYPED_SSA, loc, 0,
 	    AddExprWithLocation(MLIL_CALL_OUTPUT_SSA, loc, 0, newMemVersion, output.size() * 2, AddSSAVariableList(output)),
-	    AddExprWithLocation(MLIL_CALL_PARAM_SSA, loc, 0, prevMemVersion, params.size() * 2, AddSSAVariableList(params)),
+	    AddExprWithLocation(MLIL_CALL_PARAM_SSA, loc, 0, prevMemVersion, params.size(), AddOperandList(params)),
 	    stack);
 }
 
@@ -2748,17 +2782,29 @@ ExprId MediumLevelILFunction::TailCallSSA(const vector<SSAVariable>& output, Exp
 
 
 ExprId MediumLevelILFunction::TailCallUntypedSSA(const vector<SSAVariable>& output, ExprId dest,
-    const vector<SSAVariable>& params, size_t newMemVersion, size_t prevMemVersion, ExprId stack,
+    const vector<ExprId>& params, size_t newMemVersion, size_t prevMemVersion, ExprId stack,
     const ILSourceLocation& loc)
 {
 	return AddExprWithLocation(MLIL_TAILCALL_UNTYPED_SSA, loc, 0,
 	    AddExprWithLocation(MLIL_CALL_OUTPUT_SSA, loc, 0, newMemVersion, output.size() * 2, AddSSAVariableList(output)),
 	    dest,
-	    AddExprWithLocation(MLIL_CALL_PARAM_SSA, loc, 0, prevMemVersion, params.size() * 2, AddSSAVariableList(params)),
+	    AddExprWithLocation(MLIL_CALL_PARAM_SSA, loc, 0, prevMemVersion, params.size(), AddOperandList(params)),
 	    stack);
 }
 
 
+ExprId MediumLevelILFunction::SeparateParamList(const vector<ExprId>& params, const ILSourceLocation& loc)
+{
+	return AddExprWithLocation(MLIL_SEPARATE_PARAM_LIST, loc, 0, params.size(), AddOperandList(params));
+}
+
+
+ExprId MediumLevelILFunction::SharedParamSlot(const vector<ExprId>& params, const ILSourceLocation& loc)
+{
+	return AddExprWithLocation(MLIL_SHARED_PARAM_SLOT, loc, 0, params.size(), AddOperandList(params));
+}
+
+
 ExprId MediumLevelILFunction::Return(const vector<ExprId>& sources, const ILSourceLocation& loc)
 {
 	return AddExprWithLocation(MLIL_RET, loc, 0, sources.size(), AddOperandList(sources));
diff --git a/mediumlevelilinstruction.h b/mediumlevelilinstruction.h
index bcac516b..bdf65e9c 100644
--- a/mediumlevelilinstruction.h
+++ b/mediumlevelilinstruction.h
@@ -131,8 +131,8 @@ namespace BinaryNinja
 		OutputSSAMemoryVersionMediumLevelOperandUsage,
 		ParameterExprsMediumLevelOperandUsage,
 		SourceExprsMediumLevelOperandUsage,
-		ParameterVariablesMediumLevelOperandUsage,
-		ParameterSSAVariablesMediumLevelOperandUsage,
+		UntypedParameterExprsMediumLevelOperandUsage,
+		UntypedParameterSSAExprsMediumLevelOperandUsage,
 		ParameterSSAMemoryVersionMediumLevelOperandUsage,
 		SourceSSAVariablesMediumLevelOperandUsages
 	};
@@ -733,16 +733,6 @@ namespace BinaryNinja
 			return As<N>().GetSourceExprs();
 		}
 		template <BNMediumLevelILOperation N>
-		MediumLevelILVariableList GetParameterVariables() const
-		{
-			return As<N>().GetParameterVariables();
-		}
-		template <BNMediumLevelILOperation N>
-		MediumLevelILSSAVariableList GetParameterSSAVariables() const
-		{
-			return As<N>().GetParameterSSAVariables();
-		}
-		template <BNMediumLevelILOperation N>
 		MediumLevelILSSAVariableList GetSourceSSAVariables() const
 		{
 			return As<N>().GetSourceSSAVariables();
@@ -784,11 +774,6 @@ namespace BinaryNinja
 			As<N>().SetOutputSSAVariables(vars);
 		}
 		template <BNMediumLevelILOperation N>
-		void SetParameterSSAVariables(const _STD_VECTOR<SSAVariable>& vars)
-		{
-			As<N>().SetParameterSSAVariables(vars);
-		}
-		template <BNMediumLevelILOperation N>
 		void SetParameterExprs(const _STD_VECTOR<MediumLevelILInstruction>& params)
 		{
 			As<N>().SetParameterExprs(params);
@@ -844,8 +829,6 @@ namespace BinaryNinja
 		MediumLevelILSSAVariableList GetOutputSSAVariables() const;
 		MediumLevelILInstructionList GetParameterExprs() const;
 		MediumLevelILInstructionList GetSourceExprs() const;
-		MediumLevelILVariableList GetParameterVariables() const;
-		MediumLevelILSSAVariableList GetParameterSSAVariables() const;
 		MediumLevelILSSAVariableList GetSourceSSAVariables() const;
 	};
 
@@ -1189,9 +1172,9 @@ namespace BinaryNinja
 			return GetRawOperandAsExpr(0).GetRawOperandAsVariableList(0);
 		}
 		MediumLevelILInstruction GetDestExpr() const { return GetRawOperandAsExpr(1); }
-		MediumLevelILVariableList GetParameterVariables() const
+		MediumLevelILInstructionList GetParameterExprs() const
 		{
-			return GetRawOperandAsExpr(2).GetRawOperandAsVariableList(0);
+			return GetRawOperandAsExpr(2).GetRawOperandAsExprList(0);
 		}
 		MediumLevelILInstruction GetStackExpr() const { return GetRawOperandAsExpr(3); }
 	};
@@ -1208,9 +1191,9 @@ namespace BinaryNinja
 		{
 			return GetRawOperandAsExpr(0).GetRawOperandAsVariableList(0);
 		}
-		MediumLevelILVariableList GetParameterVariables() const
+		MediumLevelILInstructionList GetParameterExprs() const
 		{
-			return GetRawOperandAsExpr(1).GetRawOperandAsVariableList(0);
+			return GetRawOperandAsExpr(1).GetRawOperandAsExprList(0);
 		}
 		MediumLevelILInstruction GetStackExpr() const { return GetRawOperandAsExpr(2); }
 	};
@@ -1229,12 +1212,22 @@ namespace BinaryNinja
 			return GetRawOperandAsExpr(0).GetRawOperandAsVariableList(0);
 		}
 		MediumLevelILInstruction GetDestExpr() const { return GetRawOperandAsExpr(1); }
-		MediumLevelILVariableList GetParameterVariables() const
+		MediumLevelILInstructionList GetParameterExprs() const
 		{
-			return GetRawOperandAsExpr(2).GetRawOperandAsVariableList(0);
+			return GetRawOperandAsExpr(2).GetRawOperandAsExprList(0);
 		}
 		MediumLevelILInstruction GetStackExpr() const { return GetRawOperandAsExpr(3); }
 	};
+	template <>
+	struct MediumLevelILInstructionAccessor<MLIL_SEPARATE_PARAM_LIST> : public MediumLevelILInstructionBase
+	{
+		MediumLevelILInstructionList GetParameterExprs() const { return GetRawOperandAsExprList(0); }
+	};
+	template <>
+	struct MediumLevelILInstructionAccessor<MLIL_SHARED_PARAM_SLOT> : public MediumLevelILInstructionBase
+	{
+		MediumLevelILInstructionList GetParameterExprs() const { return GetRawOperandAsExprList(0); }
+	};
 
 	template <>
 	struct MediumLevelILInstructionAccessor<MLIL_CALL_SSA> : public MediumLevelILInstructionBase
@@ -1268,9 +1261,9 @@ namespace BinaryNinja
 			return GetRawOperandAsExpr(0).GetRawOperandAsSSAVariableList(1);
 		}
 		MediumLevelILInstruction GetDestExpr() const { return GetRawOperandAsExpr(1); }
-		MediumLevelILSSAVariableList GetParameterSSAVariables() const
+		MediumLevelILInstructionList GetParameterExprs() const
 		{
-			return GetRawOperandAsExpr(2).GetRawOperandAsSSAVariableList(1);
+			return GetRawOperandAsExpr(2).GetRawOperandAsExprList(1);
 		}
 		size_t GetSourceMemoryVersion() const { return GetRawOperandAsExpr(2).GetRawOperandAsIndex(0); }
 		MediumLevelILInstruction GetStackExpr() const { return GetRawOperandAsExpr(3); }
@@ -1280,9 +1273,13 @@ namespace BinaryNinja
 		{
 			GetRawOperandAsExpr(0).UpdateRawOperandAsSSAVariableList(1, vars);
 		}
-		void SetParameterSSAVariables(const _STD_VECTOR<SSAVariable>& vars)
+		void SetParameterExprs(const _STD_VECTOR<MediumLevelILInstruction>& params)
+		{
+			GetRawOperandAsExpr(2).UpdateRawOperandAsExprList(1, params);
+		}
+		void SetParameterExprs(const _STD_VECTOR<ExprId>& params)
 		{
-			GetRawOperandAsExpr(2).UpdateRawOperandAsSSAVariableList(1, vars);
+			GetRawOperandAsExpr(2).UpdateRawOperandAsExprList(1, params);
 		}
 	};
 	template <>
@@ -1315,9 +1312,9 @@ namespace BinaryNinja
 		{
 			return GetRawOperandAsExpr(0).GetRawOperandAsSSAVariableList(1);
 		}
-		MediumLevelILSSAVariableList GetParameterSSAVariables() const
+		MediumLevelILInstructionList GetParameterExprs() const
 		{
-			return GetRawOperandAsExpr(1).GetRawOperandAsSSAVariableList(1);
+			return GetRawOperandAsExpr(1).GetRawOperandAsExprList(1);
 		}
 		size_t GetSourceMemoryVersion() const { return GetRawOperandAsExpr(1).GetRawOperandAsIndex(0); }
 		MediumLevelILInstruction GetStackExpr() const { return GetRawOperandAsExpr(2); }
@@ -1327,9 +1324,13 @@ namespace BinaryNinja
 		{
 			GetRawOperandAsExpr(0).UpdateRawOperandAsSSAVariableList(1, vars);
 		}
-		void SetParameterSSAVariables(const _STD_VECTOR<SSAVariable>& vars)
+		void SetParameterExprs(const _STD_VECTOR<MediumLevelILInstruction>& params)
+		{
+			GetRawOperandAsExpr(1).UpdateRawOperandAsExprList(1, params);
+		}
+		void SetParameterExprs(const _STD_VECTOR<ExprId>& params)
 		{
-			GetRawOperandAsExpr(1).UpdateRawOperandAsSSAVariableList(1, vars);
+			GetRawOperandAsExpr(1).UpdateRawOperandAsExprList(1, params);
 		}
 	};
 	template <>
@@ -1364,9 +1365,9 @@ namespace BinaryNinja
 			return GetRawOperandAsExpr(0).GetRawOperandAsSSAVariableList(1);
 		}
 		MediumLevelILInstruction GetDestExpr() const { return GetRawOperandAsExpr(1); }
-		MediumLevelILSSAVariableList GetParameterSSAVariables() const
+		MediumLevelILInstructionList GetParameterExprs() const
 		{
-			return GetRawOperandAsExpr(2).GetRawOperandAsSSAVariableList(1);
+			return GetRawOperandAsExpr(2).GetRawOperandAsExprList(1);
 		}
 		size_t GetSourceMemoryVersion() const { return GetRawOperandAsExpr(2).GetRawOperandAsIndex(0); }
 		MediumLevelILInstruction GetStackExpr() const { return GetRawOperandAsExpr(3); }
@@ -1376,9 +1377,13 @@ namespace BinaryNinja
 		{
 			GetRawOperandAsExpr(0).UpdateRawOperandAsSSAVariableList(1, vars);
 		}
-		void SetParameterSSAVariables(const _STD_VECTOR<SSAVariable>& vars)
+		void SetParameterExprs(const _STD_VECTOR<MediumLevelILInstruction>& params)
+		{
+			GetRawOperandAsExpr(2).UpdateRawOperandAsExprList(1, params);
+		}
+		void SetParameterExprs(const _STD_VECTOR<ExprId>& params)
 		{
-			GetRawOperandAsExpr(2).UpdateRawOperandAsSSAVariableList(1, vars);
+			GetRawOperandAsExpr(2).UpdateRawOperandAsExprList(1, params);
 		}
 	};
 
diff --git a/python/lowlevelil.py b/python/lowlevelil.py
index 3354dae4..df8f352b 100644
--- a/python/lowlevelil.py
+++ b/python/lowlevelil.py
@@ -447,7 +447,9 @@ class LowLevelILInstruction(BaseILInstruction):
 	                                               ("dest_memory", "int"), ("dest", "reg_ssa_list")
 	                                           ], LowLevelILOperation.LLIL_CALL_STACK_SSA: [("src", "reg_ssa"),
 	                                                                                        ("src_memory", "int")],
-	    LowLevelILOperation.LLIL_CALL_PARAM: [("src", "expr_list")], LowLevelILOperation.LLIL_LOAD_SSA: [
+	    LowLevelILOperation.LLIL_CALL_PARAM: [("src", "expr_list")],
+		LowLevelILOperation.LLIL_SEPARATE_PARAM_LIST_SSA: [("src", "expr_list")], 
+		LowLevelILOperation.LLIL_SHARED_PARAM_SLOT_SSA: [("src", "expr_list")], LowLevelILOperation.LLIL_LOAD_SSA: [
 	        ("src", "expr"), ("src_memory", "int")
 	    ], LowLevelILOperation.LLIL_STORE_SSA: [("dest", "expr"), ("dest_memory", "int"), ("src_memory", "int"),
 	                                            ("src", "expr")], LowLevelILOperation.LLIL_REG_PHI: [
@@ -1706,6 +1708,44 @@ class LowLevelILCallParam(LowLevelILInstruction, SSA):
 
 
 @dataclass(frozen=True, repr=False, eq=False)
+class LowLevelILSeparateParamListSsa(LowLevelILInstruction, SSA):
+	def __repr__(self):
+		return f"<LowLevelILSeparateParamListSsa: {self.src}>"
+
+	def __str__(self):
+		return str(self.src)
+
+	@property
+	def src(self) -> List['LowLevelILInstruction']:
+		return self._get_expr_list(0)
+
+	@property
+	def detailed_operands(self) -> List[Tuple[str, LowLevelILOperandType, str]]:
+		return [
+			("src", self.src, "List[LowLevelILInstruction]"),
+		]
+
+
+@dataclass(frozen=True, repr=False, eq=False)
+class LowLevelILSharedParamSlotSsa(LowLevelILInstruction, SSA):
+	def __repr__(self):
+		return f"<LowLevelILSharedParamSlotSsa: {self.src}>"
+
+	def __str__(self):
+		return str(self.src)
+
+	@property
+	def src(self) -> List['LowLevelILInstruction']:
+		return self._get_expr_list(0)
+
+	@property
+	def detailed_operands(self) -> List[Tuple[str, LowLevelILOperandType, str]]:
+		return [
+			("src", self.src, "List[LowLevelILInstruction]"),
+		]
+
+
+@dataclass(frozen=True, repr=False, eq=False)
 class LowLevelILMemPhi(LowLevelILInstruction, Memory, Phi):
 	@property
 	def dest_memory(self) -> int:
@@ -2977,6 +3017,8 @@ ILInstruction:Dict[LowLevelILOperation, LowLevelILInstruction] = {  # type: igno
     LowLevelILOperation.LLIL_CALL_OUTPUT_SSA: LowLevelILCallOutputSsa,              #  [("dest_memory", "int"), ("dest", "reg_ssa_list")],
     LowLevelILOperation.LLIL_CALL_STACK_SSA: LowLevelILCallStackSsa,                #  [("src", "reg_ssa"), ("src_memory", "int")],
     LowLevelILOperation.LLIL_CALL_PARAM: LowLevelILCallParam,                       #  [("src", "expr_list")],
+    LowLevelILOperation.LLIL_SEPARATE_PARAM_LIST_SSA: LowLevelILSeparateParamListSsa, #  [("src", "expr_list")],
+    LowLevelILOperation.LLIL_SHARED_PARAM_SLOT_SSA: LowLevelILSharedParamSlotSsa,   #  [("src", "expr_list")],
     LowLevelILOperation.LLIL_LOAD_SSA: LowLevelILLoadSsa,                           #  [("src", "expr"), ("src_memory", "int")],
     LowLevelILOperation.LLIL_STORE_SSA: LowLevelILStoreSsa,                         #  [("dest", "expr"), ("dest_memory", "int"), ("src_memory", "int"), ("src", "expr")],
     LowLevelILOperation.LLIL_REG_PHI: LowLevelILRegPhi,                             #  [("dest", "reg_ssa"), ("src", "reg_ssa_list")],
diff --git a/python/mediumlevelil.py b/python/mediumlevelil.py
index 1ae61d38..90f15e7d 100644
--- a/python/mediumlevelil.py
+++ b/python/mediumlevelil.py
@@ -218,7 +218,11 @@ class MediumLevelILInstruction(BaseILInstruction):
 	    ], MediumLevelILOperation.MLIL_CALL_UNTYPED: [
 	        ("output", "expr"), ("dest", "expr"), ("params", "expr"), ("stack", "expr")
 	    ], MediumLevelILOperation.MLIL_CALL_OUTPUT: [("dest", "var_list")], MediumLevelILOperation.MLIL_CALL_PARAM: [
-	        ("src", "var_list")
+	        ("src", "expr_list")
+	    ], MediumLevelILOperation.MLIL_SEPARATE_PARAM_LIST: [
+	        ("params", "expr_list")
+	    ], MediumLevelILOperation.MLIL_SHARED_PARAM_SLOT: [
+	        ("params", "expr_list")
 	    ], MediumLevelILOperation.MLIL_RET: [
 	        ("src", "expr_list")
 	    ], MediumLevelILOperation.MLIL_NORET: [], MediumLevelILOperation.MLIL_IF: [
@@ -328,7 +332,7 @@ class MediumLevelILInstruction(BaseILInstruction):
 	    ], MediumLevelILOperation.MLIL_CALL_OUTPUT_SSA: [
 	        ("dest_memory", "int"), ("dest", "var_ssa_list")
 	    ], MediumLevelILOperation.MLIL_CALL_PARAM_SSA: [
-	        ("src_memory", "int"), ("src", "var_ssa_list")
+	        ("src_memory", "int"), ("src", "expr_list")
 	    ], MediumLevelILOperation.MLIL_LOAD_SSA: [
 	        ("src", "expr"), ("src_memory", "int")
 	    ], MediumLevelILOperation.MLIL_LOAD_STRUCT_SSA: [
@@ -1285,11 +1289,39 @@ class MediumLevelILCallParam(MediumLevelILInstruction):
 
 	@property
 	def src(self) -> List[variable.Variable]:
-		return self._get_var_list(0, 1)
+		return self._get_expr_list(0, 1)
+
+	@property
+	def detailed_operands(self) -> List[Tuple[str, MediumLevelILOperandType, str]]:
+		return [("src", self.src, "List[MediumLevelILInstruction]")]
+
+
+@dataclass(frozen=True, repr=False, eq=False)
+class MediumLevelILSeparateParamList(MediumLevelILInstruction):
+	def __repr__(self):
+		return f"<MediumLevelILSeparateParamList: {self.src}>"
+
+	@property
+	def src(self) -> List[variable.Variable]:
+		return self._get_expr_list(0, 1)
 
 	@property
 	def detailed_operands(self) -> List[Tuple[str, MediumLevelILOperandType, str]]:
-		return [("src", self.src, "List[Variable]")]
+		return [("src", self.src, "List[MediumLevelILInstruction]")]
+
+
+@dataclass(frozen=True, repr=False, eq=False)
+class MediumLevelILSharedParamSlot(MediumLevelILInstruction):
+	def __repr__(self):
+		return f"<MediumLevelILSharedParamSlot: {self.src}>"
+
+	@property
+	def src(self) -> List[variable.Variable]:
+		return self._get_expr_list(0, 1)
+
+	@property
+	def detailed_operands(self) -> List[Tuple[str, MediumLevelILOperandType, str]]:
+		return [("src", self.src, "List[MediumLevelILInstruction]")]
 
 
 @dataclass(frozen=True, repr=False, eq=False)
@@ -1856,13 +1888,13 @@ class MediumLevelILCallParamSsa(MediumLevelILInstruction, SSA):
 
 	@property
 	def src(self) -> List[SSAVariable]:
-		return self._get_var_ssa_list(1, 2)
+		return self._get_expr_list(1, 2)
 
 	@property
 	def detailed_operands(self) -> List[Tuple[str, MediumLevelILOperandType, str]]:
 		return [
 			('src_memory', self.src_memory, 'int'),
-			('src', self.src, 'List[SSAVariable]'),
+			('src', self.src, 'List[MediumLevelILInstruction]'),
 		]
 
 
@@ -2865,7 +2897,9 @@ ILInstruction = {
     MediumLevelILOperation.MLIL_JUMP: MediumLevelILJump,  # [("dest", "expr")],
     MediumLevelILOperation.MLIL_RET_HINT: MediumLevelILRetHint,  # [("dest", "expr")],
     MediumLevelILOperation.MLIL_CALL_OUTPUT: MediumLevelILCallOutput,  # [("dest", "var_list")],
-    MediumLevelILOperation.MLIL_CALL_PARAM: MediumLevelILCallParam,  # [("src", "var_list")],
+    MediumLevelILOperation.MLIL_CALL_PARAM: MediumLevelILCallParam,  # [("src", "expr_list")],
+    MediumLevelILOperation.MLIL_SEPARATE_PARAM_LIST: MediumLevelILSeparateParamList,  # [("src", "expr_list")],
+    MediumLevelILOperation.MLIL_SHARED_PARAM_SLOT: MediumLevelILSharedParamSlot,  # [("src", "expr_list")],
     MediumLevelILOperation.MLIL_RET: MediumLevelILRet,  # [("src", "expr_list")],
     MediumLevelILOperation.MLIL_GOTO: MediumLevelILGoto,  # [("dest", "int")],
     MediumLevelILOperation.MLIL_BOOL_TO_INT: MediumLevelILBoolToInt,  # [("src", "expr")],
@@ -2905,7 +2939,7 @@ ILInstruction = {
     MediumLevelILOperation.MLIL_CALL_OUTPUT_SSA:
         MediumLevelILCallOutputSsa,  # [("dest_memory", "int"), ("dest", "var_ssa_list")],
     MediumLevelILOperation.MLIL_CALL_PARAM_SSA:
-        MediumLevelILCallParamSsa,  # [("src_memory", "int"), ("src", "var_ssa_list")],
+        MediumLevelILCallParamSsa,  # [("src_memory", "int"), ("src", "expr_list")],
     MediumLevelILOperation.MLIL_LOAD_SSA: MediumLevelILLoadSsa,  # [("src", "expr"), ("src_memory", "int")],
     MediumLevelILOperation.MLIL_VAR_PHI: MediumLevelILVarPhi,  # [("dest", "var_ssa"), ("src", "var_ssa_list")],
     MediumLevelILOperation.MLIL_MEM_PHI: MediumLevelILMemPhi,  # [("dest_memory", "int"), ("src_memory", "int_list")],
diff --git a/rust/examples/mlil_visitor/src/main.rs b/rust/examples/mlil_visitor/src/main.rs
index f83a7eac..3df005a7 100644
--- a/rust/examples/mlil_visitor/src/main.rs
+++ b/rust/examples/mlil_visitor/src/main.rs
@@ -109,6 +109,8 @@ fn print_operation(operation: &MediumLevelILOperation) {
         CallUntyped(_) => print!("CallUntyped"),
         TailcallUntyped(_) => print!("TailcallUntyped"),
         SyscallUntyped(_) => print!("SyscallUntyped"),
+        SeparateParamList(_) => print!("SeparateParamList"),
+        SharedParamSlot(_) => print!("SharedParamSlot"),
         Neg(_) => print!("Neg"),
         Not(_) => print!("Not"),
         Sx(_) => print!("Sx"),
diff --git a/rust/src/mlil/instruction.rs b/rust/src/mlil/instruction.rs
index 5e237128..139abe20 100644
--- a/rust/src/mlil/instruction.rs
+++ b/rust/src/mlil/instruction.rs
@@ -113,6 +113,8 @@ pub enum MediumLevelILOperation {
     CallUntyped(CallUntyped),
     TailcallUntyped(CallUntyped),
     SyscallUntyped(SyscallUntyped),
+    SeparateParamList(SeparateParamList),
+    SharedParamSlot(SharedParamSlot),
     Neg(UnaryOp),
     Not(UnaryOp),
     Sx(UnaryOp),
@@ -535,6 +537,12 @@ impl MediumLevelILInstruction {
                 op.operands[1] as usize,
                 op.operands[2] as usize,
             )),
+            MLIL_SEPARATE_PARAM_LIST => Op::SeparateParamList(SeparateParamList::new(
+                (op.operands[0] as usize, op.operands[1] as usize)
+            )),
+            MLIL_SHARED_PARAM_SLOT => Op::SharedParamSlot(SharedParamSlot::new(
+                (op.operands[0] as usize, op.operands[1] as usize)
+            )),
             MLIL_NEG => Op::Neg(UnaryOp::new(op.operands[0] as usize)),
             MLIL_NOT => Op::Not(UnaryOp::new(op.operands[0] as usize)),
             MLIL_SX => Op::Sx(UnaryOp::new(op.operands[0] as usize)),
@@ -706,6 +714,8 @@ impl MediumLevelILInstruction {
             CallUntyped(op) => Lifted::CallUntyped(op.lift(&self.function)),
             TailcallUntyped(op) => Lifted::TailcallUntyped(op.lift(&self.function)),
             SyscallUntyped(op) => Lifted::SyscallUntyped(op.lift(&self.function)),
+            SeparateParamList(op) => Lifted::SeparateParamList(op.lift(&self.function)),
+            SharedParamSlot(op) => Lifted::SharedParamSlot(op.lift(&self.function)),
             Neg(op) => Lifted::Neg(op.lift(&self.function)),
             Not(op) => Lifted::Not(op.lift(&self.function)),
             Sx(op) => Lifted::Sx(op.lift(&self.function)),
@@ -793,6 +803,8 @@ impl MediumLevelILInstruction {
             SyscallUntypedSsa(op) => Box::new(op.operands(&self.function)),
             CallUntyped(op) | TailcallUntyped(op) => Box::new(op.operands(&self.function)),
             SyscallUntyped(op) => Box::new(op.operands(&self.function)),
+            SeparateParamList(op) => Box::new(op.operands(&self.function)),
+            SharedParamSlot(op) => Box::new(op.operands(&self.function)),
             Neg(op) | Not(op) | Sx(op) | Zx(op) | LowPart(op) | BoolToInt(op) | UnimplMem(op)
             | Fsqrt(op) | Fneg(op) | Fabs(op) | FloatToInt(op) | IntToFloat(op) | FloatConv(op)
             | RoundToInt(op) | Floor(op) | Ceil(op) | Ftrunc(op) | Load(op) => {
diff --git a/rust/src/mlil/lift.rs b/rust/src/mlil/lift.rs
index 68a7884e..fc996cb4 100644
--- a/rust/src/mlil/lift.rs
+++ b/rust/src/mlil/lift.rs
@@ -105,6 +105,8 @@ pub enum MediumLevelILLiftedOperation {
     CallUntyped(LiftedCallUntyped),
     TailcallUntyped(LiftedCallUntyped),
     SyscallUntyped(LiftedSyscallUntyped),
+    SeparateParamList(LiftedSeparateParamList),
+    SharedParamSlot(LiftedSharedParamSlot),
     Neg(LiftedUnaryOp),
     Not(LiftedUnaryOp),
     Sx(LiftedUnaryOp),
diff --git a/rust/src/mlil/operation.rs b/rust/src/mlil/operation.rs
index cdff02b2..880155e3 100644
--- a/rust/src/mlil/operation.rs
+++ b/rust/src/mlil/operation.rs
@@ -252,12 +252,22 @@ fn get_call_list(
     OperandList::new(function, op.operands[1] as usize, op.operands[0] as usize).map_var()
 }
 
+fn get_call_exprs(
+    function: &MediumLevelILFunction,
+    op_type: BNMediumLevelILOperation,
+    idx: usize,
+) -> OperandExprList {
+    let op = unsafe { BNGetMediumLevelILByIndex(function.handle, idx) };
+    assert_eq!(op.operation, op_type);
+    OperandList::new(function, op.operands[1] as usize, op.operands[0] as usize).map_expr()
+}
+
 fn get_call_output(function: &MediumLevelILFunction, idx: usize) -> OperandVariableList {
     get_call_list(function, BNMediumLevelILOperation::MLIL_CALL_OUTPUT, idx)
 }
 
-fn get_call_params(function: &MediumLevelILFunction, idx: usize) -> OperandVariableList {
-    get_call_list(function, BNMediumLevelILOperation::MLIL_CALL_PARAM, idx)
+fn get_call_params(function: &MediumLevelILFunction, idx: usize) -> OperandExprList {
+    get_call_exprs(function, BNMediumLevelILOperation::MLIL_CALL_PARAM, idx)
 }
 
 fn get_call_list_ssa(
@@ -270,6 +280,16 @@ fn get_call_list_ssa(
     OperandList::new(function, op.operands[2] as usize, op.operands[1] as usize).map_ssa_var()
 }
 
+fn get_call_exprs_ssa(
+    function: &MediumLevelILFunction,
+    op_type: BNMediumLevelILOperation,
+    idx: usize,
+) -> OperandExprList {
+    let op = get_raw_operation(function, idx);
+    assert_eq!(op.operation, op_type);
+    OperandList::new(function, op.operands[2] as usize, op.operands[1] as usize).map_expr()
+}
+
 fn get_call_output_ssa(function: &MediumLevelILFunction, idx: usize) -> OperandSSAVariableList {
     get_call_list_ssa(
         function,
@@ -278,8 +298,8 @@ fn get_call_output_ssa(function: &MediumLevelILFunction, idx: usize) -> OperandS
     )
 }
 
-fn get_call_params_ssa(function: &MediumLevelILFunction, idx: usize) -> OperandSSAVariableList {
-    get_call_list_ssa(function, BNMediumLevelILOperation::MLIL_CALL_PARAM_SSA, idx)
+fn get_call_params_ssa(function: &MediumLevelILFunction, idx: usize) -> OperandExprList {
+    get_call_exprs_ssa(function, BNMediumLevelILOperation::MLIL_CALL_PARAM_SSA, idx)
 }
 
 // NOP, NORET, BP, UNDEF, UNIMPL
@@ -1605,7 +1625,7 @@ pub struct CallUntypedSsa {
 pub struct LiftedCallUntypedSsa {
     pub output: Vec<SSAVariable>,
     pub dest: Box<MediumLevelILLiftedInstruction>,
-    pub params: Vec<SSAVariable>,
+    pub params: Vec<MediumLevelILLiftedInstruction>,
     pub stack: Box<MediumLevelILLiftedInstruction>,
 }
 impl CallUntypedSsa {
@@ -1623,7 +1643,7 @@ impl CallUntypedSsa {
     pub fn dest(&self, function: &MediumLevelILFunction) -> MediumLevelILInstruction {
         get_operation(function, self.dest)
     }
-    pub fn params(&self, function: &MediumLevelILFunction) -> OperandSSAVariableList {
+    pub fn params(&self, function: &MediumLevelILFunction) -> OperandExprList {
         get_call_params_ssa(function, self.params)
     }
     pub fn stack(&self, function: &MediumLevelILFunction) -> MediumLevelILInstruction {
@@ -1633,7 +1653,7 @@ impl CallUntypedSsa {
         LiftedCallUntypedSsa {
             output: self.output(function).collect(),
             dest: Box::new(self.dest(function).lift()),
-            params: self.params(function).collect(),
+            params: self.params(function).map(|instr| instr.lift()).collect(),
             stack: Box::new(self.stack(function).lift()),
         }
     }
@@ -1645,7 +1665,7 @@ impl CallUntypedSsa {
         [
             ("output", VarSsaList(self.output(function))),
             ("dest", Expr(self.dest(function))),
-            ("params", VarSsaList(self.params(function))),
+            ("params", ExprList(self.params(function))),
             ("stack", Expr(self.stack(function))),
         ]
         .into_iter()
@@ -1713,7 +1733,7 @@ pub struct SyscallUntypedSsa {
 #[derive(Clone, Debug, PartialEq)]
 pub struct LiftedSyscallUntypedSsa {
     pub output: Vec<SSAVariable>,
-    pub params: Vec<SSAVariable>,
+    pub params: Vec<MediumLevelILLiftedInstruction>,
     pub stack: Box<MediumLevelILLiftedInstruction>,
 }
 impl SyscallUntypedSsa {
@@ -1727,7 +1747,7 @@ impl SyscallUntypedSsa {
     pub fn output(&self, function: &MediumLevelILFunction) -> OperandSSAVariableList {
         get_call_output_ssa(function, self.output)
     }
-    pub fn params(&self, function: &MediumLevelILFunction) -> OperandSSAVariableList {
+    pub fn params(&self, function: &MediumLevelILFunction) -> OperandExprList {
         get_call_params_ssa(function, self.params)
     }
     pub fn stack(&self, function: &MediumLevelILFunction) -> MediumLevelILInstruction {
@@ -1736,7 +1756,7 @@ impl SyscallUntypedSsa {
     pub fn lift(&self, function: &MediumLevelILFunction) -> LiftedSyscallUntypedSsa {
         LiftedSyscallUntypedSsa {
             output: self.output(function).collect(),
-            params: self.params(function).collect(),
+            params: self.params(function).map(|instr| instr.lift()).collect(),
             stack: Box::new(self.stack(function).lift()),
         }
     }
@@ -1747,7 +1767,7 @@ impl SyscallUntypedSsa {
         use MediumLevelILOperand::*;
         [
             ("output", VarSsaList(self.output(function))),
-            ("params", VarSsaList(self.params(function))),
+            ("params", ExprList(self.params(function))),
             ("stack", Expr(self.stack(function))),
         ]
         .into_iter()
@@ -1766,7 +1786,7 @@ pub struct CallUntyped {
 pub struct LiftedCallUntyped {
     pub output: Vec<Variable>,
     pub dest: Box<MediumLevelILLiftedInstruction>,
-    pub params: Vec<Variable>,
+    pub params: Vec<MediumLevelILLiftedInstruction>,
     pub stack: Box<MediumLevelILLiftedInstruction>,
 }
 impl CallUntyped {
@@ -1784,7 +1804,7 @@ impl CallUntyped {
     pub fn dest(&self, function: &MediumLevelILFunction) -> MediumLevelILInstruction {
         get_operation(function, self.dest)
     }
-    pub fn params(&self, function: &MediumLevelILFunction) -> OperandVariableList {
+    pub fn params(&self, function: &MediumLevelILFunction) -> OperandExprList {
         get_call_params(function, self.params)
     }
     pub fn stack(&self, function: &MediumLevelILFunction) -> MediumLevelILInstruction {
@@ -1794,7 +1814,7 @@ impl CallUntyped {
         LiftedCallUntyped {
             output: self.output(function).collect(),
             dest: Box::new(self.dest(function).lift()),
-            params: self.params(function).collect(),
+            params: self.params(function).map(|instr| instr.lift()).collect(),
             stack: Box::new(self.stack(function).lift()),
         }
     }
@@ -1806,7 +1826,7 @@ impl CallUntyped {
         [
             ("output", VarList(self.output(function))),
             ("dest", Expr(self.dest(function))),
-            ("params", VarList(self.params(function))),
+            ("params", ExprList(self.params(function))),
             ("stack", Expr(self.stack(function))),
         ]
         .into_iter()
@@ -1823,7 +1843,7 @@ pub struct SyscallUntyped {
 #[derive(Clone, Debug, PartialEq)]
 pub struct LiftedSyscallUntyped {
     pub output: Vec<Variable>,
-    pub params: Vec<Variable>,
+    pub params: Vec<MediumLevelILLiftedInstruction>,
     pub stack: Box<MediumLevelILLiftedInstruction>,
 }
 impl SyscallUntyped {
@@ -1837,7 +1857,7 @@ impl SyscallUntyped {
     pub fn output(&self, function: &MediumLevelILFunction) -> OperandVariableList {
         get_call_output(function, self.output)
     }
-    pub fn params(&self, function: &MediumLevelILFunction) -> OperandVariableList {
+    pub fn params(&self, function: &MediumLevelILFunction) -> OperandExprList {
         get_call_params(function, self.params)
     }
     pub fn stack(&self, function: &MediumLevelILFunction) -> MediumLevelILInstruction {
@@ -1846,7 +1866,7 @@ impl SyscallUntyped {
     pub fn lift(&self, function: &MediumLevelILFunction) -> LiftedSyscallUntyped {
         LiftedSyscallUntyped {
             output: self.output(function).collect(),
-            params: self.params(function).collect(),
+            params: self.params(function).map(|instr| instr.lift()).collect(),
             stack: Box::new(self.stack(function).lift()),
         }
     }
@@ -1857,7 +1877,7 @@ impl SyscallUntyped {
         use MediumLevelILOperand::*;
         [
             ("output", VarList(self.output(function))),
-            ("params", VarList(self.params(function))),
+            ("params", ExprList(self.params(function))),
             ("stack", Expr(self.stack(function))),
         ]
         .into_iter()
@@ -2050,6 +2070,64 @@ impl Ret {
     }
 }
 
+// SEPARATE_PARAM_LIST
+#[derive(Copy, Clone)]
+pub struct SeparateParamList {
+    params: (usize, usize),
+}
+#[derive(Clone, Debug, PartialEq)]
+pub struct LiftedSeparateParamList {
+    pub params: Vec<MediumLevelILLiftedInstruction>,
+}
+impl SeparateParamList {
+    pub fn new(params: (usize, usize)) -> Self {
+        Self { params }
+    }
+    pub fn params(&self, function: &MediumLevelILFunction) -> OperandExprList {
+        OperandList::new(function, self.params.1, self.params.0).map_expr()
+    }
+    pub fn lift(&self, function: &MediumLevelILFunction) -> LiftedSeparateParamList {
+        LiftedSeparateParamList {
+            params: self.params(function).map(|instr| instr.lift()).collect(),
+        }
+    }
+    pub fn operands(
+        &self,
+        function: &MediumLevelILFunction,
+    ) -> impl Iterator<Item = (&'static str, MediumLevelILOperand)> {
+        [("params", MediumLevelILOperand::ExprList(self.params(function)))].into_iter()
+    }
+}
+
+// SHARED_PARAM_SLOT
+#[derive(Copy, Clone)]
+pub struct SharedParamSlot {
+    params: (usize, usize),
+}
+#[derive(Clone, Debug, PartialEq)]
+pub struct LiftedSharedParamSlot {
+    pub params: Vec<MediumLevelILLiftedInstruction>,
+}
+impl SharedParamSlot {
+    pub fn new(params: (usize, usize)) -> Self {
+        Self { params }
+    }
+    pub fn params(&self, function: &MediumLevelILFunction) -> OperandExprList {
+        OperandList::new(function, self.params.1, self.params.0).map_expr()
+    }
+    pub fn lift(&self, function: &MediumLevelILFunction) -> LiftedSharedParamSlot {
+        LiftedSharedParamSlot {
+            params: self.params(function).map(|instr| instr.lift()).collect(),
+        }
+    }
+    pub fn operands(
+        &self,
+        function: &MediumLevelILFunction,
+    ) -> impl Iterator<Item = (&'static str, MediumLevelILOperand)> {
+        [("params", MediumLevelILOperand::ExprList(self.params(function)))].into_iter()
+    }
+}
+
 // VAR, ADDRESS_OF
 #[derive(Copy, Clone, Debug, Hash, PartialEq, Eq)]
 pub struct Var {