From 6be9a1fce3d750613d2605c57f0c911d5dc569d0 Mon Sep 17 00:00:00 2001 From: Brandon Miller Date: Fri, 30 Jan 2026 14:24:09 -0500 Subject: Update function recognizer to detect ILP32 plt entries --- arch/arm64/arch_arm64.cpp | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/arch/arm64/arch_arm64.cpp b/arch/arm64/arch_arm64.cpp index 4dc59f86..fb623e4e 100644 --- a/arch/arm64/arch_arm64.cpp +++ b/arch/arm64/arch_arm64.cpp @@ -2337,7 +2337,7 @@ class Arm64ImportedFunctionRecognizer : public FunctionRecognizer LowLevelILInstruction ldOperand = ld.GetSourceExpr(); if (ldOperand.operation != LLIL_LOAD) return false; - if (ldOperand.size != func->GetArchitecture()->GetAddressSize()) + if (ldOperand.size != func->GetPlatform()->GetAddressSize()) return false; LowLevelILInstruction ldAddrOperand = ldOperand.GetSourceExpr(); uint64_t entry = pltPage; @@ -2359,7 +2359,6 @@ class Arm64ImportedFunctionRecognizer : public FunctionRecognizer } else if (ldAddrOperand.operation != LLIL_REG) // If theres no constant return false; - targetReg = ld.GetDestRegister(); Ref sym = data->GetSymbolByAddress(entry); if (!sym) @@ -2370,17 +2369,18 @@ class Arm64ImportedFunctionRecognizer : public FunctionRecognizer LowLevelILInstruction add = il->GetInstruction(2); if (add.operation != LLIL_SET_REG) return false; - if (add.GetDestRegister() != pltReg) + BNRegisterInfo destRegInfo = func->GetArchitecture()->GetRegisterInfo(add.GetDestRegister()); + if (destRegInfo.fullWidthRegister != pltReg) return false; LowLevelILInstruction addOperand = add.GetSourceExpr(); - if (addOperand.operation == LLIL_ADD) { LowLevelILInstruction addLeftOperand = addOperand.GetLeftExpr(); LowLevelILInstruction addRightOperand = addOperand.GetRightExpr(); if (addLeftOperand.operation != LLIL_REG) return false; - if (addLeftOperand.GetSourceRegister() != pltReg) + BNRegisterInfo addLeftRegInfo = func->GetArchitecture()->GetRegisterInfo(addLeftOperand.GetSourceRegister()); + if (addLeftRegInfo.fullWidthRegister != pltReg) return false; if (!LowLevelILFunction::IsConstantType(addRightOperand.operation)) return false; @@ -2399,7 +2399,8 @@ class Arm64ImportedFunctionRecognizer : public FunctionRecognizer jump.GetDestExpr(); if (jumpOperand.operation != LLIL_REG) return false; - if (jumpOperand.GetSourceRegister() != targetReg) + BNRegisterInfo targetRegInfo = func->GetArchitecture()->GetRegisterInfo(targetReg); + if (jumpOperand.GetSourceRegister() != targetRegInfo.fullWidthRegister) return false; Ref funcSym = Symbol::ImportedFunctionFromImportAddressSymbol(sym, func->GetStart()); -- cgit v1.3.1