Skip to content

[ARMv7] Expand ARM and Thumb SIMD and VFP lifting - #8556

Open
zznop wants to merge 1 commit into
devfrom
test_lift_armv7_dh_instrs
Open

zznop wants to merge 1 commit into
devfrom
test_lift_armv7_dh_instrs

Conversation

@zznop

@zznop zznop commented Sep 16, 2026

Copy link
Copy Markdown
Member

This PR expands lifting for vector comparisons, bitwise operations, widening/narrowing moves, and more. Expansion includes all the ARMv7 instructions from this issue: https://github.com/Vector35/binaryninja/issues/1910

In addition to expanding lifting, I had to make fixes to the thumb-2 decoder. Here is a short summary:

  • vorr/vbic/vmvn immediates: derive .i16/.i32 types from cmode instead of register bits, immediate payload bits, or a constant
    • Ensures correct immediate replication during lifting
  • vmovl: preserve the encoded signedness instead of unconditionally marking all widening moves as unsigned
  • vcge #0: include the F bit when selecting the data type so .f32 is distinguished from .s32
  • vmull.p64: add the ARMv8 polynomial-multiple decoding
  • Legacy VFP transfers: recognize odd-imm8 fldm*x/fstm*x encodings before selecting vpop/vpush aliases
    • Preserves the extra four bytes in addressing and writeback

I've uploaded my test binaries that I used for verification in addition to the binaries in this repository: https://github.com/Aarno-Labs/iot-binary-dataset (that are responsible for uncovering the issues)

armv7-dh-lifting-expansion.zip

Before:

Screenshot 2026-09-16 at 4 11 33 PM

After:

Screenshot 2026-09-16 at 4 11 58 PM

Add lifting for vector comparisons, bitwise operations, widening and
narrowing moves, multiply-long, negation, pairwise addition, shifts,
swaps, transposes, tests, and interleaving operations. Use dedicated
intrinsics for lane-wise operations and explicit IL for bitwise
operations, register swaps, and scalar floating-point negation.

Correct SIMD decoding, signedness, immediate types, D/Q operand widths,
and reserved encodings. Support ARMv8 VMULL.P64 polynomial products.

Add FLDMDBX/FLDMIAX and FSTMDBX/FSTMIAX lifting, accounting for the
unused trailing word in addressing and writeback. Correct Thumb
decoding of these forms, including SP-based transfers.
@zznop zznop added this to the Langara milestone Sep 16, 2026
@zznop
zznop requested a review from rssor September 16, 2026 20:16
@zznop zznop self-assigned this Sep 16, 2026
@zznop zznop added Arch: ARM/Thumb Issues with the ARM/Thumb architecture plugin Lifting issues related to LLIL lifting labels Sep 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Arch: ARM/Thumb Issues with the ARM/Thumb architecture plugin Lifting issues related to LLIL lifting

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant