Strange MIPS lifting

[soyantouwu]

In this binary, $s5 is set to a pointer and below, a function call is performed using $s5 as the address for an array of structures

800370a4  0480023c   lui     $v0, 0x8004
800370a8  a8855524   addiu   $s5, $v0, -0x7a58  {structure_ptr1}
...
80037124  21801502   addu    $s0, $s0, $s5
80037128  0400048e   lw      $a0, 4($s0) {struct1::filename}
8003712c  0480053c   lui     $a1, 0x8004
80037130  909da524   addiu   $a1, $a1, -0x6270  {overlay}
80037134  c6dc000c   jal     0x80037318  {some_function}

LLIL

  17 @ 800370a4  $v0 = 0x80040000
  18 @ 800370a8  $s5 = $v0 - 0x7a58
  ...
  50 @ 80037124  $s0 = $s0 + $s5
  51 @ 80037128  $a0 = [$s0 + 4 {struct1::filename}].d
  52 @ 8003712c  $a1 = 0x80040000
  53 @ 80037130  $a1 = $a1 - 0x6270
  54 @ 80037134  call(some_function)

However, in line 50 of the MLIL binja for some reason expresses it as a subtraction. This seems to cause ugly syntax in the HLIL ($s0 is essentially sizeof(struct1) * some_index)

  50 @ 80037124  $s0 = $s0 - 0x7ffc7a58
  51 @ 80037128  $a0 = [$s0 + 4].d
  52 @ 8003712c  $a1 = 0x80040000
  53 @ 80037130  $a1 = 0x80039d90
  54 @ 80037134  ...registers... = call(some_function $a0, $a1, stack = &var_30)

Resulting HLIL

some_function((index * 0xc - 0x7ffc7a58)->filename, &some_memory)

I apologize if this is hard to read, I would rather not reveal much detail of what I'm working on. I can provide the bndb if required.

[emesare]

I have seen this pattern before but I don't have a binary I can easily find with it, if you could email the binary to me I can take a look.

[email protected]

[soyantouwu]

I just sent you an email with the bndb, might as well save you the time.

[emesare]

V35 can find it as "analysis inn spot shave"

[emesare]

Issue #5927 has been created, dev builds >=6060 have a solution to your problem :) let me know in that issue if you run into anything else related. Thanks.

[soyantouwu]

Thanks for your help. I tried the new build and it is fixed. However, I still see similar patterns when the access is not done on a array. Same database as provided, check 0x80019e7c

80019ea0      do
80019e7c          *(i - 0x7ff344e7) = 0
80019e88          *(i - 0x7ff344d7) = 0
80019e94          *(i - 0x7ff344c7) = 0
80019e98          i += 1
80019ea4          i_1 = 0
80019ea0      while (i s< 8)

[soyantouwu]

This access is done on 0x800CBB19 and even changing the type of that memory to char didn't help

[soyantouwu]

@emesare bump