Add SSA instruction for partial variable writes in HLIL

Author: D0ntPanic

binaryninjaapi.h

@@ -16347,6 +16347,8 @@ namespace BinaryNinja {
 
 		ExprId Var(size_t size, const Variable& src, const ILSourceLocation& loc = ILSourceLocation());
 		ExprId VarSSA(size_t size, const SSAVariable& src, const ILSourceLocation& loc = ILSourceLocation());
+		ExprId VarSSAPartial(size_t size, const Variable& dest, size_t newVersion, size_t prevVersion,
+			const ILSourceLocation& loc = ILSourceLocation());
 		ExprId VarPhi(const SSAVariable& dest, const std::vector<SSAVariable>& sources,
 		    const ILSourceLocation& loc = ILSourceLocation());
 		ExprId MemPhi(

binaryninjacore.h

@@ -1737,6 +1737,7 @@ extern "C"
 		HLIL_FORCE_VER_SSA,
 		HLIL_ASSERT_SSA,
 		HLIL_VAR_SSA,
+		HLIL_VAR_SSA_PARTIAL,
 		HLIL_ARRAY_INDEX_SSA,
 		HLIL_DEREF_SSA,
 		HLIL_DEREF_FIELD_SSA,

highlevelilinstruction.cpp

@@ -60,6 +60,7 @@ static constexpr std::array s_operandTypeForUsage = {
 	OperandUsageType{DestVariableHighLevelOperandUsage, VariableHighLevelOperand},
 	OperandUsageType{SSAVariableHighLevelOperandUsage, SSAVariableHighLevelOperand},
 	OperandUsageType{DestSSAVariableHighLevelOperandUsage, SSAVariableHighLevelOperand},
+	OperandUsageType{PartialSSAVariableSourceHighLevelOperandUsage, SSAVariableHighLevelOperand},
 	OperandUsageType{DestExprHighLevelOperandUsage, ExprHighLevelOperand},
 	OperandUsageType{LeftExprHighLevelOperandUsage, ExprHighLevelOperand},
 	OperandUsageType{RightExprHighLevelOperandUsage, ExprHighLevelOperand},
@@ -113,6 +114,12 @@ struct HighLevelILOperationTraits
 
 	static constexpr uint8_t GetOperandIndexAdvance(OperandUsage usage, size_t /* operandIndex */)
 	{
+		if (usage == PartialSSAVariableSourceHighLevelOperandUsage)
+		{
+			// SSA variables are usually two slots, but this one has previously defined
+			// variables and thus only takes one slot
+			return 1;
+		}
 		switch (OperandTypeForUsage(usage))
 		{
 		case SSAVariableHighLevelOperand:
@@ -252,6 +259,7 @@ static constexpr std::array s_instructionOperandUsage = {
 	OperandUsage{HLIL_FORCE_VER_SSA, {DestSSAVariableHighLevelOperandUsage, SSAVariableHighLevelOperandUsage}},
 	OperandUsage{HLIL_ASSERT_SSA, {SSAVariableHighLevelOperandUsage, ConstantHighLevelOperandUsage}},
 	OperandUsage{HLIL_VAR_SSA, {SSAVariableHighLevelOperandUsage}},
+	OperandUsage{HLIL_VAR_SSA_PARTIAL, {SSAVariableHighLevelOperandUsage, PartialSSAVariableSourceHighLevelOperandUsage}},
 	OperandUsage{HLIL_ARRAY_INDEX_SSA, {SourceExprHighLevelOperandUsage, SourceMemoryVersionHighLevelOperandUsage, IndexExprHighLevelOperandUsage}},
 	OperandUsage{HLIL_DEREF_SSA, {SourceExprHighLevelOperandUsage, SourceMemoryVersionHighLevelOperandUsage}},
 	OperandUsage{HLIL_DEREF_FIELD_SSA, {SourceExprHighLevelOperandUsage, SourceMemoryVersionHighLevelOperandUsage, OffsetHighLevelOperandUsage, MemberIndexHighLevelOperandUsage}},
@@ -816,6 +824,12 @@ SSAVariable HighLevelILInstructionBase::GetRawOperandAsSSAVariable(size_t operan
 }
 
 
+SSAVariable HighLevelILInstructionBase::GetRawOperandAsPartialSSAVariableSource(size_t operand) const
+{
+	return SSAVariable(Variable::FromIdentifier(operands[operand]), (size_t)operands[operand + 2]);
+}
+
+
 HighLevelILInstructionList HighLevelILInstructionBase::GetRawOperandAsExprList(size_t operand) const
 {
 	return HighLevelILInstructionList(
@@ -1528,6 +1542,10 @@ ExprId HighLevelILInstruction::CopyTo(
 		return dest->Var(size, GetVariable<HLIL_VAR>(), loc);
 	case HLIL_VAR_SSA:
 		return dest->VarSSA(size, GetSSAVariable<HLIL_VAR_SSA>(), loc);
+	case HLIL_VAR_SSA_PARTIAL:
+		return dest->VarSSAPartial(size, GetDestSSAVariable<HLIL_VAR_SSA_PARTIAL>().var,
+			GetDestSSAVariable<HLIL_VAR_SSA_PARTIAL>().version,
+			GetSourceSSAVariable<HLIL_VAR_SSA_PARTIAL>().version, loc);
 	case HLIL_VAR_PHI:
 		return dest->VarPhi(GetDestSSAVariable<HLIL_VAR_PHI>(), GetSourceSSAVariables<HLIL_VAR_PHI>(), loc);
 	case HLIL_MEM_PHI:
@@ -1925,6 +1943,16 @@ bool HighLevelILInstruction::operator<(const HighLevelILInstruction& other) cons
 		if (size > other.size)
 			return false;
 		return GetSSAVariable<HLIL_VAR_SSA>() < other.GetSSAVariable<HLIL_VAR_SSA>();
+	case HLIL_VAR_SSA_PARTIAL:
+		if (size < other.size)
+			return true;
+		if (size > other.size)
+			return false;
+		if (GetDestSSAVariable<HLIL_VAR_SSA_PARTIAL>() < other.GetDestSSAVariable<HLIL_VAR_SSA_PARTIAL>())
+			return true;
+		if (other.GetDestSSAVariable<HLIL_VAR_SSA_PARTIAL>() < GetDestSSAVariable<HLIL_VAR_SSA_PARTIAL>())
+			return false;
+		return GetSourceSSAVariable<HLIL_VAR_SSA_PARTIAL>() < other.GetSourceSSAVariable<HLIL_VAR_SSA_PARTIAL>();
 	case HLIL_STRUCT_FIELD:
 		if (size < other.size)
 			return true;
@@ -2324,6 +2352,15 @@ SSAVariable HighLevelILInstruction::GetDestSSAVariable() const
 }
 
 
+SSAVariable HighLevelILInstruction::GetSourceSSAVariable() const
+{
+	size_t operandIndex;
+	if (GetOperandIndexForUsage(PartialSSAVariableSourceHighLevelOperandUsage, operandIndex))
+		return GetRawOperandAsPartialSSAVariableSource(operandIndex - 2);
+	throw MediumLevelILInstructionAccessException();
+}
+
+
 HighLevelILInstruction HighLevelILInstruction::GetDestExpr() const
 {
 	size_t operandIndex;
@@ -2831,6 +2868,13 @@ ExprId HighLevelILFunction::VarSSA(size_t size, const SSAVariable& src, const IL
 }
 
 
+ExprId HighLevelILFunction::VarSSAPartial(size_t size, const Variable& dest, size_t newVersion, size_t prevVersion,
+	const ILSourceLocation& loc)
+{
+	return AddExprWithLocation(HLIL_VAR_SSA_PARTIAL, loc, size, dest.ToIdentifier(), newVersion, prevVersion);
+}
+
+
 ExprId HighLevelILFunction::VarPhi(
     const SSAVariable& dest, const vector<SSAVariable>& sources, const ILSourceLocation& loc)
 {

highlevelilinstruction.h

@@ -89,6 +89,7 @@ namespace BinaryNinja
 		DestVariableHighLevelOperandUsage,
 		SSAVariableHighLevelOperandUsage,
 		DestSSAVariableHighLevelOperandUsage,
+		PartialSSAVariableSourceHighLevelOperandUsage,
 		DestExprHighLevelOperandUsage,
 		LeftExprHighLevelOperandUsage,
 		RightExprHighLevelOperandUsage,
@@ -371,6 +372,7 @@ namespace BinaryNinja
 		HighLevelILInstruction GetRawOperandAsExpr(size_t operand) const;
 		Variable GetRawOperandAsVariable(size_t operand) const;
 		SSAVariable GetRawOperandAsSSAVariable(size_t operand) const;
+		SSAVariable GetRawOperandAsPartialSSAVariableSource(size_t operand) const;
 		HighLevelILInstructionList GetRawOperandAsExprList(size_t operand) const;
 		HighLevelILSSAVariableList GetRawOperandAsSSAVariableList(size_t operand) const;
 		HighLevelILIndexList GetRawOperandAsIndexList(size_t operand) const;
@@ -524,6 +526,11 @@ namespace BinaryNinja
 			return As<N>().GetDestSSAVariable();
 		}
 		template <BNHighLevelILOperation N>
+		SSAVariable GetSourceSSAVariable() const
+		{
+			return As<N>().GetSourceSSAVariable();
+		}
+		template <BNHighLevelILOperation N>
 		HighLevelILInstruction GetDestExpr() const
 		{
 			return As<N>().GetDestExpr();
@@ -700,6 +707,11 @@ namespace BinaryNinja
 			As<N>().SetDestSSAVersion(version);
 		}
 		template <BNHighLevelILOperation N>
+		void SetSourceSSAVersion(size_t version)
+		{
+			As<N>().SetSourceSSAVersion(version);
+		}
+		template <BNHighLevelILOperation N>
 		void SetParameterExprs(const _STD_VECTOR<MediumLevelILInstruction>& params)
 		{
 			As<N>().SetParameterExprs(params);
@@ -779,6 +791,7 @@ namespace BinaryNinja
 		Variable GetDestVariable() const;
 		SSAVariable GetSSAVariable() const;
 		SSAVariable GetDestSSAVariable() const;
+		SSAVariable GetSourceSSAVariable() const;
 		HighLevelILInstruction GetDestExpr() const;
 		HighLevelILInstruction GetLeftExpr() const;
 		HighLevelILInstruction GetRightExpr() const;
@@ -1164,6 +1177,14 @@ namespace BinaryNinja
 		void SetSSAVersion(size_t version) { UpdateRawOperand(1, version); }
 	};
 	template <>
+	struct HighLevelILInstructionAccessor<HLIL_VAR_SSA_PARTIAL> : public HighLevelILInstructionBase
+	{
+		SSAVariable GetDestSSAVariable() const { return GetRawOperandAsSSAVariable(0); }
+		SSAVariable GetSourceSSAVariable() const { return GetRawOperandAsPartialSSAVariableSource(0); }
+		void SetDestSSAVersion(size_t version) { UpdateRawOperand(1, version); }
+		void SetSourceSSAVersion(size_t version) { UpdateRawOperand(2, version); }
+	};
+	template <>
 	struct HighLevelILInstructionAccessor<HLIL_VAR_PHI> : public HighLevelILInstructionBase
 	{
 		SSAVariable GetDestSSAVariable() const { return GetRawOperandAsSSAVariable(0); }

python/highlevelil.py

@@ -191,6 +191,8 @@ class HighLevelILInstruction(BaseILInstruction):
 	        ("dest", "expr_list"), ("dest_memory", "int"), ("src", "expr"), ("src_memory", "int")
 	    ], HighLevelILOperation.HLIL_VAR: [("var", "var")], HighLevelILOperation.HLIL_VAR_SSA: [
 	        ("var", "var_ssa")
+	    ], HighLevelILOperation.HLIL_VAR_SSA_PARTIAL: [
+	        ("var", "var_ssa_dest_and_src"), ("prev", "var_ssa_dest_and_src")
 	    ], HighLevelILOperation.HLIL_VAR_PHI: [("dest", "var_ssa"),
 	                                           ("src", "var_ssa_list")], HighLevelILOperation.HLIL_MEM_PHI: [
 	                                               ("dest", "int"), ("src", "int_list")
@@ -1552,6 +1554,24 @@ def detailed_operands(self) -> List[Tuple[str, HighLevelILOperandType, str]]:
 		]
 
 
+@dataclass(frozen=True, repr=False, eq=False)
+class HighLevelILVarSsaPartial(HighLevelILInstruction, SSAVariableInstruction):
+	@property
+	def dest(self) -> 'mediumlevelil.SSAVariable':
+		return self._get_var_ssa(0, 1)
+
+	@property
+	def prev(self) -> 'mediumlevelil.SSAVariable':
+		return self._get_var_ssa(0, 2)
+
+	@property
+	def detailed_operands(self) -> List[Tuple[str, HighLevelILOperandType, str]]:
+		return [
+			("dest", self.dest, "SSAVariable"),
+			("prev", self.prev, "SSAVariable"),
+		]
+
+
 @dataclass(frozen=True, repr=False, eq=False)
 class HighLevelILVarPhi(HighLevelILInstruction, Phi, SetVar):
 	@property
@@ -2495,6 +2515,7 @@ def src(self) -> 'mediumlevelil.SSAVariable':
         HighLevelILAssignUnpackMemSsa,  #  ("dest", "expr_list"), ("dest_memory", "int"), ("src", "expr"), ("src_memory", "int"),
     HighLevelILOperation.HLIL_VAR: HighLevelILVar,  #  ("var", "var"),
     HighLevelILOperation.HLIL_VAR_SSA: HighLevelILVarSsa,  #  ("var", "var_ssa"),
+	HighLevelILOperation.HLIL_VAR_SSA_PARTIAL: HighLevelILVarSsaPartial,  #  ("dest", "var_ssa_dest_and_src"), ("prev", "var_ssa_dest_and_src"),
     HighLevelILOperation.HLIL_VAR_PHI: HighLevelILVarPhi,  #  ("dest", "var_ssa"), ("src", "var_ssa_list"),
     HighLevelILOperation.HLIL_MEM_PHI: HighLevelILMemPhi,  #  ("dest", "int"), ("src", "int_list"),
     HighLevelILOperation.HLIL_ARRAY_INDEX: HighLevelILArrayIndex,  #  ("src", "expr"), ("index", "expr"),

rust/src/high_level_il/instruction.rs

@@ -614,6 +614,10 @@ impl HighLevelILInstruction {
             HLIL_VAR_SSA => Op::VarSsa(VarSsa {
                 var: get_var_ssa((op.operands[0], op.operands[1] as usize)),
             }),
+            HLIL_VAR_SSA_PARTIAL => Op::VarSsaPartial(VarSsaPartial {
+                dest: get_var_ssa((op.operands[0], op.operands[1] as usize)),
+                prev: get_var_ssa((op.operands[0], op.operands[2] as usize)),
+            }),
             HLIL_WHILE => Op::While(While {
                 condition: HighLevelExpressionIndex::from(op.operands[0]),
                 body: HighLevelExpressionIndex::from(op.operands[1]),
@@ -977,6 +981,7 @@ impl HighLevelILInstruction {
                 src: self.get_ssa_var_list(2),
             }),
             VarSsa(op) => Lifted::VarSsa(op),
+            VarSsaPartial(op) => Lifted::VarSsaPartial(op),
 
             While(op) => Lifted::While(self.lift_while(op)),
             DoWhile(op) => Lifted::DoWhile(self.lift_while(op)),
@@ -1274,6 +1279,7 @@ pub enum HighLevelILInstructionKind {
     VarInitSsa(VarInitSsa),
     VarPhi(VarPhi),
     VarSsa(VarSsa),
+    VarSsaPartial(VarSsaPartial),
     While(While),
     DoWhile(While),
     WhileSsa(WhileSsa),

rust/src/high_level_il/lift.rs

@@ -169,6 +169,7 @@ pub enum HighLevelILLiftedInstructionKind {
     VarInitSsa(LiftedVarInitSsa),
     VarPhi(LiftedVarPhi),
     VarSsa(VarSsa),
+    VarSsaPartial(VarSsaPartial),
     While(LiftedWhile),
     DoWhile(LiftedWhile),
     WhileSsa(LiftedWhileSsa),
@@ -310,6 +311,7 @@ impl HighLevelILLiftedInstruction {
             VarInitSsa(_) => "VarInitSsa",
             VarPhi(_) => "VarPhi",
             VarSsa(_) => "VarSsa",
+            VarSsaPartial(_) => "VarSsaPartial",
             While(_) => "While",
             DoWhile(_) => "DoWhile",
             WhileSsa(_) => "WhileSsa",
@@ -479,6 +481,10 @@ impl HighLevelILLiftedInstruction {
                 ("src", Operand::VarSsaList(op.src.clone())),
             ],
             VarSsa(op) => vec![("var", Operand::VarSsa(op.var))],
+            VarSsaPartial(op) => vec![
+                ("dest", Operand::VarSsa(op.dest)),
+                ("prev", Operand::VarSsa(op.prev)),
+            ],
             While(op) | DoWhile(op) => vec![
                 ("condition", Operand::Expr(*op.condition.clone())),
                 ("body", Operand::Expr(*op.body.clone())),

rust/src/high_level_il/operation.rs

@@ -532,6 +532,13 @@ pub struct VarSsa {
     pub var: SSAVariable,
 }
 
+// VAR_SSA_PARTIAL
+#[derive(Copy, Clone, Debug, Hash, PartialEq, Eq)]
+pub struct VarSsaPartial {
+    pub dest: SSAVariable,
+    pub prev: SSAVariable,
+}
+
 // WHILE, DO_WHILE
 #[derive(Debug, Copy, Clone)]
 pub struct While {