feat: MLIL DetailedOperands/Operands/Traverse + shared IL operand types - #42
Merged
Conversation
… types (#42) Mirror Python MediumLevelILInstruction.detailed_operands / operands / traverse (mediumlevelil.py) by driving them from a static descriptor table, the same pattern already used for HighLevelIL. Shared types (IL/): extract ILOperand, ILOperandKind, ILOperandDescriptor out of the HLIL-specific copies so both ILs share one source of truth. ILOperandDescriptor gains a SecondaryRawIndex for the MLIL "aliased" dest/prev operands, where prev shares the variable slot with dest but reads a different version slot (e.g. SET_VAR_ALIASED is var@0, dest-version@1, prev-version@2). HLIL is refactored onto the shared types; its DetailedOperands reader now takes a descriptor and threads the secondary index through the SSAVariable / ConstantData cases. MLIL table (MediumLevelIL/MediumLevelILDetailedOperandsTable.cs): 140 rows generated from the official Python overrides by reading each property's actual _get_*(N) raw index (not accumulated slot widths -- the core's advance=0 rule desynchronises accumulation for sub-instruction-derived operands). Empirically cross-checked against the live core (5.3.9757): detailed_operands succeeds with zero exceptions across cat/ls/true, and the operand indices match. Fixes that surfaced: - OperationOperands counts were too low for five ops whose copied RawOperands array was shorter than the descriptors read, which would have thrown IndexOutOfRange: MLIL_CALL_UNTYPED 3->4, MLIL_RET_HINT 0->1, MLIL_STORE_STRUCT_SSA 4->5, MLIL_SYSCALL_UNTYPED 2->3, MLIL_TAILCALL_UNTYPED 2->4. - GetOperandAsIntegerArray passed the slot VALUE to BNMediumLevelILGetOperandList instead of the operand index, returning a garbage list; now mirrors GetOperandAsIntegerMap. KNOWN PARITY GAP (documented in the table header): the call/syscall/intrinsic family lists an output/params/output_dest_memory operand whose value is reached by unwrapping a CallOutput/CallParam sub-instruction expression (BNMediumLevelILGetOperandList does not flatten across the parent->sub boundary). Those derived operands are omitted; the flat-readable operands are included. Sub-instruction navigation to close the gap is tracked as a follow-up. VERSION NOTE: the C# MediumLevelILOperation enum was generated against a newer binaryninja-api than the installed core (5.3.9757 / aa25bfc). The table matches the installed core (140 ops). 11 enum members the core never emits have no row (empty DetailedOperands); the one rename (installed MLIL_CALL_OUTPUT == C# MLIL_VAR_OUTPUT) is handled in the generator. E2E + consistency tests live in the separate sharp-binaryninja-tests harness.
tinysec
added a commit
that referenced
this pull request
Jul 21, 2026
The C# MediumLevelILOperation enum was generated against a newer binaryninja-api (dev branch) and carried 21 extra members the installed core (5.3.9757 / python api revision aa25bfc) never emits. This shifted every value from index ~15 onward by +2/+4/+8 and broke sub-instruction dispatch -- GetOperandAsExpression returned the wrong typed wrapper (e.g. MLILSysCallUntypedSSA for a native MLIL_CALL_OUTPUT_SSA), so the cast in the new derived-operand readers threw InvalidCastException. This PR realigns the enum to the installed core's 140-member ordering byte-for-byte and closes the PR #42 derived-operand parity gap: * Enumeration/BNMediumLevelILOperation.cs -- rewritten to match the installed core (MLIL_CALL_OUTPUT at index 56, MLIL_CALL_SSA at 122, etc.); MLIL_VAR_OUTPUT is now MLIL_CALL_OUTPUT, and the ABS/BSWAP/CLS/CLZ/CTZ/POPCNT/RBIT/MAXS/MAXU/MINS/MINU members the installed core never emits are gone. * IL/ILOperandKind.cs -- 8 new sub-instruction-derived kinds (CallOutputVariables, CallParamExpressions, CallOutputSsaVariables, CallOutputSsaMemory, CallParamSsaExpressions, CallParamSsaMemory, MemoryIntrinsicOutputSsaVariables, MemoryIntrinsicOutputSsaMemory). Each fetches the sub-instruction at RawIndex via GetOperandAsExpression and reads one of its existing properties. * Struct/BNMediumLevelILInstruction.cs -- 8 new dispatch cases in ReadDetailedOperandByKind; FromExpressionIndex / count-table cleaned of dead ABS/BSWAP/etc. entries and renamed MLIL_VAR_OUTPUT to MLIL_CALL_OUTPUT. * MediumLevelIL/MediumLevelILDetailedOperandsTable.cs -- 10 table rows updated for the call/syscall/intrinsic/tailcall family so output/params/output_dest_memory/params_src_memory are now served instead of omitted. * MediumLevelIL/MLILTailCallUntyped.cs -- .Output and .Parameters now navigate the CallOutput / CallParam sub-instructions. * Handle/BNMediumLevelILFunction.cs -- EmitCallOutput uses MLIL_CALL_OUTPUT. All 88 E2E tests pass.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
MediumLevelILInstruction.DetailedOperands/Operands/Traverse, mirroring Pythonmediumlevelil.py, driven by a static descriptor table — the same pattern already used for HighLevelIL. Extracts the sharedILOperand/ILOperandKind/ILOperandDescriptortypes so both ILs share one source of truth.Changes
IL/shared types —ILOperand,ILOperandKind,ILOperandDescriptorextracted from the HLIL-specific copies.ILOperandDescriptorgainsSecondaryRawIndexfor the MLIL aliased dest/prev operands (e.g.SET_VAR_ALIASED= var@0, dest-version@1, prev-version@2 —prevshares the var slot withdestbut reads version@2).SSAVariable/ConstantDatacases.MediumLevelIL/MediumLevelILDetailedOperandsTable.cs— 140 rows generated from the official Python overrides by reading each property's actual_get_*(N)raw index (not accumulated slot widths — the core'sadvance=0rule desyncs accumulation for sub-instruction-derived operands). Cross-checked against the live core (5.3.9757).Struct/BNMediumLevelILInstruction.cs—DetailedOperands/Operands/Traverse+GetOperandAsIntegerreader.Fixes that surfaced
OperationOperandscounts too low for five ops whose copiedRawOperandsarray was shorter than the descriptors read →IndexOutOfRange:MLIL_CALL_UNTYPED3→4,MLIL_RET_HINT0→1,MLIL_STORE_STRUCT_SSA4→5,MLIL_SYSCALL_UNTYPED2→3,MLIL_TAILCALL_UNTYPED2→4.GetOperandAsIntegerArraypassed the slot value toBNMediumLevelILGetOperandListinstead of the operand index → garbage list; now mirrorsGetOperandAsIntegerMap.Known parity gap (documented)
The call/syscall/intrinsic family lists an
output/params/output_dest_memoryoperand reached by unwrapping aCallOutput/CallParamsub-instruction;BNMediumLevelILGetOperandListdoes not flatten across that boundary, so those derived operands are omitted (flat-readable operands included). Sub-instruction navigation to close the gap is a tracked follow-up.Version note
The C#
MediumLevelILOperationenum was generated against a newerbinaryninja-apithan the installed core (5.3.9757 /aa25bfc). The table matches the installed core (140 ops); 11 enum members the core never emits have no row (emptyDetailedOperands); the one rename (installedMLIL_CALL_OUTPUT== C#MLIL_VAR_OUTPUT) is handled in the generator.Tests
E2E + reflection-consistency tests live in the separate
sharp-binaryninja-testsharness (kept out of this repo per project convention). All 85 tests pass, including 9 new MLIL DetailedOperands tests.