Busybox PowerPC `unimplemented` instruction: mfcr

[XVilka]

Binary Ninja Version: 2.4.2898-dev Personal, 1e7cedd7
Platform: Fedora 34 (Workstation Edition)

10002c4c  int32_t sub_10002c4c(int32_t arg1, int32_t arg2, int32_t arg3, uint32_t arg4)

void var_1028  {Frame offset -1028}
int32_t var_24  {Frame offset -24}
int32_t arg1  {Register r3}
char const* const r3_2  {Register r3}
int32_t arg2  {Register r4}
void* r4  {Register r4}
void* r4_1  {Register r4}
int32_t arg3  {Register r5}
uint32_t arg4  {Register r6}

       10002c4c  sub_10002c4c:
   0 @ 10002c50  r12 = unimplemented
   1 @ 10002c5c  r24 = arg1
   2 @ 10002c5c  lt = r24 s< 0
   3 @ 10002c60  var_24 = r12
   4 @ 10002c64  r26 = arg2
   5 @ 10002c6c  r31 = arg4
   6 @ 10002c70  r30 = arg3
   7 @ 10002c74  r27 = 0xffffffff
   8 @ 10002c78  r28 = 0xffffffff

Or in a decompiler view:

10002c4c  int32_t sub_10002c4c(int32_t arg1, int32_t arg2, int32_t arg3, uint32_t arg4)

10002c50      int32_t r12 = unimplemented  {mfcr r12}
10002c5c      bool lt = arg1 s< 0
10002c60      int32_t var_24 = r12
10002c6c      uint32_t r31 = arg4
10002c70      int32_t r30 = arg3
10002c74      int32_t r27 = 0xffffffff
10002c7c      if (not(lt))

Or disasm output:

10002c4c  int32_t sub_10002c4c(int32_t arg1, int32_t arg2, int32_t arg3, uint32_t arg4)

int32_t var_1030  {Frame offset -1030}
void var_1028  {Frame offset -1028}
int32_t var_24  {Frame offset -24}
int32_t __saved_r24  {Frame offset -20}
int32_t __saved_r25  {Frame offset -1c}
int32_t __saved_r26  {Frame offset -18}
int32_t __saved_r27  {Frame offset -14}
int32_t __saved_r28  {Frame offset -10}
int32_t __saved_r29  {Frame offset -c}
int32_t __saved_r30  {Frame offset -8}
int32_t __saved_r31  {Frame offset -4}
void arg_0  {Frame offset 0}
int32_t arg_4  {Frame offset 4}

10002c4c  sub_10002c4c:
10002c4c  9421efd0   stwu    r1, -4144(r1) {var_1030} {arg_0}
10002c50  7d800026   mfcr    r12
10002c54  7c0802a6   mflr    r0
10002c58  bf011010   stmw    r24, 4112(r1) {__saved_r24} {__saved_r25} {__saved_r26} {__saved_r27} {__saved_r28} {__saved_r29} {__saved_r30} {__saved_r31}
10002c5c  7c781b79   or.     r24, r3, r3
10002c60  9181100c   stw     r12, 4108(r1) {var_24}
10002c64  7c9a2378   mr      r26, r4
10002c68  90011034   stw     r0, 4148(r1) {arg_4}
10002c6c  7cdf3378   mr      r31, r6
10002c70  7cbe2b78   mr      r30, r5
10002c74  3b60ffff   li      r27, -0x1  {0xffffffff}
10002c78  3b80ffff   li      r28, -0x1  {0xffffffff}
10002c7c  418000d0   blt     0x10002d4c

Binary is one of the Rizin's tests - busybox-powerpc: https://github.com/rizinorg/rizin-testbins/blob/master/elf/busybox-powerpc

[psifertex]

Thanks for the report. As a heads up, I'm migrating this issue to the power PC architecture module. As we've open sourced the architectures they each have their own repo now for bugs specific to them.