Add "pass by reference" instruction to mark parameters that are passed by reference according to calling convention

D0ntPanic · D0ntPanic · commit 33b65792294c · 2026-04-13T14:41:12.000-04:00
diff --git a/binaryninjaapi.h b/binaryninjaapi.h
@@ -15752,6 +15752,7 @@ namespace BinaryNinja {
 		    const ILSourceLocation& loc = ILSourceLocation());
 		ExprId AddressOf(const Variable& var, const ILSourceLocation& loc = ILSourceLocation());
 		ExprId AddressOfField(const Variable& var, uint64_t offset, const ILSourceLocation& loc = ILSourceLocation());
+		ExprId PassByRef(size_t size, ExprId src, const ILSourceLocation& loc = ILSourceLocation());
 		ExprId Const(size_t size, uint64_t val, const ILSourceLocation& loc = ILSourceLocation());
 		ExprId ConstPointer(size_t size, uint64_t val, const ILSourceLocation& loc = ILSourceLocation());
 		ExprId ExternPointer(
@@ -16147,6 +16148,7 @@ namespace BinaryNinja {
 		ExprId DerefFieldSSA(size_t size, ExprId src, size_t srcMemVersion, uint64_t offset, size_t memberIndex,
 		    const ILSourceLocation& loc = ILSourceLocation());
 		ExprId AddressOf(ExprId src, const ILSourceLocation& loc = ILSourceLocation());
+		ExprId PassByRef(size_t size, ExprId src, const ILSourceLocation& loc = ILSourceLocation());
 		ExprId Const(size_t size, uint64_t val, const ILSourceLocation& loc = ILSourceLocation());
 		ExprId ConstPointer(size_t size, uint64_t val, const ILSourceLocation& loc = ILSourceLocation());
 		ExprId ExternPointer(
diff --git a/binaryninjacore.h b/binaryninjacore.h
@@ -1362,6 +1362,7 @@ extern "C"
 		MLIL_VAR_SPLIT,      // Not valid in SSA form (see MLIL_VAR_SPLIT_SSA)
 		MLIL_ADDRESS_OF,
 		MLIL_ADDRESS_OF_FIELD,
+		MLIL_PASS_BY_REF,
 		MLIL_CONST,
 		MLIL_CONST_DATA,
 		MLIL_CONST_PTR,
@@ -1564,6 +1565,7 @@ extern "C"
 		HLIL_DEREF,
 		HLIL_DEREF_FIELD,
 		HLIL_ADDRESS_OF,
+		HLIL_PASS_BY_REF,
 		HLIL_CONST,
 		HLIL_CONST_DATA,
 		HLIL_CONST_PTR,
diff --git a/highlevelilinstruction.cpp b/highlevelilinstruction.cpp
@@ -159,6 +159,7 @@ static constexpr std::array s_instructionOperandUsage = {
 	OperandUsage{HLIL_DEREF, {SourceExprHighLevelOperandUsage}},
 	OperandUsage{HLIL_DEREF_FIELD, {SourceExprHighLevelOperandUsage, OffsetHighLevelOperandUsage, MemberIndexHighLevelOperandUsage}},
 	OperandUsage{HLIL_ADDRESS_OF, {SourceExprHighLevelOperandUsage}},
+	OperandUsage{HLIL_PASS_BY_REF, {SourceExprHighLevelOperandUsage}},
 	OperandUsage{HLIL_CONST, {ConstantHighLevelOperandUsage}},
 	OperandUsage{HLIL_CONST_DATA, {ConstantDataHighLevelOperandUsage}},
 	OperandUsage{HLIL_CONST_PTR, {ConstantHighLevelOperandUsage}},
@@ -1265,6 +1266,7 @@ void HighLevelILInstruction::CollectSubExprs(stack<size_t>& toProcess) const
 	case HLIL_FLOOR:
 	case HLIL_CEIL:
 	case HLIL_FTRUNC:
+	case HLIL_PASS_BY_REF:
 		toProcess.push(AsOneOperand().GetSourceExpr().exprIndex);
 		break;
 	case HLIL_ADD:
@@ -1571,6 +1573,7 @@ ExprId HighLevelILInstruction::CopyTo(
 	case HLIL_FLOOR:
 	case HLIL_CEIL:
 	case HLIL_FTRUNC:
+	case HLIL_PASS_BY_REF:
 		return dest->AddExprWithLocation(operation, loc, size, subExprHandler(AsOneOperand().GetSourceExpr()));
 	case HLIL_ADD:
 	case HLIL_SUB:
@@ -2129,6 +2132,7 @@ bool HighLevelILInstruction::operator<(const HighLevelILInstruction& other) cons
 	case HLIL_FLOOR:
 	case HLIL_CEIL:
 	case HLIL_FTRUNC:
+	case HLIL_PASS_BY_REF:
 		if (size < other.size)
 			return true;
 		if (size > other.size)
@@ -2841,6 +2845,12 @@ ExprId HighLevelILFunction::AddressOf(ExprId src, const ILSourceLocation& loc)
 }
 
 
+ExprId HighLevelILFunction::PassByRef(size_t size, ExprId src, const ILSourceLocation& loc)
+{
+	return AddExprWithLocation(HLIL_PASS_BY_REF, loc, size, src);
+}
+
+
 ExprId HighLevelILFunction::Const(size_t size, uint64_t val, const ILSourceLocation& loc)
 {
 	return AddExprWithLocation(HLIL_CONST, loc, size, val);
diff --git a/highlevelilinstruction.h b/highlevelilinstruction.h
@@ -1497,6 +1497,9 @@ namespace BinaryNinja
 	template <>
 	struct HighLevelILInstructionAccessor<HLIL_FTRUNC> : public HighLevelILOneOperandInstruction
 	{};
+	template <>
+	struct HighLevelILInstructionAccessor<HLIL_PASS_BY_REF> : public HighLevelILOneOperandInstruction
+	{};
 
 #undef _STD_VECTOR
 #undef _STD_SET
diff --git a/lang/c/pseudoc.cpp b/lang/c/pseudoc.cpp
@@ -1816,6 +1816,23 @@ void PseudoCFunction::GetExprTextInternal(const HighLevelILInstruction& instr, H
 		}();
 		break;
 
+	case HLIL_PASS_BY_REF:
+		[&]() {
+			const auto srcExpr = instr.GetSourceExpr<HLIL_PASS_BY_REF>();
+			if (srcExpr.operation == HLIL_ADDRESS_OF)
+			{
+				GetExprTextInternal(srcExpr.GetSourceExpr<HLIL_ADDRESS_OF>(), tokens, settings, precedence);
+			}
+			else
+			{
+				tokens.Append(OperationToken, "*");
+				GetExprTextInternal(srcExpr, tokens, settings, UnaryOperatorPrecedence);
+			}
+			if (statement)
+				tokens.AppendSemicolon();
+		}();
+		break;
+
 	case HLIL_FCMP_E:
 		[&]() {
 			bool parens = precedence > EqualityOperatorPrecedence;
diff --git a/lang/rust/pseudorust.cpp b/lang/rust/pseudorust.cpp
@@ -1900,6 +1900,15 @@ void PseudoRustFunction::GetExprText(const HighLevelILInstruction& instr, HighLe
 		}();
 		break;
 
+	case HLIL_PASS_BY_REF:
+		[&]() {
+			const auto srcExpr = instr.GetSourceExpr<HLIL_PASS_BY_REF>();
+			GetExprText(srcExpr, tokens, settings, UnaryOperatorPrecedence);
+			if (exprType != InnerExpression)
+				tokens.AppendSemicolon();
+		}();
+		break;
+
 	case HLIL_FCMP_E:
 	case HLIL_CMP_E:
 		[&]() {
diff --git a/mediumlevelilinstruction.cpp b/mediumlevelilinstruction.cpp
@@ -167,6 +167,7 @@ static constexpr std::array s_instructionOperandUsage = {
 	OperandUsage{MLIL_VAR_SPLIT, {HighVariableMediumLevelOperandUsage, LowVariableMediumLevelOperandUsage}},
 	OperandUsage{MLIL_ADDRESS_OF, {SourceVariableMediumLevelOperandUsage}},
 	OperandUsage{MLIL_ADDRESS_OF_FIELD, {SourceVariableMediumLevelOperandUsage, OffsetMediumLevelOperandUsage}},
+	OperandUsage{MLIL_PASS_BY_REF, {SourceExprMediumLevelOperandUsage}},
 	OperandUsage{MLIL_CONST, {ConstantMediumLevelOperandUsage}},
 	OperandUsage{MLIL_CONST_DATA, {ConstantDataMediumLevelOperandUsage}},
 	OperandUsage{MLIL_CONST_PTR, {ConstantMediumLevelOperandUsage}},
@@ -1487,6 +1488,7 @@ void MediumLevelILInstruction::VisitExprs(bn::base::function_ref<bool(const Medi
 	case MLIL_FLOOR:
 	case MLIL_CEIL:
 	case MLIL_FTRUNC:
+	case MLIL_PASS_BY_REF:
 		AsOneOperand().GetSourceExpr().VisitExprs(func);
 		break;
 	case MLIL_ADD:
@@ -1774,6 +1776,7 @@ ExprId MediumLevelILInstruction::CopyTo(MediumLevelILFunction* dest,
 	case MLIL_FLOOR:
 	case MLIL_CEIL:
 	case MLIL_FTRUNC:
+	case MLIL_PASS_BY_REF:
 		return dest->AddExprWithLocation(operation, loc, size, subExprHandler(AsOneOperand().GetSourceExpr()));
 	case MLIL_ADD:
 	case MLIL_SUB:
@@ -2433,6 +2436,12 @@ ExprId MediumLevelILFunction::AddressOfField(const Variable& var, uint64_t offse
 }
 
 
+ExprId MediumLevelILFunction::PassByRef(size_t size, ExprId src, const ILSourceLocation& loc)
+{
+	return AddExprWithLocation(MLIL_PASS_BY_REF, loc, size, src);
+}
+
+
 ExprId MediumLevelILFunction::Const(size_t size, uint64_t val, const ILSourceLocation& loc)
 {
 	return AddExprWithLocation(MLIL_CONST, loc, size, val);
diff --git a/mediumlevelilinstruction.h b/mediumlevelilinstruction.h
@@ -1804,6 +1804,9 @@ namespace BinaryNinja
 	template <>
 	struct MediumLevelILInstructionAccessor<MLIL_FTRUNC> : public MediumLevelILOneOperandInstruction
 	{};
+	template <>
+	struct MediumLevelILInstructionAccessor<MLIL_PASS_BY_REF> : public MediumLevelILOneOperandInstruction
+	{};
 
 #undef _STD_VECTOR
 #undef _STD_SET
diff --git a/python/highlevelil.py b/python/highlevelil.py
@@ -210,7 +210,9 @@ class HighLevelILInstruction(BaseILInstruction):
 	    ], HighLevelILOperation.HLIL_DEREF_FIELD_SSA: [
 	        ("src", "expr"), ("src_memory", "int"), ("offset", "int"),
 	        ("member_index", "member_index")
-	    ], HighLevelILOperation.HLIL_ADDRESS_OF: [("src", "expr")], HighLevelILOperation.HLIL_CONST: [
+	    ], HighLevelILOperation.HLIL_ADDRESS_OF: [("src", "expr")], HighLevelILOperation.HLIL_PASS_BY_REF: [
+	        ("src", "expr")
+	    ], HighLevelILOperation.HLIL_CONST: [
 	        ("constant", "int")
 	    ], HighLevelILOperation.HLIL_CONST_PTR: [("constant", "int")], HighLevelILOperation.HLIL_EXTERN_PTR: [
 	        ("constant", "int"), ("offset", "int")
@@ -1743,6 +1745,11 @@ def vars_address_taken(self) -> VariablesList:
 		return [*self.src.vars_address_taken]
 
 
+@dataclass(frozen=True, repr=False, eq=False)
+class HighLevelILPassByRef(HighLevelILUnaryBase):
+	pass
+
+
 @dataclass(frozen=True, repr=False, eq=False)
 class HighLevelILConst(HighLevelILInstruction, Constant):
 	@property
@@ -2429,6 +2436,7 @@ def src(self) -> 'mediumlevelil.SSAVariable':
     HighLevelILOperation.HLIL_DEREF_FIELD_SSA:
         HighLevelILDerefFieldSsa,  #  ("src", "expr"), ("src_memory", "int"), ("offset", "int"), ("member_index", "member_index"),
     HighLevelILOperation.HLIL_ADDRESS_OF: HighLevelILAddressOf,  #  ("src", "expr"),
+	HighLevelILOperation.HLIL_PASS_BY_REF: HighLevelILPassByRef,  #  ("src", "expr"),
     HighLevelILOperation.HLIL_CONST: HighLevelILConst,  #  ("constant", "int"),
     HighLevelILOperation.HLIL_CONST_PTR: HighLevelILConstPtr,  #  ("constant", "int"),
     HighLevelILOperation.HLIL_EXTERN_PTR: HighLevelILExternPtr,  #  ("constant", "int"), ("offset", "int"),
@@ -3380,6 +3388,18 @@ def address_of(self, src: ExpressionIndex, loc: Optional['ILSourceLocation'] = N
 		"""
 		return self.expr(HighLevelILOperation.HLIL_ADDRESS_OF, src, size=0, source_location=loc)
 
+	def pass_by_ref(self, size: int, src: ExpressionIndex, loc: Optional['ILSourceLocation'] = None) -> ExpressionIndex:
+		"""
+		``pass_by_ref`` indicates that ``value`` is being passed by reference to a call with a pointer size of  ``size``
+
+		:param int size: the size of the pointer in bytes
+		:param ExpressionIndex src: the expression containing the reference being passed
+		:param ILSourceLocation loc: location of returned expression
+		:return: The expression ``ref *src``
+		:rtype: ExpressionIndex
+		"""
+		return self.expr(HighLevelILOperation.HLIL_PASS_BY_REF, src, size, source_location=loc)
+
 	def const(self, size: int, value: int, loc: Optional['ILSourceLocation'] = None) -> ExpressionIndex:
 		"""
 		``const`` returns an expression for the constant integer ``value`` of size ``size``
diff --git a/python/mediumlevelil.py b/python/mediumlevelil.py
@@ -218,7 +218,9 @@ class MediumLevelILInstruction(BaseILInstruction):
 	    MediumLevelILOperation.MLIL_VAR: [("src", "var")], MediumLevelILOperation.MLIL_VAR_FIELD: [
 	        ("src", "var"), ("offset", "int")
 	    ], MediumLevelILOperation.MLIL_VAR_SPLIT: [("high", "var"), ("low", "var")],
-	    MediumLevelILOperation.MLIL_ADDRESS_OF: [("src", "var")], MediumLevelILOperation.MLIL_ADDRESS_OF_FIELD: [
+	    MediumLevelILOperation.MLIL_ADDRESS_OF: [("src", "var")], MediumLevelILOperation.MLIL_PASS_BY_REF: [
+	        ("src", "expr")
+	    ], MediumLevelILOperation.MLIL_ADDRESS_OF_FIELD: [
 	        ("src", "var"), ("offset", "int")
 	    ], MediumLevelILOperation.MLIL_CONST: [("constant", "int")], MediumLevelILOperation.MLIL_CONST_PTR: [
 	        ("constant", "int")
@@ -1310,6 +1312,11 @@ def vars_address_taken(self) -> List[variable.Variable]:
 		return [self.src]
 
 
+@dataclass(frozen=True, repr=False, eq=False)
+class MediumLevelILPassByRef(MediumLevelILUnaryBase):
+	pass
+
+
 @dataclass(frozen=True, repr=False, eq=False)
 class MediumLevelILConst(MediumLevelILConstBase):
 	@property
@@ -3118,6 +3125,7 @@ def detailed_operands(self) -> List[Tuple[str, MediumLevelILOperandType, str]]:
     MediumLevelILOperation.MLIL_LOAD: MediumLevelILLoad,  # [("src", "expr")],
     MediumLevelILOperation.MLIL_VAR: MediumLevelILVar,  # [("src", "var")],
     MediumLevelILOperation.MLIL_ADDRESS_OF: MediumLevelILAddressOf,  # [("src", "var")],
+    MediumLevelILOperation.MLIL_PASS_BY_REF: MediumLevelILPassByRef,  # [("src", "expr")],
     MediumLevelILOperation.MLIL_CONST: MediumLevelILConst,  # [("constant", "int")],
     MediumLevelILOperation.MLIL_CONST_PTR: MediumLevelILConstPtr,  # [("constant", "int")],
     MediumLevelILOperation.MLIL_FLOAT_CONST: MediumLevelILFloatConst,  # [("constant", "float")],
@@ -3740,6 +3748,9 @@ def do_copy(
 			if expr.operation == MediumLevelILOperation.MLIL_ADDRESS_OF:
 				expr: MediumLevelILAddressOf
 				return dest.address_of(expr.src, loc)
+			if expr.operation == MediumLevelILOperation.MLIL_PASS_BY_REF:
+				expr: MediumLevelILPassByRef
+				return dest.pass_by_ref(expr.size, expr.src, loc)
 			if expr.operation == MediumLevelILOperation.MLIL_ADDRESS_OF_FIELD:
 				expr: MediumLevelILAddressOfField
 				return dest.address_of_field(expr.src, expr.offset, loc)
@@ -4367,6 +4378,18 @@ def address_of(self, var: 'variable.Variable', loc: Optional['ILSourceLocation']
 		"""
 		return self.expr(MediumLevelILOperation.MLIL_ADDRESS_OF, var.identifier, size=0, source_location=loc)
 
+	def pass_by_ref(self, size: int, value: ExpressionIndex, loc: Optional['ILSourceLocation'] = None) -> ExpressionIndex:
+		"""
+		``pass_by_ref`` indicates that ``value`` is being passed by reference to a call with a pointer size of  ``size``
+
+		:param int size: the size of the pointer in bytes
+		:param ExpressionIndex value: the expression containing the reference being passed
+		:param ILSourceLocation loc: location of returned expression
+		:return: The expression ``ref *value``
+		:rtype: ExpressionIndex
+		"""
+		return self.expr(MediumLevelILOperation.MLIL_PASS_BY_REF, value, size=size, source_location=loc)
+
 	def address_of_field(self, var: 'variable.Variable', offset: int, loc: Optional['ILSourceLocation'] = None) -> ExpressionIndex:
 		"""
 		``address_of_field`` takes the address of ``var`` at the offset ``offset``
diff --git a/rust/src/high_level_il/instruction.rs b/rust/src/high_level_il/instruction.rs
@@ -400,6 +400,9 @@ impl HighLevelILInstruction {
             HLIL_ADDRESS_OF => Op::AddressOf(UnaryOp {
                 src: HighLevelExpressionIndex::from(op.operands[0]),
             }),
+            HLIL_PASS_BY_REF => Op::PassByRef(UnaryOp {
+                src: HighLevelExpressionIndex::from(op.operands[0]),
+            }),
             HLIL_NEG => Op::Neg(UnaryOp {
                 src: HighLevelExpressionIndex::from(op.operands[0]),
             }),
@@ -784,6 +787,7 @@ impl HighLevelILInstruction {
 
             Deref(op) => Lifted::Deref(self.lift_unary_op(op)),
             AddressOf(op) => Lifted::AddressOf(self.lift_unary_op(op)),
+            PassByRef(op) => Lifted::PassByRef(self.lift_unary_op(op)),
             Neg(op) => Lifted::Neg(self.lift_unary_op(op)),
             Not(op) => Lifted::Not(self.lift_unary_op(op)),
             Sx(op) => Lifted::Sx(self.lift_unary_op(op)),
@@ -1161,6 +1165,7 @@ pub enum HighLevelILInstructionKind {
     ConstData(ConstData),
     Deref(UnaryOp),
     AddressOf(UnaryOp),
+    PassByRef(UnaryOp),
     Neg(UnaryOp),
     Not(UnaryOp),
     Sx(UnaryOp),
diff --git a/rust/src/high_level_il/lift.rs b/rust/src/high_level_il/lift.rs
@@ -112,6 +112,7 @@ pub enum HighLevelILLiftedInstructionKind {
     ConstData(LiftedConstData),
     Deref(LiftedUnaryOp),
     AddressOf(LiftedUnaryOp),
+    PassByRef(LiftedUnaryOp),
     Neg(LiftedUnaryOp),
     Not(LiftedUnaryOp),
     Sx(LiftedUnaryOp),
@@ -240,6 +241,7 @@ impl HighLevelILLiftedInstruction {
             ConstData(_) => "ConstData",
             Deref(_) => "Deref",
             AddressOf(_) => "AddressOf",
+            PassByRef(_) => "PassByRef",
             Neg(_) => "Neg",
             Not(_) => "Not",
             Sx(_) => "Sx",
@@ -360,10 +362,10 @@ impl HighLevelILLiftedInstruction {
                 "constant_data",
                 Operand::ConstantData(op.constant_data.clone()),
             )],
-            Deref(op) | AddressOf(op) | Neg(op) | Not(op) | Sx(op) | Zx(op) | LowPart(op)
-            | BoolToInt(op) | UnimplMem(op) | Fsqrt(op) | Fneg(op) | Fabs(op) | FloatToInt(op)
-            | IntToFloat(op) | FloatConv(op) | RoundToInt(op) | Floor(op) | Ceil(op)
-            | Ftrunc(op) => vec![("src", Operand::Expr(*op.src.clone()))],
+            Deref(op) | AddressOf(op) | PassByRef(op) | Neg(op) | Not(op) | Sx(op) | Zx(op)
+            | LowPart(op) | BoolToInt(op) | UnimplMem(op) | Fsqrt(op) | Fneg(op) | Fabs(op)
+            | FloatToInt(op) | IntToFloat(op) | FloatConv(op) | RoundToInt(op) | Floor(op)
+            | Ceil(op) | Ftrunc(op) => vec![("src", Operand::Expr(*op.src.clone()))],
             DerefFieldSsa(op) => vec![
                 ("src", Operand::Expr(*op.src.clone())),
                 ("src_memory", Operand::Int(op.src_memory)),
diff --git a/rust/src/medium_level_il/instruction.rs b/rust/src/medium_level_il/instruction.rs
@@ -655,6 +655,9 @@ impl MediumLevelILInstruction {
             MLIL_ADDRESS_OF => Op::AddressOf(Var {
                 src: get_var(op.operands[0]),
             }),
+            MLIL_PASS_BY_REF => Op::PassByRef(UnaryOp {
+                src: MediumLevelExpressionIndex::from(op.operands[0] as usize),
+            }),
             MLIL_VAR_FIELD => Op::VarField(Field {
                 src: get_var(op.operands[0]),
                 offset: op.operands[1],
@@ -1110,6 +1113,7 @@ impl MediumLevelILInstruction {
             }),
             Var(op) => Lifted::Var(op),
             AddressOf(op) => Lifted::AddressOf(op),
+            PassByRef(op) => Lifted::PassByRef(self.lift_unary_op(op)),
             VarField(op) => Lifted::VarField(op),
             AddressOfField(op) => Lifted::AddressOfField(op),
             VarSsa(op) => Lifted::VarSsa(op),
@@ -1830,6 +1834,7 @@ pub enum MediumLevelILInstructionKind {
     Ret(Ret),
     Var(Var),
     AddressOf(Var),
+    PassByRef(UnaryOp),
     VarField(Field),
     AddressOfField(Field),
     VarSsa(VarSsa),
diff --git a/rust/src/medium_level_il/lift.rs b/rust/src/medium_level_il/lift.rs
@@ -176,6 +176,7 @@ pub enum MediumLevelILLiftedInstructionKind {
     Ret(LiftedRet),
     Var(Var),
     AddressOf(Var),
+    PassByRef(LiftedUnaryOp),
     VarField(Field),
     AddressOfField(Field),
     VarSsa(VarSsa),
@@ -323,6 +324,7 @@ impl MediumLevelILLiftedInstruction {
             Ret(_) => "Ret",
             Var(_) => "Var",
             AddressOf(_) => "AddressOf",
+            PassByRef(_) => "PassByRef",
             VarField(_) => "VarField",
             AddressOfField(_) => "AddressOfField",
             VarSsa(_) => "VarSsa",
@@ -546,6 +548,7 @@ impl MediumLevelILLiftedInstruction {
             SeparateParamList(op) => vec![("params", Operand::ExprList(op.params.clone()))],
             SharedParamSlot(op) => vec![("params", Operand::ExprList(op.params.clone()))],
             Var(op) | AddressOf(op) => vec![("src", Operand::Var(op.src))],
+            PassByRef(op) => vec![("src", Operand::Expr(*op.src.clone()))],
             VarField(op) | AddressOfField(op) => vec![
                 ("src", Operand::Var(op.src)),
                 ("offset", Operand::Int(op.offset)),
