Add the framework for BNIL emulator and implement LLIL emulator - #8314

Open

xusheng6 wants to merge 51 commits into

devfrom

Commits on Jul 29, 2026

Add the BNIL (LLIL) emulator plugin

xusheng6
and
claude
committed
8bc02c3
Add coverage for newly added IL instructions
xusheng6
committed
ff7af30
[emulator] Remove stray blank line in binaryninjacore.h

xusheng6
and
claude
committed
e146066
[emulator] Remove stray blank line before namespace close in binaryninjaapi.h

xusheng6
and
claude
committed
865d5e0
[emulator] Move intx include out of binaryninjaapi.h into emulator headers

xusheng6
and
claude
committed
66cb585
[emulator] Fix signed IL ops for operands wider than 8 bytes and INT_MIN/-1

xusheng6
and
claude
committed
afa7423
[emulator] Fix LLIL_ADD_OVERFLOW to compute signed overflow, not unsigned carry

xusheng6
and
claude
committed
0c92c7d
[emulator] Fix RLC/RRC rotate-through-carry semantics

xusheng6
and
claude
committed
7beb8b1
[emulator] Mask arithmetic operands consistently up front

xusheng6
and
claude
committed
cd94031
[emulator] Fix carry/borrow flag for ADC/SBB at the operand-size boundary

xusheng6
and
claude
committed
b06ba46
[emulator] Fix double-precision divide/modulo operand widths and signedness

xusheng6
and
claude
committed
277f674
[emulator] Fix cross-segment memory read/write boundary computation

xusheng6
and
claude
committed
ad6ec7c
[emulator] Reject overlapping memory maps

xusheng6
and
claude
committed
c0797a8
[emulator] Bound intrinsic-hook output writes to the buffer capacity

xusheng6
and
claude
committed
a88486a
[emulator] Start EmuRefCountObject at a reference count of 1

xusheng6
and
claude
committed
cf6b0eb
[emulator] Don't let map allocation failures cross the C ABI boundary

xusheng6
and
claude
committed
849b897
[emulator] Stop after a call stub/hook requests a stop

xusheng6
and
claude
committed
7c76770
[emulator] Mask memory-read-hook value to the buffer width in Python

xusheng6
and
claude
committed
c2873a2
[emulator] Move the public C++ API out of the BinaryNinja namespace

xusheng6
and
claude
committed
59868ac
[emulator] Return a reference, not a raw pointer, from LLILEmulator::GetView

xusheng6
and
claude
committed
eacb774
[emulator] Require a valid architecture as an emulator invariant

xusheng6
and
claude
committed
292a1ff
[emulator] Place call arguments using the emulated function's calling convention

xusheng6
and
claude
committed
4c3f160
[emulator] Drop false claim that tests run in the main suite

xusheng6
and
claude
committed
9c79ea1
[emulator] Fix docs stdout example and Python-bindings cmake fallback path

xusheng6
and
claude
committed
58cda36
[emulator] Type the stdin callback buffer as void* for a writable binding

xusheng6
and
claude
committed
414baec
[emulator] Use typed LLIL operand accessors instead of GetRawOperandAs*

xusheng6
and
claude
committed
18c8b6a
[emulator] Add tests for flags, shifts/rotates, extension, and division/memory edges

xusheng6
and
claude
committed
1c4d4fb
[emulator] Don't re-mask shift counts; execute the IL shift literally

xusheng6
and
claude
committed
c364188
[emulator] Include the vendored intx directly, drop the wrapper header

xusheng6
and
claude
committed
8775bd4
emulator: warn when emulating a non-default architecture

xusheng6
and
claude
committed
47392a8
emulator: honor non-default argument locations in SetArgument

xusheng6
and
claude
committed
efd142b
emulator: move wide-integer helpers to the ILEmulator base class

xusheng6
and
claude
committed
7c64bf2
emulator: store flags as bool

xusheng6
and
claude
committed
c5aff49
emulator: use return consistently in the LLIL call handlers

xusheng6
and
claude
committed
9e81c2c
emulator: read arguments/return values via the function calling convention

xusheng6
and
claude
committed
5525a11
emulator: drop redundant string wrap around GetShortName

xusheng6
and
claude
committed
65b488d
emulator: return std::optional from ResolveCallTargetName

xusheng6
and
claude
committed
239a227
emulator: add a per-instruction LLIL test suite

xusheng6
and
claude
committed
dd841f5
[emulator] Fix null-architecture crash when emulating a standalone IL function

xusheng6
and
claude
committed
df8003c
[emulator] Fix MULU_DP/MULS_DP operand and product widths

xusheng6
and
claude
committed
44c0a9a
[emulator] Fix TEST_BIT to select a bit by index, not mask

xusheng6
and
claude
committed
6f3373c
[emulator] Resolve JUMP_TO through the instruction's own target map

xusheng6
and
claude
committed
3068a19
[emulator] Fix test cases that asserted on IL the API cannot express

xusheng6
and
claude
committed
89be9f4
[emulator] Add known-answer tests that emulate compiled base64 and MD5

xusheng6
and
claude
committed
29b9972

Commits on Aug 3, 2026

[emulator] Mask size-0 (unsized boolean) values with 1 instead of squashing them to 0

xusheng6
and
claude
committed
40a81ff
[emulator] REG_SPLIT/SET_REG_SPLIT: size is the width of each half, not the pair

xusheng6
and
claude
committed
21675de
[emulator] FLAG_BIT places the flag at the bit index instead of always reading bit 0

xusheng6
and
claude
committed
28b92d2
Fix the flag_bit / FlagBit API docs to describe what the operation does

xusheng6
and
claude
committed
8c0efd3
[emulator] Distinguish CarryFlagWithInvertedSubtractRole when evaluating flag conditions

xusheng6
and
claude
committed
679a9a0

Commits on Aug 4, 2026

[emulator] Make ExecuteCurrentInstruction own the program-counter advancement

xusheng6
and
claude
committed
66ed50b
[emulator] A stub-handled tailcall returns to the caller instead of falling through

xusheng6
and
claude
committed
c3465e6