Add the framework for BNIL emulator and implement LLIL emulator - #8314

Open

xusheng6 wants to merge 44 commits into

devfrom

Commits on Jul 29, 2026

Add the BNIL (LLIL) emulator plugin

xusheng6
and
claude
committed
Add coverage for newly added IL instructions
xusheng6
committed
[emulator] Remove stray blank line in binaryninjacore.h

xusheng6
and
claude
committed
[emulator] Remove stray blank line before namespace close in binaryninjaapi.h

xusheng6
and
claude
committed
[emulator] Move intx include out of binaryninjaapi.h into emulator headers

xusheng6
and
claude
committed
[emulator] Fix signed IL ops for operands wider than 8 bytes and INT_MIN/-1

xusheng6
and
claude
committed
[emulator] Fix LLIL_ADD_OVERFLOW to compute signed overflow, not unsigned carry

xusheng6
and
claude
committed
[emulator] Fix RLC/RRC rotate-through-carry semantics

xusheng6
and
claude
committed
[emulator] Mask arithmetic operands consistently up front

xusheng6
and
claude
committed
[emulator] Fix carry/borrow flag for ADC/SBB at the operand-size boundary

xusheng6
and
claude
committed
[emulator] Fix double-precision divide/modulo operand widths and signedness

xusheng6
and
claude
committed
[emulator] Fix cross-segment memory read/write boundary computation

xusheng6
and
claude
committed
[emulator] Reject overlapping memory maps

xusheng6
and
claude
committed
[emulator] Bound intrinsic-hook output writes to the buffer capacity

xusheng6
and
claude
committed
[emulator] Start EmuRefCountObject at a reference count of 1

xusheng6
and
claude
committed
[emulator] Don't let map allocation failures cross the C ABI boundary

xusheng6
and
claude
committed
[emulator] Stop after a call stub/hook requests a stop

xusheng6
and
claude
committed
[emulator] Mask memory-read-hook value to the buffer width in Python

xusheng6
and
claude
committed
[emulator] Move the public C++ API out of the BinaryNinja namespace

xusheng6
and
claude
committed
[emulator] Return a reference, not a raw pointer, from LLILEmulator::GetView

xusheng6
and
claude
committed
[emulator] Require a valid architecture as an emulator invariant

xusheng6
and
claude
committed
[emulator] Place call arguments using the emulated function's calling convention

xusheng6
and
claude
committed
[emulator] Drop false claim that tests run in the main suite

xusheng6
and
claude
committed
[emulator] Fix docs stdout example and Python-bindings cmake fallback path

xusheng6
and
claude
committed
[emulator] Type the stdin callback buffer as void* for a writable binding

xusheng6
and
claude
committed
[emulator] Use typed LLIL operand accessors instead of GetRawOperandAs*

xusheng6
and
claude
committed
[emulator] Add tests for flags, shifts/rotates, extension, and division/memory edges

xusheng6
and
claude
committed
[emulator] Don't re-mask shift counts; execute the IL shift literally

xusheng6
and
claude
committed
[emulator] Include the vendored intx directly, drop the wrapper header

xusheng6
and
claude
committed
emulator: warn when emulating a non-default architecture

xusheng6
and
claude
committed
emulator: honor non-default argument locations in SetArgument

xusheng6
and
claude
committed
emulator: move wide-integer helpers to the ILEmulator base class

xusheng6
and
claude
committed
emulator: store flags as bool

xusheng6
and
claude
committed
emulator: use return consistently in the LLIL call handlers

xusheng6
and
claude
committed
emulator: read arguments/return values via the function calling convention

xusheng6
and
claude
committed
emulator: drop redundant string wrap around GetShortName

xusheng6
and
claude
committed
emulator: return std::optional from ResolveCallTargetName

xusheng6
and
claude
committed
emulator: add a per-instruction LLIL test suite

xusheng6
and
claude
committed
[emulator] Fix null-architecture crash when emulating a standalone IL function

xusheng6
and
claude
committed
[emulator] Fix MULU_DP/MULS_DP operand and product widths

xusheng6
and
claude
committed
[emulator] Fix TEST_BIT to select a bit by index, not mask

xusheng6
and
claude
committed
[emulator] Resolve JUMP_TO through the instruction's own target map

xusheng6
and
claude
committed
[emulator] Fix test cases that asserted on IL the API cannot express

xusheng6
and
claude
committed
[emulator] Add known-answer tests that emulate compiled base64 and MD5

xusheng6
and
claude
committed