Tail call analysis of indirect jumps

[0x1F9F1]

Binary Ninja Version: 1.1.1227-dev, 92412e23
Platform: Windows 10 (10.0)

There seems to have been a regression analyzing indirect tail calls between 1.1.1200-dev and 1.1.1201-dev.

1.1.1200-dev:

>>> current_llil[24]
<il: jump([rsp - 8 {var_8}].q => 25 @ 0x143455093)>

>>> current_llil[24].operation
<LowLevelILOperation.LLIL_JUMP_TO: 52>

>>> current_llil[24].get_reg_value('rsp')
<stack frame offset 0x0>

>>> current_llil[24].dest.value
<const ptr 0x14152ad3c>

>>> current_llil[25]
<il: <return> tailcall(0x14152ad3c)>

>>> current_llil[25].operation
<LowLevelILOperation.LLIL_TAILCALL: 55>

1.1.1201-dev:

>>> current_llil[24]
<il: jump([rsp - 8 {var_8}].q)>

>>> current_llil[24].operation
<LowLevelILOperation.LLIL_JUMP: 51>

>>> current_llil[24].get_reg_value('rsp')
<stack frame offset 0x0>

>>> current_llil[24].dest.value
<const ptr 0x14152ad3c>

[rssor]

This is intentional behavior for now -- indirect tail calls were actually being handled on accident in certain situations leading up to build 1.1.1201-dev (and causing problems of their own since there's some additional groundwork to lay before we can handle it robustly).

This is almost the only change that was made in build 1.1.1201-dev.