analysis.limits.maxFunctionUpdateCount exceeded

[bloombit-dev]

Version and Platform (required):

• Binary Ninja Version: 5.3.8924-dev
• Edition: Ultimate
• OS: macOS
• OS Version: Tahoe 26.2
• CPU Architecture: M4 Max

Bug Description:
Log requested issue:

Example:
[Function] Skipping analysis for function at 0xb223908c : Exceeds 'analysis.limits.maxFunctionUpdateCount'. If possible, please report this issue.

Note the file is mbn format with hexagon architecture.

Steps To Reproduce:

1. Load file with default settings
2. Review log that requests reporting this issue

Binary:

qcadsp8380.mbn.zip

[psifertex]

Did this get resolved? Curious why it was closed?

[bloombit-dev]

On latest dev 5.3.9048-dev Ultimate things look good with analysis mode intermediate (and if you generate HLIL after loading per function) with or without limits disabled.

With full analysis mode the problem still exists. Reopened

[zznop]

I was able to reproduce your issue and it appears recursive logic in the binary is tripping up our analysis when propagating function type info. I created a small binary that replicates the same problem.

void func1(void *ptr, int a);
void func3(void *ptr, int a);

void func2(void *ptr, int a)
{
        if (a == 0)
                ptr = &func1;
        else if (a == 1)
                ptr = &func3;
        void (*func)(int) = ptr;
        func(a+1);
}

void func3(void *ptr, int a)
{
        if (a == 0)
                ptr = &func1;
        else if (a == 1)
                ptr = &func3;
        void (*func)(int) = ptr;
        func(a-1);
}

void func1(void *p, int a)
{
        void *ptr;
        if (a == 0)
                ptr = &func1;
        else if (a == 1)
                ptr = &func3;
        else
                ptr = p;

        func2(ptr, 1);
}

int main(int argc, char **argv)
{
        void *ptr = &func2;
        func1(func2, 1);
}

[zznop]

recursion_binja_bug.zip

[bloombit-dev]

I was able to reproduce your issue and it appears recursive logic in the binary is tripping up our analysis when propagating function type info. I created a small binary that replicates the same problem.

void func1(void *ptr, int a);
void func3(void *ptr, int a);

void func2(void *ptr, int a)
{
        if (a == 0)
                ptr = &func1;
        else if (a == 1)
                ptr = &func3;
        void (*func)(int) = ptr;
        func(a+1);
}

void func3(void *ptr, int a)
{
        if (a == 0)
                ptr = &func1;
        else if (a == 1)
                ptr = &func3;
        void (*func)(int) = ptr;
        func(a-1);
}

void func1(void *p, int a)
{
        void *ptr;
        if (a == 0)
                ptr = &func1;
        else if (a == 1)
                ptr = &func3;
        else
                ptr = p;

        func2(ptr, 1);
}

int main(int argc, char **argv)
{
        void *ptr = &func2;
        func1(func2, 1);
}

Confirmed the bug is present on other architectures