Version and Platform (required):
- Binary Ninja Version: 5.4.10193
- Edition: Non-Commercial
- OS: Windows 11
- OS Version: 25H2
- CPU Architecture: x64
Bug Description:
Opening the Windows NT kernel on Binja makes half the functions erroneously contain ZMM registers as arguments (or spilled stack args, if there's no more ZMM registers). Makes analyzing it much harder with the amount of noise. It might be a regression, stable 5.3 R2 still has ZMM polluting everything but latest dev always has one more ZMM arg on the signature. Some functions are also missing types on dev, even though they come from the PDB, it appears correctly on stable
I've tried removing or disabling sysv as a calling convention but the issue still persists. Loading the PDB or not still doesn't changes the signatures
Steps To Reproduce:
- Open ntoskrnl.exe on binja
- Wait for analysis to finish, as function signatures first appear correctly but ZMM registers propagate over time everywhere
Expected Behavior:
Not having int512_t parameters everywhere
Screenshots/Video Recording:
[5.4.10193 vs 5.3.9757]






Binary:
I'm using my own system's ntoskrnl.exe, I assume you can grab any WIndows's installation for it, it's on Windows/System32. But I've reattached it here anyways
Additional information:
These issues seem related to this one, if not the same: #7665 and #7673
Version and Platform (required):
Bug Description:
Opening the Windows NT kernel on Binja makes half the functions erroneously contain ZMM registers as arguments (or spilled stack args, if there's no more ZMM registers). Makes analyzing it much harder with the amount of noise. It might be a regression, stable 5.3 R2 still has ZMM polluting everything but latest dev always has one more ZMM arg on the signature. Some functions are also missing types on dev, even though they come from the PDB, it appears correctly on stable
I've tried removing or disabling sysv as a calling convention but the issue still persists. Loading the PDB or not still doesn't changes the signatures
Steps To Reproduce:
Expected Behavior:
Not having int512_t parameters everywhere
Screenshots/Video Recording:






[5.4.10193 vs 5.3.9757]
Binary:
I'm using my own system's ntoskrnl.exe, I assume you can grab any WIndows's installation for it, it's on Windows/System32. But I've reattached it here anyways
Additional information:
These issues seem related to this one, if not the same: #7665 and #7673