How can I get correct parameter when calling function in MIPS?

[hzshang]

I want to parse the parameters of sprintf to determine potential overflow vulnerabilities. For the below functions, calling the get_parameter_at function in x86 and aarch64 can get the correct result:

x86 code

000012e8  int32_t bug_function2(char* arg1)
0000130a      void* gsbase
0000130a      int32_t eax_1 = *(gsbase + 0x14)
00001335      void var_110
00001335      sprintf(s: &var_110, format: "echo %d %s %s", 1, arg1, &data_2010)
...

API example in x86

>>> func = bv.get_function_at(0x12e8)
>>> func.get_parameter_at(0x1335,None,0)
<stack frame offset -0x110>
>>> func.get_parameter_at(0x1335,None,1)
<const ptr 0x2014>
>>> func.get_parameter_at(0x1335,None,2)
<const 0x1>
>>> func.get_parameter_at(0x1335,None,3)
<undetermined>
>>> func.get_parameter_at(0x1335,None,4)
<const ptr 0x2010>

However, func.get_parameter_at(0x1335,None,4) in MIPS return undetermined

MIPS code

004008a4  int32_t bug_function2(int32_t arg1)
004008c8      int32_t $v0 = *__stack_chk_guard
004008fc      void var_10c
004008fc      sprintf(&var_10c, 0x400ba8, 1, arg1, 0x400bb8)  {"echo %d %s %s"}
...

API example in MIPS

>>> func = bv.get_function_at(004008a4)
>>> func.get_parameter_at(0x4008fc,None,0)
<stack frame offset -0x10c>
>>> func.get_parameter_at(0x4008fc,None,1)
<const 0x400ba8>
>>> func.get_parameter_at(0x4008fc,None,2)
<const 0x1>
>>> func.get_parameter_at(0x4008fc,None,3)
<entry $a0>
>>> func.get_parameter_at(0x4008fc,None,4)
<undetermined>

I think arg4 should be a constant value 0x400bb8, bu it return <undetermined>.

here is the binary download link.

binary.zip

[psifertex]

I'm not sure why the get_parameter_at isn't working, I'll take a look but I would use this bit of code instead:

current_function.get_low_level_il_at(here).mlil.params[4].value.value