What is MediumLevelILOperation.MLIL_RET_HINT?

[sabastiaan]

After playing a little bit with mapped mlil I found the following:

If we take a regular return instruction like c3 in x64, then we can access it in a few different ways:

1. through llil, this would result in LowLevelILOperation.LLIL_RET
2. through mlil, this would result in MediumLevelILOperation.MLIL_RET
3. through mapped mlil found on an the llil of 1, this results in MediumLevelILOperation.MLIL_RET_HINT

Scanning some decently large binaries I could also find no instance of this operation in direct MLIL.
I also could find no reference to this in the documentation.

Personally, I find it quite strange that for the same instruction, it's llil and mlil operation are equal, but the mmlil and mlil aren't.

Does anybody know what it is used for?

[plafosse]

This should only show up in Mapped MLIL. They are a hint to the analysis that a jump should be converted to a ret in the final version of MLIL. Our current suggestion is to stop using Mapped MLIL as we'd eventually like to deprecate it in favor of improved MLIL analysis and APIs.