Need `BNGetLiftedlILBasicBlockForInstruction` to ensure `il_basic_block` will return successfully on lifted_il APIs

Open
#1,320 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
cpp, python

Research direction

Reproduce the failure with the lifted_il loop from the issue, then inspect python/binaryninja/lowlevelil.py around il_basic_block and LowLevelILBasicBlock, along with the BNGetLiftedILBasicBlockForInstruction entry point. Compare its behavior with the working llil and mlil cases; done means the lifted_il loop returns a valid il_basic_block without the constructor or cleanup exceptions.

Written by the indexing model from the issue text.

Description

Component: Core Impact: Low

On any sufficiently large binary, /bin/ls for example, the following code will not complete without generating an exception.

for func in bv.functions:
  for bb in func.lifted_il:
    for inst in bb:
      inst.il_basic_block

When replacing func.lifted_il with either func.llil or func.mlil, it seems to work fine.

The exception generated is:

Exception AttributeError: "'LowLevelILBasicBlock' object has no attribute 'handle'" in <object repr() failed> ignored
Traceback (most recent call last):
  File "<console>", line 4, in <module>
  File "/home/kyle/binaryninja/plugins/../python/binaryninja/lowlevelil.py", line 537, in il_basic_block
    return LowLevelILBasicBlock(view, core.BNGetLowLevelILBasicBlockForInstruction(self.function.handle, self.instr_index), self.function)
  File "/home/kyle/binaryninja/plugins/../python/binaryninja/lowlevelil.py", line 2413, in __init__
    super(LowLevelILBasicBlock, self).__init__(handle, view)
  File "/home/kyle/binaryninja/plugins/../python/binaryninja/basicblock.py", line 62, in __init__
    self.handle = core.handle_of_type(handle, core.BNBasicBlock)
  File "/home/kyle/binaryninja/plugins/../python/binaryninja/_binaryninjacore.py", line 13434, in handle_of_type
    raise ValueError('expected pointer to %s' % str(handle_type))
ValueError: expected pointer to <class 'binaryninja._binaryninjacore.BNBasicBlock'>

Later, when closing ipython or waiting an arbitrary amount of time, the following exception is generated:

Exception ignored in: <object repr() failed>
Traceback (most recent call last):
  File "/home/kyle/binaryninja/python/binaryninja/basicblock.py", line 69, in __del__
AttributeError: 'LowLevelILBasicBlock' object has no attribute 'handle'

Nearly identical blocks/instructions are affected, does seem to break consistently on the same block in the same binary, but I I think that's more happenstance than anything.

Present in both Python2 and Python3, sorta seems like a dangling pointer issue to me.

Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Vector35/binaryninja-api

All issues in Vector35/binaryninja-api

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.