Vector35 / Vector35/binaryninja-api

Expand and improve the "problem" tag types

Open
#2,352 2 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: UI Effort: Low Impact: Low
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Two related requests:

First, when REing the analysis failures are often valuable starting spots for analysis. They can identify interesting code, show load errors, show lift errors, etc. Right now this functionality is partially implemented via certain tag types, e.g. non-code branch, unresolved indirect branch, unresolved stack adjustment, etc. However, the UI workflow here leaves something to be desired currently -- go to tag types, enable those tag types, go to tags and navigate through them.

The first request is for these analysis failures should be pushed to the users attention in some fashion. Something similar to the red X for error logs, so the user is reminded to look at the analysis failures. Pushing this to the user is somewhat critical in my opinion -- finding the failure tag after you've found the problem some other way defeats the point.

Second expand the number of problem tag types. If this is the default way unexpected analysis events are going to be communicated to the user, there are probably a bunch which could be added.

List of possible tags to add:

  • Writes into read only code
  • Loads from unmapped addresses
  • Calling convention aberrations
  • Heuristics for large amounts of dead code removal
  • Branches that are constant due to memory permissions
  • Branches that go into the void (cc #2381)
  • Conflicting accesses sizes to structure members
  • mismatched sp at basic block start (cc #1907)
  • inability to populate function arguments (cc #1924)
  • unknown register referenced in any IL instruction (cc #2963)
  • tag places where dataflow no longer agrees with indirect branch targets
  • tag places where enum types have values written to them that are not in the defined variants.
  • tag places where the forward propagated type does not match the current type

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the existing problem-related tag types and the current tag-types and tags UI workflow described in the issue. Determine how analysis failures could be surfaced to users, prioritize the proposed additional problem tags, and define completion around an agreed notification approach and implemented tag coverage.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.