Vector35 / Vector35/binaryninja-api
Actual selection range does not reflect visual selection in Linear View when selection ends in defined data region
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
(Resubmitted and revised by @galenbwill for user chris123 on public slack)
Binary Ninja Version
2.4.3044-dev
Describe the bug
The binary contains a defined string:
char encryptedFlag[0x1a] = "\xd0\xc05O\x0c\xd9#*HK\t\x0bT<\xf8\xc0\xe5\xdf\xd7y\x0f=\xdb5\xc4", 0
So a mix of \xXX and normal chars.
In this case selecting the entire string , right click, copy as, raw hex only copies: the first two bytes of the selection."d0c0" so it ends once it encounters the not escaped O.
The exact same happens when RC4 decrypting, it only decrypts the first two bytes by selecting it all, right click, transformation, RC4.
A workaround is to temporarily undefine the variable, copy/rc4 and redefine it.
Clarification: The behavior is actually to copy the entire selection, except only the first two bytes of the last line of the selection.
Expected behavior
The entire data gets copied and either decrypted or copied as raw data. Basically the output of binascii.hexlify(bv.read(here, 0x1a)) is expected. (which in the above example would be d0c0354f0cd9232a484b090b543cf8c0e5dfd7790f3ddb35c400)
Version and Platform (required):
- Binary Ninja: Dev 2.4.3044
- OS: Windows
- Version 10
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue in Linear View with a defined string containing both escaped bytes and normal characters, then try Copy as raw hex and the RC4 transformation on the full selection. Compare both results with the expected complete byte sequence from binascii.hexlify(bv.read(here, 0x1a)); done means the entire visual selection is copied and transformed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- desktop-dev, reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100