Vector35 / Vector35/binaryninja-api

InstructionTextToken.address is inconsistent

Open
#2,722 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: API Effort: Medium Impact: Low
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Binary Ninja Version
2.4.3074-dev

Describe the bug
The property InstructionTextToken.address sounds like it should be the address (absolute? IL index? either?) of the token or the line on which the token is located. In practice, it is inconsistent and can be a number of things, including:

  • The absolute address of the token e.g. 0x1000011d8
  • The IL (unsure which, and probably an expr index) index of the token e.g. 58
  • Zero

To Reproduce
Steps to reproduce the behavior:

  1. Open this binary: ls.zip
  2. Navigate to sub_10000119a
  3. Enter the following python command:
    [(t.text, t.address) for t in list(current_hlil[15].lines)[0].tokens]
    Results are as follows:
    [('return ', 0x0), ('_strcoll', 0x0), ('(', 0x0), ('arg2', 0x3a), (' + ', 0x0), ('0x68', 0x1000011d4), (', ', 0x0), ('arg1', 0x3d), (' + ', 0x0), ('0x68', 0x1000011d8), (', ', 0x0), ('rdx', 0x40), (', ', 0x0), ('rcx_1', 0x41), (', ', 0x0), ('arg1', 0x42), (' + ', 0x0), ('0x68', 0x1000011d8), (') __tailcall', 0x0)]
    Some of the tokens use absolute addresses, some use IL addresses (maybe??) and some are zero
  4. Enter the following python command:
    [(t.text, t.address) for t in current_mlil[7].tokens]
    Results are as follows:
    [('if (', 0x0), ('temp0', 0x7), (' s> ', 0x0), ('rcx', 0x7), (') then ', 0x0), ('8', 0x0), (' @ ', 0x0), ('0x1000011d3', 0x0), (' else ', 0x0), ('9', 0x0), (' @ ', 0x0), ('0x1000011b8', 0x0)]
    Some of these have the IL instruction index as their address, some of them are zero
  5. Enter the following python command:
    [(t.text, t.address) for t in current_llil[9].tokens]
    Results are as follows:
    [('if (', 0x0), ('temp0', 0x9), ('.q', 0x0), (' s> ', 0x0), ('rcx', 0x9), (') then ', 0x0), ('10', 0x0), (' @ ', 0x0), ('0x1000011d2', 0x0), (' else ', 0x0), ('12', 0x0), (' @ ', 0x0), ('0x1000011b8', 0x0)]
    Similar to MLIL, some of these are IL locations and some are zero
  6. Enter the following python command:
    [(t.text, t.address) for t in current_function[0][5][0]]
    Results are as follows:
    [('mov', 0x0), (' ', 0x0), ('rcx', 0x0), (', ', 0x0), ('qword ', 0x0), ('[', 0x0), ('rdi', 0x0), ('+', 0x0), ('0x50', 0x0), (']', 0x0)]
    All of these have an address of zero

Expected behavior
I expected the addresses of the tokens to be consistent, at least within one IL type, and maybe even correct or useful information. Something like (any one of these is fine):

  • All the tokens have the absolute address as their address, even in IL views
  • All the tokens have the absolute address (disasm) or their IL instruction index
  • All the tokens have the absolute address (disasm) or their IL expression index (kind of confusing but acceptable if documented)

Version and Platform (required):

  • Binary Ninja: Dev 2.4.3074-dev
  • OS: macOS
  • Version 10.15.7

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the listed Python commands for InstructionTextToken.address across current_hlil, current_mlil, current_llil, and current_function using the supplied binary. Then trace how each token list assigns addresses and compare the results with the expected alternatives; done means the address semantics are consistent or explicitly documented across the shown views.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, python
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.