Vector35 / Vector35/binaryninja-api

__gconv_step is wrong in x86_64 libc type library

Open
#2,764 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Type Libraries Effort: Trivial Impact: Low
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Binary Ninja Version
2.4

Describe the bug
the structure __gconv_step is misdefined in the libc typelibrary for x86_64.

This is likely due to a DWARF parsing bug.

To Reproduce

>>> Platform['linux-x86_64'].get_type_libraries_by_name('libc_x86_64.so.6')[0].get_named_type('__gconv_step').members
[<void* __shlib_handle, offset 0x0>, <char const* __modname, offset 0x8>, <int32_t __counter, offset 0x10>, <char* __from_name, offset 0x18>, <char* __to_name, offset 0x20>, <__gconv_fct __fct, offset 0x28>, <void __fct, offset 0x28>, <void __fct, offset 0x28>, <__gconv_btowc_fct __btowc_fct, offset 0x30>, <__gconv_init_fct __init_fct, offset 0x38>, <__gconv_end_fct __end_fct, offset 0x40>, <int32_t __min_needed_from, offset 0x48>, <int32_t __max_needed_from, offset 0x4c>, <int32_t __min_needed_to, offset 0x50>, <int32_t __max_needed_to, offset 0x54>, <int32_t __stateful, offset 0x58>, <void* __data, offset 0x60>]

Expected behavior
The two void types at offset 0x28 shouldn't exist.

Screenshots

image

Workaround

with Type.builder(bv, '__gconv_step') as s:
  s.remove(6)
  s.remove(7)

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue with Platform['linux-x86_64'].get_type_libraries_by_name('libc_x86_64.so.6') and inspect get_named_type('__gconv_step'). Trace the DWARF parsing path that creates the duplicate void members at offset 0x28. Done means the type library no longer contains those two members and the Type.builder workaround is unnecessary.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, python
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.