Vector35 / Vector35/binaryninja-api

"Invalid Instruction" tags are cleared on reanalysis

Open
#2,812 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: UI Effort: Low Impact: Low UI: Tags
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 2.5.3145-dev
  • OS: macOS
  • OS Version: 12.0.1

Bug Description:
Certain "invalid instruction" tags are created when the arch fails to disassemble an instruction, but reanalyzing the function deletes them and does not recreate them.

Steps To Reproduce:
Please provide all steps required to reproduce the behavior:

  1. Open /System/Library/Kernels/kernel.release.t6000
  2. Observe Invalid Instruction tags

Expected Behavior:
I expected the tags to persist.

Screenshots:
image

Additional Information:
Possible cause: invalid instruction tags are only created when analyzing basic blocks. Function reanalysis clears all auto tags. Basic blocks are not analyzed on subsequent reanalyses unless the file contents change, so the invalid instruction tags are cleared and never recreated.

Possible solutions:

  1. Reanalyze basic blocks when functions are reanalyzed, so the tags are created again
  2. Have a set of preserved tags for reanalysis
  3. Have a set of preserved tag types reanalysis
  4. Have a tagtypetype for them specifically to facilitate 2 or 3
  5. Only remove tags of certain types when clearing auto analysis data

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue with /System/Library/Kernels/kernel.release.t6000 by observing the Invalid Instruction tags and reanalyzing the function. Read the issue's notes about basic blocks and auto tags first; done means the tags persist after function reanalysis and are recreated or preserved consistently.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.