Vector35 / Vector35/binaryninja-api
api-ms-win-xyz type libraries sometimes don't have types
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Version and Platform (required):
- Binary Ninja Version: 3.0.3458-dev
- OS: macOS
- OS Version: 12.0.1
- CPU Architecture: M1
Bug Description:
Some type libraries named api-ms-win-* have incorrect/missing types for symbols. These are probably type libraries of DLLs that just import their symbols from various other DLLs, and when a binary references them the types are not propagated.
Steps To Reproduce:
- Open C:\Windows\System32\wevtsvc.dll
- Find the EnterCriticalSection symbol
- Observe its type, note how it does not have the correct arguments
- Open a different windows exe that references kernel32 directly
- Find the EnterCriticalSection symbol
- Observe its type, note how it does have the correct arguments
Expected Behavior:
I expected the imported functions to have correct arguments in all cases.
Screenshots:
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue by opening C:\Windows\System32\wevtsvc.dll and inspecting EnterCriticalSection, then compare it with a Windows executable that references kernel32 directly. Trace how imported symbols receive types and verify that the imported function has the correct arguments in both cases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100