Variables created from array indexing have incorrect types

Aperta
#3,244 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Ferma
Stack tecnologico
cpp
Ambito
reverse-engineering

Direzione di ricerca

Start with the provided struct_array3.zip reproduction in _main, applying Foo* to x0 and comparing x8_16 with Show All Expression Types enabled. Trace how MLIL assigns the variable type and how HLIL resolves the array index expression. Done means the variable receives the higher-confidence struct Bar* type from the resolved expression.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Component: Core Core: HLIL Impact: Medium

Version and Platform (required):

  • Binary Ninja Version: 3.1.3553-dev
  • OS: macOS
  • OS Version: 12.0.1
  • CPU Architecture: M1

Bug Description:
When HLIL resolves an array index offset, the resulting HLIL Expression has a deduced type, but this does not apply the type to a variable assigned to that expression. This is probably due to array resolution being done in HLIL and not applying expression types to variables which are created in MLIL.

Steps To Reproduce:
Please provide all steps required to reproduce the behavior:

  1. Open this binary: struct_array3.zip
  2. Create these types:
struct Bar __packed
{
    int32_t a;
    int32_t field_4;
    struct Baz* bazs[0x10];
    int32_t b;
};
struct Baz __packed
{
    int32_t a;
    int32_t b;
    uint8_t* c;
};
struct Foo __packed
{
    int64_t unknown;
    struct Bar* pBars[0xa];
    struct Bar** ppBars[0xa];
    struct Bar*** pppBars[0xa];
    int64_t unknown1;
};
  1. In _main, apply the type Foo* to the variable x0 (address 100003df8)
  2. Observe the type of variable x8_16 (address 100003e88) is int32_t*
  3. Enable the option Show All Expression Types
  4. Observe the type of the expression assigned to x8_16 is struct Bar*

Expected Behavior:
I expected the assignment to change the variable's type automatically (at least, assuming the new type has confidence > the variable's existing confidence)

Screenshots:
image
image

Additional Information:
This is probably due to MLIL assigning the variable's type based on the analysis without the array resolution, as HLIL applies later and doesn't update the type.

Lingua principale
C++
Stelle
1.3k
Fork
298
Merge medio
5g 5h
PR unite (30g)
19

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di Vector35/binaryninja-api

Tutte le issue di Vector35/binaryninja-api

Issue simili

Altre issue su C++

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.