Vector35 / Vector35/binaryninja-api
Disassembly of instruction stops at section boundary
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Here is an issue that I ran into when I deal with the crackme at https://github.com/antire-book/dont_panic. After some processing, I get the following code:
The code at 0x40017a fails to disassemble. However, if we look at the bytes(48 31 ed ...), it is definitely a valid instruction:
And the reason that we stop disassembling even if the bytes are valid is because we are hititng a section boundary:
The related database: trouble.bndb.zip
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the supplied trouble.bndb.zip database and reproduce disassembly at 0x40017a in the crackme from the issue. Trace the section-boundary handling that stops after the preceding bytes; done means the valid instruction beginning with 48 31 ed is disassembled instead of terminating at the boundary.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100