Vector35 / Vector35/binaryninja-api
Unnecessary addition operation at function call in decompiled code
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
- Binary Ninja Version: 3.2.3782-dev
- OS: Windows 10 x64
Bug Description:
int64_t var_d8 = -2
void var_108
int64_t rax_1 = __security_cookie ^ &var_108
BOOL wot = TryEnterCriticalSection(&this->Lock)
if (wot != 0)
this->vft->field_c0(this)
this->vft->Stop(this)
this->field_70 = 0
LeaveCriticalSection(&this->Lock)
else
char Destination[0x28]
// BUG here
// wot + 0x28?
// wot = 0, 0 + 0x28, why?
strcpy_s(&Destination, zx.q(wot + 0x28), "Stop")
int64_t rcx_3 = this->field_510
if (rcx_3 == 0)
void*** rax_2 = operator new(0x40)
void*** var_d0_1 = rax_2
if (rax_2 == 0)
rcx_3 = 0
else
rcx_3 = sub_180093810(rax_2)
this->field_510 = rcx_3
(*(*rcx_3 + 8))(rcx_3, &Destination, 0xa8, 0, 0xffffffff)
__security_check_cookie(rax_1 ^ &var_108)
Disassembly of strcpy_s call:
lea r8, [rel data_1800ca610] {"Stop"}
lea edx, [rax+0x28]
lea rcx, [rsp+0x40 {Destination}]
call qword [rel strcpy_s]
Expected Behavior:
I expect it to show only 0x28
Additional Information:
IDA does not even creates wot variable.
if ( TryEnterCriticalSection(&this->Lock) )
{
this->vft->sub_180099A50(this);
this->vft->Stop(this);
this->field_70 = 0;
LeaveCriticalSection(&this->Lock);
}
else
{
strcpy_s(Destination, 0x28ui64, "Stop");
I can not share the binary unfortunately.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review the reported decompiled C and the strcpy_s disassembly in this issue, focusing on the argument represented as wot + 0x28. Reproduction will require an equivalent binary or test case, which the report does not provide; done means the decompiler emits the expected 0x28 size without the unnecessary variable or addition.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100