Vector35 / Vector35/binaryninja-api

Binja does not define second string when comparing

Open
#3,719 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Core Effort: Low Impact: Medium
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

  • Binary Ninja Version: 3.2.3895
  • OS: Windows 11, x64

Bug Description:

This is the code that I use for testing:

	int res = 0;
	const char* s1 = "test_string";
	if (strcmp(s1, "string_to_compare"))
		res = 1;
	else
		res = 2;

	printf("res = %d", res);

This is the HLIL output of it:

int32_t var_18 = 0
char* target = "test_string"
int32_t rax
while (true)
  char s = *target
  char d = target[16]
  bool c_1 = s u< d
  if (s != d)
    rax = sbb.d(target.d, target.d, c_1) | 1
    break
  target = &target[1]
  if (s == 0)
    rax = 0
    break
int32_t var_18_1
if (rax == 0)
  var_18_1 = 2
else
  var_18_1 = 1
sub_140001060("res = %d", var_18_1)
return 0

Actually the output is correct, but I think it should replace char d = target[16] with char* d = "string_to_compare" and dereference string from that variable in order to make it more easy to understand. Next move is probably recognize inlined strcmp.

Additional Information:
Binary: string_compare_bug.zip

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the attached string_compare_bug.zip and compare its HLIL output with the reported C example, focusing on the inlined strcmp handling and the missing second string definition. Done means the decompiler represents the comparison with the second literal as a separate string value, while preserving the correct result.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.