PE view creates functions at data variable exports

Open

#4,053 opened on Dec 6, 2022 0 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 3/5
Estimated time: 1-2 days
Newbie friendliness: 42/100

Issue type: Bug
Clarity: Mostly clear
Activity status: Stale
Tech stack: cpp
Domain: reverse-engineering

Research direction

Reproduce the issue using the binary referenced by Vector35/binaryninja-api#3709 and inspect address 0x100162e8. Start with the PE loader's export handling, especially its treatment of exports in executable segments. Done means data variable exports no longer produce erroneous functions while real functions continue to be analyzed.

Written by the indexing model from the issue text.

Description

Component: BinaryViewType Effort: Low File Format: PE Impact: Low

Version and Platform (required):

Binary Ninja Version: 3.2
OS: macOS
OS Version: 12.4
CPU Architecture: M1

Bug Description:
On trying to analyze the binary in Vector35/binaryninja-api#3709, many functions are created for data variable symbols, because they are technically exports (and have an entry), but are in the text segment. These functions are erroneous and misleading.

Steps To Reproduce:
Please provide all steps required to reproduce the behavior:

Open the binary from Vector35/binaryninja-api#3709
Go to 0x100162e8
Observe nonsense function created
Undefine function
Observe real data variable at that address

Expected Behavior:
I expected binja to not try to analyze a data variable

Screenshots:

Additional Information:
This is a bug in the PE loader observing that the segment of the export is executable, and assuming it can create a function there.

Dominant language: C++
Stars: 1.3k
Forks: 298
Avg merge: 5d 5h
Merged PRs (30d): 19

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

Eval bug: SIGSEGV in token-counting routes when the request arrives while the server is sleeping (stale vocab/mctx captured before the wake barrier) Open

Difficulty 2/5 1-3 hours Newbie friendliness 86/100

ggml-org/llama.cpp#29188 · Opened Sep 20, 2026
Sensor initialization takes very long when `--initial-sim-time` is set to current UNIX timestamp Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

gazebosim/gz-sensors#662 · 1 comment · Opened Sep 20, 2026
Aligned columns on the serial monitor while keeping CSV on the SD card Open

enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

NorthernWidget/Margay_Library#31 · Opened Sep 20, 2026
v1 manifest list: existing_files_count is the table-wide total-data-files Open

comp-datalake

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

ClickHouse/ClickHouse#121222 · Opened Sep 20, 2026
Case collision between `Canvas` and `canvas` test directories causes platform-dependent source hashes Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

LadybirdBrowser/ladybird#12123 · Opened Sep 20, 2026

More C++ issues