Vector35 / Vector35/binaryninja-api
Binary Ninja fails to infer index of dimensional arrays properly
Open
Nobody has claimed this yet.
Component: Core
Core: HLIL
Impact: Medium
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Version and Platform (required):
- Binary Ninja Version: 3.4 dev
Bug Description:
Multi-dimensional array indices are not properly inferred.
For the given structuint8_t state_t[0x4][0x4]Output is this:
0804a4a6 (*state)[0][1] = (*state)[0][5]
0804a4b3 (*state)[0][5] = (*state)[0][9]
0804a4c0 (*state)[0][9] = (*state)[0][13]
It should be this:
(*state)[0][1] = (*state)[1][1];
(*state)[1][1] = (*state)[2][1];
(*state)[2][1] = (*state)[3][1];
bndb shared privately search for: multi_dimensional_array_bug.zip
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by obtaining and opening the privately shared multi_dimensional_array_bug.zip reproduction, then inspect the decompiler output for the uint8_t state_t[0x4][0x4] example. The issue is done when the inferred assignments use (*state)[1][1], (*state)[2][1], and (*state)[3][1] rather than flattened indices such as [0][5] and [0][9].
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100