Vector35 / Vector35/binaryninja-api
PE COFF Debug symbols are parsed incorrectly
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Version and Platform (required):
- Binary Ninja Version: 3.5.4285-dev
- OS: MacOS
- OS Version: Ventura
- CPU Architecture: M1
Bug Description:
In IDA, function names are automatically being discovered (not FLIRT) that BN does not pick up.
BN picks up some of the function names, but misses out on a few that was picked out by IDA.
Steps To Reproduce:
Please provide all steps required to reproduce the behavior:
Load the following binary in both IDA & Binary Ninja.
binary.zip
Expected Behavior:
In this particular case, a function at address 0x57db80 should be named as _FXCLI_DebugDispatch.
Screenshots:
In IDA:
In Binary Ninja:
Notice how the function at 0x57db80is named as _FXCLI_DebugDispatch in IDA, but not in Binary Ninja
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by loading the attached binary in Binary Ninja and comparing its PE/COFF debug-symbol results with IDA. Inspect why the function at 0x57db80 is not assigned the expected name, _FXCLI_DebugDispatch. Done means Binary Ninja discovers and names that function consistently for the provided reproduction binary.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100