bv.add_function() analysis warning for 'misaligned function' generated unnecessarily on ARM.

Open
#4,508 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
42/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
cpp
Domain
reverse-engineering

Research direction

Start at the bv.add_function() path and inspect how bv.arch.instr_alignment is used when validating the first instruction address for ARM architectures. Reproduce with an ARM binary and an address ending in 2, 6, A, or E, then verify that alignment 2 suppresses only the unnecessary misaligned-function warning while other alignment checks remain intact.

Written by the indexing model from the issue text.

Description

Arch: ARM/Thumb Component: Architecture Effort: Low Impact: Low

Version and Platform (required):

  • Binary Ninja Version: 3.4.4271 (stable). Also verified against dev version.
  • OS: MacOS
  • OS Version: Ventura 13.4.1
  • CPU Architecture: M1

Bug Description:
On an ARM architecture binary, when using bv.add_function() to add function whose code begins at an address that is not 32bit-aligned (e.g., address ending in 2, 6, A, or E), Binary Ninja produces an Analysis Warning unnecessarily ([...Analysis warn] Adding misaligned function at: 0x4177e392). Setting bv.arch.instr_align==2 during load has no effect.

Steps To Reproduce:

  1. Load an ARM binary
  2. Set bv.arch.instr_alignment=2 during load, if desired (can also be set with the 'platform' arch when adding the function)
  3. Find an instruction at a non-32bit-aligned address (e.g., ending in 2, 6, A, or E)
  4. Use bv.add_function() to try to define a new function starting at that address

Expected Behavior:
ARM allows the first instruction of a function to begin at an address that is not 32bit-aligned (some specific ARM data access instructions must be 32bit-aligned, but for most ARM instructions, 32bit-alignment is not required).

If bv.add_function() is called using any ARM architecture ('armv7, armv8', 'thumb', 'thumb2', 'aarch32', 'aarch64', etc.) and bv.arch.instr_alignment == 2, then the Analysis Warning for 'misaligned function' should be suppressed, when the first instruction of the first basic block of the function is not DWORD-aligned.

References:
ARMv7 architecture manual, section A3.2.1.
ARMv8 architecture manual, section B7.6.

Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Vector35/binaryninja-api

All issues in Vector35/binaryninja-api

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.