Vector35 / Vector35/binaryninja-api

Setting a calling convention doesn't trigger argument locations to be redetermined

Open
#4,530 0 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Core Effort: Low Impact: Low
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 3.5.4390-dev
  • OS: macOS
  • OS Version: 13.5
  • CPU Architecture: arm64

Bug Description:
Created a custom calling convention that took the first argument at x20 (this in Swift) and applied it, but it didn't work:

image

Explicit argument locations do work, however:

image

It turns out this is a little more complicated than 'it doesn't work', though. What appears to be happening is that:

  1. If you have the argument location at x20 first
  2. ...and then edit the signature to remove the explicit argument location
  3. ...and then change the calling convention
  4. ...the argument won't be at x20 because the calling convention updates the type, but doesn't update the actual variables

Removing the explicit location changes the argument to the "default location" (x0, in this case) and then the update does not change the variable location even though the calling convention has changed in the type of the function. The variable in the type is still at "default location" but the variable in the analysis has not been changed to the "default location" of the new calling convention. Check current_function.type.parameters[0].location is None vs bv.arch.get_reg_name(current_function.parameter_vars[0].storage) to see that this is the case.

Expected Behavior:
Any time the calling convention has changed, it should update the parameter variable locations if they are set to the default location. It should update to use the default location in the new calling convention.

Additional Information:
Lots of thanks to @CouleeApps for figuring out what was actually happening here, since it appeared to be working non-deterministically before.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the calling-convention update path and inspect how current_function.type.parameters[0].location relates to bv.arch.get_reg_name(current_function.parameter_vars[0].storage). Reproduce the sequence of removing an explicit location and changing the calling convention; done means parameters using the default location move to the new convention's default location.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.