No propagation of type

Open
#4,582 7 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
42/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
cpp
Domain
compilers, reverse-engineering

Research direction

Reproduce the issue in Binary Ninja using Kernelbase.dll and PsspValidateWin32WalkMarker, then inspect how manually assigned argument types are handled across assignments and dereferences. The fix is complete when setting arg1 to struct OBJECT_ATTRIBUTES** causes the referenced variable to display the propagated OBJECT_ATTRIBUTES* type instead of the original cast type.

Written by the indexing model from the issue text.

Description

Component: Core Core: Type Propagation Effort: Medium Impact: Low

Version and Platform (required):

  • Binary Ninja Version: 3.5.4480-dev, 60681746
  • OS: windows
  • OS Version: 11
  • CPU Architecture: x86_64

Bug Description:
When setting a variable (var1) or argument to a different or custom type and another variable (var2) references it (e.g. var1 = var2, or var1 = *var2), the type information we set on var1 does not propagate to var2.

Steps To Reproduce:
Open anything (e.g. Kernelbase.dll), find a function (e.g. PsspValidateWin32WalkMarker) and set arg1 to a double pointer (e.g. struct OBJECT_ATTRIBUTES** arg1)

Now view anything that does something like
int32_t rbx_1 = *arg1

Note that in this case above, rbx_1 maintained its old/original type, making this assignment a cast, when I'd want it to propagate the type I specifically set for arg1.

I don't see an option for this either? Which makes finding cross-refs for certain types difficult, as you not only have to change the type in an argument, but all variables that copy its value.

Expected Behavior:
I should expect to see something like:
OBJECT_ATTRIBUTES* rbx_1 = *arg1

Screenshots:
image

Additional Information:

Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Vector35/binaryninja-api

All issues in Vector35/binaryninja-api

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.