Vector35 / Vector35/binaryninja-api
Have the prototypes exactly the same as their definition in SDK /WDK
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
I'm opening this issue with windows kernel support in my mind, but I guess my point is acceptable for all platforms. I strongly believe that we should have the function prototypes exactly the same as their definition in the SDK.
For example, according to the prototype in the WDK, KeAcquireSpinLockRaiseToDpc returns KIRQL but BN tells me it returns uint64_t. Even if it is technically correct, it causes several other neurons to fire and disrupting integrity of the understanding process. Because now I need to remember (or worst, look it up) what does KeAcquireSpinLockRaiseToDpc returns. Seeing a KIRQL as a return type there could make me understand (or at least guess) that it returns current IRQL.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing Binary Ninja's reported prototype for KeAcquireSpinLockRaiseToDpc with the corresponding Windows SDK/WDK definition, including its KIRQL return type. Then determine whether the same prototype mismatch affects other platforms or functions; done means the affected prototypes match their SDK/WDK definitions.
Written by the indexing model from the issue text.
Assessment
- Domain
- reverse-engineering
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100