Vector35 / Vector35/binaryninja-api

Type propagation through DataVariables/got entries

Open
#4,958 1 comment 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Core Effort: Medium Impact: Medium
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 3.6.4790-dev, 10b89271
  • OS: macos
  • OS Version: 14.3
  • CPU Architecture: arm64

Bug Description:
I did not deep dive into the clang internals of handling of the classes but looks like it decides to handle public member functions as exported function. BN creates export and import entries for member functions but it fails when propagating the function type from exported one to imported one.

In the example below Animal::eat, Animal::sleep and Dog::bark should have at least one parameter which is class itself but all of them are missing that.

When I check those functions (not the import entries) they are defined like:

int64_t `Dog::bark`()
int64_t `Animal::eat`(void* arg1)
int64_t `Animal::sleep`(void* arg1)

So BN detected eat and sleep have at least one parameter (it did because those functions references arg1) but it did missed the bark.

When I check got section this is what I got:

So the right side functions (at least eat and sleep) have a parameter for class itself but this does not reflected to the left side which is import entry I guess. Left side functions looks like this:

I expect BN to propagate those types correctly.

Steps To Reproduce:
Binary is attached, just open it in BN.

Additional Information:
classtest.zip

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Open the attached classtest.zip in Binary Ninja and inspect the DataVariables and got entries for Animal::eat, Animal::sleep, and Dog::bark. Compare the imported and exported function types, focusing on propagation of the class parameter. Done means the import entries reflect the parameters detected on the corresponding functions.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.