Vector35 / Vector35/binaryninja-api
Type propagation through DataVariables/got entries
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Version and Platform (required):
- Binary Ninja Version: 3.6.4790-dev, 10b89271
- OS: macos
- OS Version: 14.3
- CPU Architecture: arm64
Bug Description:
I did not deep dive into the clang internals of handling of the classes but looks like it decides to handle public member functions as exported function. BN creates export and import entries for member functions but it fails when propagating the function type from exported one to imported one.
In the example below Animal::eat, Animal::sleep and Dog::bark should have at least one parameter which is class itself but all of them are missing that.
When I check those functions (not the import entries) they are defined like:
int64_t `Dog::bark`()
int64_t `Animal::eat`(void* arg1)
int64_t `Animal::sleep`(void* arg1)
So BN detected eat and sleep have at least one parameter (it did because those functions references arg1) but it did missed the bark.
When I check got section this is what I got:
So the right side functions (at least eat and sleep) have a parameter for class itself but this does not reflected to the left side which is import entry I guess. Left side functions looks like this:
I expect BN to propagate those types correctly.
Steps To Reproduce:
Binary is attached, just open it in BN.
Additional Information:
classtest.zip
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Open the attached classtest.zip in Binary Ninja and inspect the DataVariables and got entries for Animal::eat, Animal::sleep, and Dog::bark. Compare the imported and exported function types, focusing on propagation of the class parameter. Done means the import entries reflect the parameters detected on the corresponding functions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100