Vector35 / Vector35/binaryninja-api
VFT functions missing in arm64 PE binaries
Open
Nobody has claimed this yet.
Arch: ARM64
Component: Relocations
Effort: Low
File Format: PE
Impact: Medium
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Version and Platform (required):
- Binary Ninja Version: 3.6.4790-dev, 10b89271
- OS: macos
- OS Version: 14.3
- CPU Architecture: arm64
Steps To Reproduce:
- Load the attached binary into Binary Ninja.
- Navigate to address
1400033e8where vft definitions are located. - See the bug
Screenshots:
Without debug symbols:
Debug symbols loaded:
IDA without debug symbols:
Additional Information:
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Load the attached class_test_arm64.zip binary in Binary Ninja and reproduce the issue at address 1400033e8, comparing the results with the screenshots and IDA's view. Done means the VFT functions are correctly identified in the arm64 PE binary, both without and with debug symbols.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100