Vector35 / Vector35/binaryninja-api
A way to split address-exposed variables that are only assigned indirectly
@rssor is already working on this.
Since Mar 12, 2024.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
I've run into this pattern quite a few times:
What's happening here is that the compiler decided to use the same stack space for the PERFORMANCE_INFORMATION structure (for the K32GetPerformanceInfo() call) and PROCESS_MEMORY_COUNTERS structure (for the first K32GetProcessMemoryInfo() call).
This leads to the confusing stats->os_reported_free = info.CommitLimit assignment, because at that point in the function, the type of info is incorrect.
My first thought was to switch over to MLIL and try to do a split on rdx here:
As I somewhat expected, though, that did nothing.
It would be great if BN would somehow allow me to handle this situation e.g. by making up a fake stack buffer for the first K32GetProcessMemoryInfo() call, assuming such a thing even makes sense in BN's IRs.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.