Vector35 / Vector35/binaryninja-api

A way to split address-exposed variables that are only assigned indirectly

Open
#5,154 1 comment 2 reactions 1 assignee View on GitHub

@rssor is already working on this.

Since Mar 12, 2024.

Component: Core Effort: High Impact: Medium
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

I've run into this pattern quite a few times:

image
image

What's happening here is that the compiler decided to use the same stack space for the PERFORMANCE_INFORMATION structure (for the K32GetPerformanceInfo() call) and PROCESS_MEMORY_COUNTERS structure (for the first K32GetProcessMemoryInfo() call).

This leads to the confusing stats->os_reported_free = info.CommitLimit assignment, because at that point in the function, the type of info is incorrect.

My first thought was to switch over to MLIL and try to do a split on rdx here:

image

As I somewhat expected, though, that did nothing.

It would be great if BN would somehow allow me to handle this situation e.g. by making up a fake stack buffer for the first K32GetProcessMemoryInfo() call, assuming such a thing even makes sense in BN's IRs.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.