Vector35 / Vector35/binaryninja-api

Structure fields not recognized in an array of structures

Open
#5,376 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Core Core: MLIL Effort: Low Impact: Medium
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 4.0.4958, ddff9339
  • OS: macos
  • OS Version: 14.4
  • CPU Architecture: arm64

Internal binary major dine favor.

I'm getting pretty bad output from BN and it's not letting me tweak it. For example, that 0x145e4c is the second field in the structure. And I don't understand why it's trying to grab series1 and x1_5 as 64-bit ints instead of splitting them into separate structure field accesses.

00099c68          if (PAYLOAD_NEGOTIATE_PARAM_CONFIG_LIST[sx.q(ix)].series == series && *(sx.q(ix) * 0x14 + 0x145e4c) == mount_pos_type)
00099cac              int64_t ix_1 = sx.q(ix)
00099ccc              int64_t series_1 = PAYLOAD_NEGOTIATE_PARAM_CONFIG_LIST[ix_1].series.q
00099ccc              int64_t x1_5 = PAYLOAD_NEGOTIATE_PARAM_CONFIG_LIST[ix_1].no_negotiate_flag.q
00099cd0              config->series = series_1.d
00099cd0              config->mount_pos_type = series_1:4.d
00099cd0              config->no_negotiate_flag = x1_5.d
00099cd0              config->sender = x1_5:4.b
00099cd0              config->receiver = x1_5:5.b
00099cd0              config->field5 = x1_5:6.w
00099cd8              config->field6.d = PAYLOAD_NEGOTIATE_PARAM_CONFIG_LIST[ix_1].field_6
00099cdc              x0_1 = 0
00099ce0              break

Both of series1 and x1_5 are picking up data from the same structure and should be automatically split into several field accesses instead. PAYLOAD_NEGOTIATE_PARAM_CONFIG_LIST is an array of structures that looks like this

00145e48  struct PayloadNegotiateParamConfig PAYLOAD_NEGOTIATE_PARAM_CONFIG_LIST[0x9] = 
00145e48  {
00145e48      [0x0] = 
00145e48      {
00145e48          enum E_DjiAircraftSeries series = DJI_AIRCRAFT_SERIES_M300
00145e4c          enum E_DjiMountPositionType mount_pos_type = DJI_MOUNT_POSITION_TYPE_PAYLOAD_PORT
00145e50          uint32_t no_negotiate_flag = 0x0
00145e54          uint8_t sender = 0x13
00145e55          uint8_t receiver = 0x34
00145e56          uint16_t field_5 = 0x9
00145e58          uint32_t field_6 = 0x2710
00145e5c      },
...

Let me know if I should upload my database somewhere.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The report names no source file, test, or entry point. Start by reproducing the output with Binary Ninja 4.0.4958 on macOS 14.4/arm64 using the shown PAYLOAD_NEGOTIATE_PARAM_CONFIG_LIST array and inspect the structure-field accesses. Done means the listed fields are represented separately rather than combined into 64-bit values.

Written by the indexing model from the issue text.

Assessment

Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.