Vector35 / Vector35/binaryninja-api
Allow heuristic creation of jump table in writable sections
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Version and Platform (required):
- Binary Ninja Version: [e.g. 4.0.5336]
- OS: Windows
- OS Version: 10
- CPU Architecture: x64
Bug Description:
Jump table not detected on sample prog1.vmp.exe https://github.com/avast/retdec/issues/1155
prog1.vmp.exe.zip
Steps To Reproduce:
Open sample and go to 0x1401b203f
Expected Behavior:
(after manually adding ranges):
Additional notes
Manually adding user defined ranges as per https://www.lodsb.com/reversing-complex-jumptables-in-binary-ninja resolves the problem so I assume this is an edge case in jump table detection. At this line:
148 @ 1401af09e rcx_1 = [&data_1401b0456 + (rax << 3)].q
rax is correctly detected as being an unsigned range from 0:0x100 but rcx_1 is undefined
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue by opening prog1.vmp.exe and navigating to 0x1401b203f, then inspect the jump-table detection around the shown indirect lookup at 0x1401af09e. Compare the result with manually added user-defined ranges; done means the heuristic detects the jump table in the writable section without manual ranges.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100