Vector35 / Vector35/binaryninja-api
Visual clue for non-continuous control flow in the linear view
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
I'm not aware of how binary ninja disassembles a chunk of bytes for x86, but it seems that for a buffer containing more than one instructions "plausible" binary ninja added them without choosing which one to use.
e8d54d0e00 call @__security_check_cookie@4
8be5 mov esp, ebp
5d pop ebp
c3 retn
but this can overlap with
008be55dc3e8 add byte [ebx-0x173ca21b], cl {0xe8c35de8} {0xe8c35de8}
7156 jno 0x1000fa84
Unfortunately I can't share the binary but you should have all the elements needed to understand the root cause. If not please, let me know
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by examining the linear view for the overlapping x86 instruction sequences shown in the issue and compare them with the attached image. Done means the view provides a visual clue when disassembly includes non-continuous or overlapping control flow, without requiring the unavailable binary.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100