Vector35 / Vector35/binaryninja-api
Cannot detect jump table over writable data
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
For what its worth, I am seeing a similar problem. For myself, its because at the moment of the bctr, the value for the control register cannot be determined. I'm working on the best way I can to broaden the possible values for the submitted control register. In your case, it seems like the r4 register's value may not be able to be determined, while in mine its r0. Without it being able to get a solid for possible reg values, I'm guessing its just gonna assume that the jump table has infinite scope and eat it.
Temporarily resolution: https://github.com/v1X3Q0/jump-table-branch-editor
For what you can see that in this case, r0 is supposed to be something from index void**[0-7], but binja is considering that the value is undetermined for it.
Originally posted by @v1X3Q0 in https://github.com/Vector35/binaryninja-api/discussions/2270#discussioncomment-11219294
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the jump-table analysis around the bctr control-register value and the r0/r4 register propagation described in the issue; use the attached case to reproduce it. Done means the analysis bounds the jump table over writable data instead of treating it as having infinite scope, while resolving the relevant possible register values.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100