Vector35 / Vector35/binaryninja-api

Cannot detect jump table over writable data

Open
#6,115 9 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Core Core: Dataflow Effort: Low Impact: Low
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

For what its worth, I am seeing a similar problem. For myself, its because at the moment of the bctr, the value for the control register cannot be determined. I'm working on the best way I can to broaden the possible values for the submitted control register. In your case, it seems like the r4 register's value may not be able to be determined, while in mine its r0. Without it being able to get a solid for possible reg values, I'm guessing its just gonna assume that the jump table has infinite scope and eat it.

Temporarily resolution: https://github.com/v1X3Q0/jump-table-branch-editor

Captura de pantalla 2024-11-11 a la(s) 5 13 20 p m

For what you can see that in this case, r0 is supposed to be something from index void**[0-7], but binja is considering that the value is undetermined for it.

Captura de pantalla 2024-11-11 a la(s) 5 17 45 p m

Originally posted by @v1X3Q0 in https://github.com/Vector35/binaryninja-api/discussions/2270#discussioncomment-11219294

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the jump-table analysis around the bctr control-register value and the r0/r4 register propagation described in the issue; use the attached case to reproduce it. Done means the analysis bounds the jump table over writable data instead of treating it as having infinite scope, while resolving the relevant possible register values.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.