Changing a function type does not trigger re-analysis for functions which call the changed function through a function pointer as a data variable
Nessuno ha ancora preso questa issue.
Valutazione
- Difficoltà
- 4/5
- Tempo stimato
- 3-5 giorni
- Idoneità per principianti
- 35/100
- Tipo di issue
- Bug
- Chiarezza
- Abbastanza chiara
- Stato di attività
- Ferma
- Stack tecnologico
- cpp, objective-c
- Ambito
- reverse-engineering
Direzione di ricerca
Start with the modified Objective-C workflow plugin and the external-symbol path that creates a data variable with a function-pointer type. Reproduce the prototype change, then compare automatic behavior with Reanalyze Current Function; done means callers using the symbol are re-analyzed and their assigned return-value types update without manual intervention.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Descrizione
Version and Platform (required):
- Binary Ninja Version: 4.3.6550-dev (1ae64a95)
- OS: macOS
- OS Version: 15.1.1
- CPU Architecture: M1
Bug Description:
I have a situation where I'm creating external symbols that have a type thats a pointer to a function. Modifying that prototype to change the return value type is not causing the functions, that make a call using the external symbol, to run re-analysis. If I right-click Reanalyze Current Function then the variable being assigned the return value is updated to have a type that corresponds to the new return type of the external symbol. This is what I would expect to happen but without me having to manually do the right-click Reanalyze Current Function.
Its a bit of a weird scenario because I've basically modified the Objective-C workflow plugin to create external symbols, in a new section that doesn't exist in the binary, and replace the objc_msgSend call with a call to the external symbol. The external symbol once created has a data variable defined at its location with a function pointer type. The section, symbols and data variables are invisible in the UI, I believe due to #6132. I'm doubtful thats anything to do with it because its a UI issue and I'd imagine thats separate to the analysis engine that triggers re-analysis, but thought I'd mention it.
The reason for the creation of the external symbols is to handle objc_msgSend call inlining more eloquently. Currently the plugin just chooses the first Objective-C function with a matching selector as the actual target for the call. This is wrong alot of the time. I've modified the plugin to behave more like IDA does, which is to look at the type or symbol name (for Objective-C classes) for the self parameter and to use that combined with the selector to more accurately identify the target function. If the target function does not appear to exist in the binary, IDA will create an external symbol and then reference that symbol at the call site. I've essentially implemented the same feature in Binary Ninja, except now I've uncovered the issue that if I modify the function prototype of the external symbol, re-analysis for callers of the symbol, where the call has been inlined from another function, won't be triggered.
- Lingua principale
- C++
- Stelle
- 1.3k
- Fork
- 298
- Merge medio
- 5g 5h
- PR unite (30g)
- 19
Guida per i contributori
Nessuna guida per i contributori indicizzata per questo repository
Come iniziare
- Leggi tutta la issue e poi la guida ai contributi del progetto.
- Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
- Fai un fork del repository e lavora su un branch.
- Apri una pull request che faccia riferimento al numero della issue.
Altre issue di Vector35/binaryninja-api
-
Difficoltà 1/5 1-3 ore Idoneità per principianti 88/100
Vector35/binaryninja-api#8540 ·
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 88/100
Vector35/binaryninja-api#8516 ·
-
Difficoltà 1/5 Meno di un'ora Idoneità per principianti 92/100
Vector35/binaryninja-api#8503 ·
-
Difficoltà 1/5 Meno di un'ora Idoneità per principianti 88/100
Vector35/binaryninja-api#8446 ·
-
Difficoltà 1/5 Meno di un'ora Idoneità per principianti 88/100
Vector35/binaryninja-api#8444 ·
Tutte le issue di Vector35/binaryninja-api
Issue simili
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 86/100
-
Sensor initialization takes very long when `--initial-sim-time` is set to current UNIX timestamp Aperta
Difficoltà 2/5 1-3 ore Idoneità per principianti 78/100
gazebosim/gz-sensors#662 · 1 commento ·
-
enhancement
Difficoltà 2/5 1-3 ore Idoneità per principianti 76/100
-
comp-datalake
Difficoltà 2/5 1-3 ore Idoneità per principianti 88/100
ClickHouse/ClickHouse#121222 ·
-
Difficoltà 2/5 1-3 ore Idoneità per principianti 68/100
LadybirdBrowser/ladybird#12123 ·