Vector35 / Vector35/binaryninja-api
Function calls missing args for functions with defined arguments on QNX PPC
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Version and Platform (required):
- Binary Ninja Version: 4.2.6455-Stable
- OS: Ubuntu
- OS Version: 22.04.5
- CPU Architecture: AMD64
Bug Description:
Looking at PPCBE QNX binaries, will often see a function call that has a
complete and correct signature in the .plt section. Occasionally in the
binary, calls to this function will not have the correct number of arguments.
libsnmp.so.1 from exhibits this problem several times in the snmp_open
function.
I often use the "Override Call Type..." feature to force binaj to show the
call with the correct number of arguments.
Also, the "Override Call Type..." GUI default signature is very vanilla. It
is always:
void calltarget()
Would be more helpful to start with the current function signature (that the
user is tyring to change), or the function signature of the target function.
Steps To Reproduce:
- Load PPCBE QNX binary.
- Goto the .plt section, and look for pretty standard libc functions
- Look at callrefs to function with known signatures and see that some have
decompilation with missing params
Expected Behavior:
Expected function signature shown for function in .plt section to be the same
as the decompiler shows for calls to the function
Screenshots/Video Recording:
Binary:
Sent binary via slack posting
Additional Information:
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by loading the supplied PPCBE QNX binary and inspect the .plt entry for snmp_open alongside its call references and decompiler output. Compare the target signature with the arguments shown at each call, then inspect the Override Call Type dialog's default signature. Done means calls consistently show the defined argument list and the dialog offers a relevant existing signature.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100