Vector35 / Vector35/binaryninja-api

Function calls missing args for functions with defined arguments on QNX PPC

Open
#6,312 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Platform Effort: Low File Format: ELF Impact: Medium State: Blocked (Issue)
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 4.2.6455-Stable
  • OS: Ubuntu
  • OS Version: 22.04.5
  • CPU Architecture: AMD64

Bug Description:

Looking at PPCBE QNX binaries, will often see a function call that has a
complete and correct signature in the .plt section. Occasionally in the
binary, calls to this function will not have the correct number of arguments.

libsnmp.so.1 from exhibits this problem several times in the snmp_open
function.

I often use the "Override Call Type..." feature to force binaj to show the
call with the correct number of arguments.

Also, the "Override Call Type..." GUI default signature is very vanilla. It
is always:

void calltarget()

Would be more helpful to start with the current function signature (that the
user is tyring to change), or the function signature of the target function.

Steps To Reproduce:

  1. Load PPCBE QNX binary.
  2. Goto the .plt section, and look for pretty standard libc functions
  3. Look at callrefs to function with known signatures and see that some have
    decompilation with missing params

Expected Behavior:

Expected function signature shown for function in .plt section to be the same
as the decompiler shows for calls to the function

Screenshots/Video Recording:
image

Binary:

Sent binary via slack posting

Additional Information:

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by loading the supplied PPCBE QNX binary and inspect the .plt entry for snmp_open alongside its call references and decompiler output. Compare the target signature with the arguments shown at each call, then inspect the Override Call Type dialog's default signature. Done means calls consistently show the defined argument list and the dialog offers a relevant existing signature.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.