Vector35 / Vector35/binaryninja-api
Type library for certain std::string::operator+=(char*) has wrong number of arguments
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Version and Platform (required):
- Binary Ninja Version: 4.2.6455 free, 2c8da1e
- OS: fedora
- OS Version: 40
- CPU Architecture: x86_64
Bug Description:
Binary Ninja does not properly represent C++'s += operator when acting on short strings.
I'm seeing the decompiled result:
std::string::operator+=(this: &var_68)
std::string::operator+=(this: &var_68)
when I would expect something like:
std::string::operator+=(this: &var_68, "k")
std::string::operator+=(this: &var_68, "car")
Steps To Reproduce:
I've attached a .zip file with my writeup and the offending binary:
This comes from this problem from CrackMes.
Note that all .zip files download from this website will have the password crackmes.one.
To reproduce this issue, try to open the crackme binary, and read through the checkPassword function.
Expected Behavior:
Binary Ninja should be able to represent instances where short strings are added to a C++ string object.
Screenshots:
Ghidra gets this correct. Lines 32 and 33 are what I would expect.
Binary Ninja does not properly represent this, meaning that the logic is obscured and the challenge is harder to complete.
Additional Information:
I'm still learning about Binary Ninja, so it's totally possible I'm doing something wrong.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Open the attached issue-with-plus-equals.zip, then inspect the crackme binary's checkPassword function in Binary Ninja. Compare the two std::string::operator+=(char*) calls with the expected arguments shown in the report; done means short-string additions are represented with their string arguments rather than only the this pointer.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100