Vector35 / Vector35/binaryninja-api

Type library for certain std::string::operator+=(char*) has wrong number of arguments

Open
#6,400 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Type Libraries Effort: Low Impact: Medium
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 4.2.6455 free, 2c8da1e
  • OS: fedora
  • OS Version: 40
  • CPU Architecture: x86_64

Bug Description:

Binary Ninja does not properly represent C++'s += operator when acting on short strings.

I'm seeing the decompiled result:

std::string::operator+=(this: &var_68)
std::string::operator+=(this: &var_68)

when I would expect something like:

std::string::operator+=(this: &var_68, "k")
std::string::operator+=(this: &var_68, "car")

Steps To Reproduce:

I've attached a .zip file with my writeup and the offending binary:

issue-with-plus-equals.zip

This comes from this problem from CrackMes.

Note that all .zip files download from this website will have the password crackmes.one.

To reproduce this issue, try to open the crackme binary, and read through the checkPassword function.

Expected Behavior:

Binary Ninja should be able to represent instances where short strings are added to a C++ string object.

Screenshots:

Ghidra gets this correct. Lines 32 and 33 are what I would expect.

Ghidra - Important Section

Binary Ninja does not properly represent this, meaning that the logic is obscured and the challenge is harder to complete.

Binary Ninja

Additional Information:

I'm still learning about Binary Ninja, so it's totally possible I'm doing something wrong.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Open the attached issue-with-plus-equals.zip, then inspect the crackme binary's checkPassword function in Binary Ninja. Compare the two std::string::operator+=(char*) calls with the expected arguments shown in the report; done means short-string additions are represented with their string arguments rather than only the this pointer.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.