Vector35 / Vector35/binaryninja-api
"Create all members for structure" can create overlapping members
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Version and Platform (required): 4.3.6893
Bug Description:
"Create all members for structure" feature uses code accesses to the structure to identify and create members. Accesses to overlapping regions in the structure can cause Binja to create structure members that overlap (for example, a 4 byte load from offset 0x4 and a 4 byte load from offset 0x3)
Steps To Reproduce:
Please provide all steps required to reproduce the behavior:
- Go to
main - Hit
Sonvar_20and create an empty structure of 0x8 bytes in size - Right click on structure in the type widget and click "Create all members for structure"
- Observe how it creates overlapping members and decompilation becomes incorrect because its querying the wrong member
Expected Behavior:
Binja should probably combine the members, or create a union. See the screenshot below that shows the bad decompilation as a result of querying the wrong member. Also notice how member_at_offset returns only one member, despite that there are two members at offset 0x3.
Screenshots/Video Recording:
#include <stdint.h>
#include <stdio.h>
int main(int argc, char **argv)
{
char foo[8] = {0};
*(uint32_t *)foo = 0x42424242;
*(uint32_t *)&foo[3] = 0x43434343;
return 0;
}
Binary:
V35 employees can search for aunt force refrigerator voyage in Slack
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue in Binary Ninja 4.3.6893 using the listed var_20 structure and the “Create all members for structure” action. Start by tracing that action and the structure-member lookup, then inspect how overlapping accesses and member_at_offset are handled. Done means the reproduced structure no longer causes incorrect decompilation or an inconsistent member lookup.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100