Vector35 / Vector35/binaryninja-api

"Create all members for structure" can create overlapping members

Open
#6,431 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Effort: Medium Impact: Low
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required): 4.3.6893

Bug Description:

"Create all members for structure" feature uses code accesses to the structure to identify and create members. Accesses to overlapping regions in the structure can cause Binja to create structure members that overlap (for example, a 4 byte load from offset 0x4 and a 4 byte load from offset 0x3)

Steps To Reproduce:
Please provide all steps required to reproduce the behavior:

  1. Go to main
  2. Hit S on var_20 and create an empty structure of 0x8 bytes in size
  3. Right click on structure in the type widget and click "Create all members for structure"
  4. Observe how it creates overlapping members and decompilation becomes incorrect because its querying the wrong member

Expected Behavior:

Binja should probably combine the members, or create a union. See the screenshot below that shows the bad decompilation as a result of querying the wrong member. Also notice how member_at_offset returns only one member, despite that there are two members at offset 0x3.

Screenshots/Video Recording:

Image
#include <stdint.h>
#include <stdio.h>

int main(int argc, char **argv)
{
        char foo[8] = {0};
        *(uint32_t *)foo = 0x42424242;
        *(uint32_t *)&foo[3] = 0x43434343;
        return 0;
}

Binary:

V35 employees can search for aunt force refrigerator voyage in Slack

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue in Binary Ninja 4.3.6893 using the listed var_20 structure and the “Create all members for structure” action. Start by tracing that action and the structure-member lookup, then inspect how overlapping accesses and member_at_offset are handled. Done means the reproduced structure no longer causes incorrect decompilation or an inconsistent member lookup.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.