Typedefs in function argument types result in wrong calling convention being used
@plafosse is already working on this.
Since Mar 18, 2025.
Assessment
This issue has not been assessed yet.
Description
Version and Platform (required):
- Binary Ninja Version: 4.3.7007-dev (53778246)
- OS: macOS 15.3.1
- CPU Architecture: arm64
Bug Description:
When analyzing calls to CoreFoundation functions that take typedefs such as CFAbsoluteTime or CFTimeInterval the analysis appears to treat these differently than if they the underlying double type, resulting in incorrect HLIL.
Steps To Reproduce:
- Open a shared cache from macOS 15.3
- Load HIToolbox, wait for analysis to complete, then navigate to
__ZL38PullEventsFromWindowServerOnConnectionjhP17__CFMachPortBoostin HLIL. - Look at the calls to
j__CFRunLoopTimerCreateWithHandlerandj__CFRunLoopTimerSetNextFireDatetowards the end of the function. Note the incorrect computation of the fire date.
- Load CoreFoundation in hopes it sorts out the types.
- Look at the same calls to
j__CFRunLoopTimerCreateWithHandlerandj__CFRunLoopTimerSetNextFireDate. Now the fire date forCFRunLoopTimerCreateWithHandleris also incorrectly computed.
- Use Override Call Type on both calls to change arguments of type
CFTimeIntervalandCFAbsoluteTimetodouble. The computations are now correct!
Here are the definitions of CFTimeInterval and CFAbsoluteTime from the CoreFoundation type library:
typedef double CFTimeInterval;
typedef CFTimeInterval CFAbsoluteTime;
They should be transparent from the point of view of the calling convention and treated identically to double, but are not.
One further point of confusion is that the type for CFRunLoopTimerCreateWithHandler is absent from the CoreFoundation type library. Loading CoreFoundation in step 4 causes Binary Ninja to infer the type signature for it, but it gets it wrong. It goes with:
CFRunLoopTimerRef CFRunLoopTimerCreateWithHandler(CFAllocatorRef, CFAbsoluteTime, CFTimeInterval)
when it should be:
CFRunLoopTimerRef CFRunLoopTimerCreateWithHandler(CFAllocatorRef, CFAbsoluteTime, CFTimeInterval, CFOptionFlags, CFIndex, void (^)(CFRunLoopTimerRef))
If I explicitly set the type of CFRunLoopTimerCreateWithHandler and j__CFRunLoopTimerCreateWithHandler to the correct signature, the problem still occurs. Replacing CFAbsoluteTime and CFTimeInterval with double again fixes the problem.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from Vector35/binaryninja-api
-
Difficulty 1/5 1-3 hours Newbie friendliness 88/100
Vector35/binaryninja-api#8540 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
Vector35/binaryninja-api#8516 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
Vector35/binaryninja-api#8503 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
Vector35/binaryninja-api#8446 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
Vector35/binaryninja-api#8444 ·
All issues in Vector35/binaryninja-api
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
-
Sensor initialization takes very long when `--initial-sim-time` is set to current UNIX timestamp Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
gazebosim/gz-sensors#662 · 1 comment ·
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
comp-datalake
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
ClickHouse/ClickHouse#121222 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
LadybirdBrowser/ladybird#12123 ·