Vector35 / Vector35/binaryninja-api

Mac type libraries have bogus argument names for some functions (__nonnull, __nullable)

Open
#6,566 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Type Libraries Effort: Low Impact: Low
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 5.0.7162-dev (52fd44a8)
  • OS: macOS 15.4
  • CPU Architecture: arm64

Bug Description:
The type libraries for several macOS system frameworks have nullability annotations (__nonnull, __nullable) for argument names. I'm guessing this is an oversight in whatever tooling generates the type libraries not expecting to see these annotations in the SDK headers.

Steps To Reproduce:

  1. Open a macOS 15.x shared cache.
  2. Load ServiceManagement.framework and jump to __create_smd_request.
  3. Switch to HLIL and look at the argument names of the call to AuthorizationMakeExternalForm.
Image

Expected Behavior:
The final argument name should be extForm per the declaration:

mrowe@dragon:~$ rg -A1 'OSStatus AuthorizationMakeExternalForm' $(xcrun --show-sdk-path)/System/Library/
/Applications/Xcode-16.3.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Versions/A/Headers/Authorization.h
375:OSStatus AuthorizationMakeExternalForm(AuthorizationRef authorization,
376-    AuthorizationExternalForm * __nonnull extForm);

You can see the __nonnull annotation that is causing the confusion.

Binary:
This can be seen when loading the macOS 15.4 (24E248) shared cache, but I'd guess it will happen with any Mac or iOS shared cache.

Additional Information:
This shows up with a lot of system frameworks that use CF-style APIs (Security.framework, SystemConfiguration.framework, etc).

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by inspecting the type-library generation path for macOS SDK declarations, using the ServiceManagement.framework example and the Security.framework declaration in Authorization.h. Compare the __create_smd_request HLIL call with AuthorizationMakeExternalForm; done when argument names such as extForm no longer include __nonnull or __nullable across the affected APIs.

Written by the indexing model from the issue text.

Assessment

Tech stack
macos
Domain
operating-systems, reverse-engineering
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.