Vector35 / Vector35/binaryninja-api
Mac type libraries have bogus argument names for some functions (__nonnull, __nullable)
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Version and Platform (required):
- Binary Ninja Version: 5.0.7162-dev (52fd44a8)
- OS: macOS 15.4
- CPU Architecture: arm64
Bug Description:
The type libraries for several macOS system frameworks have nullability annotations (__nonnull, __nullable) for argument names. I'm guessing this is an oversight in whatever tooling generates the type libraries not expecting to see these annotations in the SDK headers.
Steps To Reproduce:
- Open a macOS 15.x shared cache.
- Load ServiceManagement.framework and jump to
__create_smd_request. - Switch to HLIL and look at the argument names of the call to
AuthorizationMakeExternalForm.
Expected Behavior:
The final argument name should be extForm per the declaration:
mrowe@dragon:~$ rg -A1 'OSStatus AuthorizationMakeExternalForm' $(xcrun --show-sdk-path)/System/Library/
/Applications/Xcode-16.3.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Versions/A/Headers/Authorization.h
375:OSStatus AuthorizationMakeExternalForm(AuthorizationRef authorization,
376- AuthorizationExternalForm * __nonnull extForm);
You can see the __nonnull annotation that is causing the confusion.
Binary:
This can be seen when loading the macOS 15.4 (24E248) shared cache, but I'd guess it will happen with any Mac or iOS shared cache.
Additional Information:
This shows up with a lot of system frameworks that use CF-style APIs (Security.framework, SystemConfiguration.framework, etc).
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by inspecting the type-library generation path for macOS SDK declarations, using the ServiceManagement.framework example and the Security.framework declaration in Authorization.h. Compare the __create_smd_request HLIL call with AuthorizationMakeExternalForm; done when argument names such as extForm no longer include __nonnull or __nullable across the affected APIs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- macos
- Domain
- operating-systems, reverse-engineering
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100