Vector35 / Vector35/binaryninja-api

Convert the type "pointer to an char array" to char*

Open
#6,690 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Core Effort: Low Impact: Low
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 5.0.7266-dev Ultimate (37487031)
  • OS: Debian
  • OS Version: trixie
  • CPU Architecture: x64

Bug Description:
When marking a stack variable (which is just a byte buffer) as char[0x64], BN has made some questionable choices in HLIL (issue 1) and as a result lifted an access to that buffer as (*(uint800_t*)p)[pn_1 - 1] = 0; in Pseudo C (issue 2) and as (*(p as *mut u100))[pn_1 - 1] = 0; in Pseudo Rust (issue 3).

Not only does the C/Rust semantics not match the underlying byte access (which I suppose is down to incorrect lifting) but also u100 is not even how this type would look like in Rust if it existed, it should be u800!

Steps To Reproduce:
Please provide all steps required to reproduce the behavior:

  1. Open binary with default settings
  2. Go to xgethostbyname
  3. Select var_98
  4. Change type to char[0x64]

Expected Behavior:
Lifted to a byte wide assignment. Also, p should probably be a char* and not char (*)[0x64], which is probably the cause of the incorrect lifting later. While it would be quite interesting to try and track the array bounds through pointer accesses, this seems like it would defy expectations of both tooling and engineers.

Screenshots/Video Recording:

Image Image

Image Image

Binary:
ls.zip

Additional Information:
Discovered this while filing https://github.com/Vector35/binaryninja-api/issues/6689.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue in xgethostbyname by selecting var_98 and changing its type to char[0x64], then compare the resulting HLIL, Pseudo C, and Pseudo Rust output. Done means the access is lifted as a byte-wide assignment and p is represented as char* rather than a pointer to the array.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, rust
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.