Vector35 / Vector35/binaryninja-api
Convert the type "pointer to an char array" to char*
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Version and Platform (required):
- Binary Ninja Version: 5.0.7266-dev Ultimate (37487031)
- OS: Debian
- OS Version: trixie
- CPU Architecture: x64
Bug Description:
When marking a stack variable (which is just a byte buffer) as char[0x64], BN has made some questionable choices in HLIL (issue 1) and as a result lifted an access to that buffer as (*(uint800_t*)p)[pn_1 - 1] = 0; in Pseudo C (issue 2) and as (*(p as *mut u100))[pn_1 - 1] = 0; in Pseudo Rust (issue 3).
Not only does the C/Rust semantics not match the underlying byte access (which I suppose is down to incorrect lifting) but also u100 is not even how this type would look like in Rust if it existed, it should be u800!
Steps To Reproduce:
Please provide all steps required to reproduce the behavior:
- Open binary with default settings
- Go to
xgethostbyname - Select
var_98 - Change type to
char[0x64]
Expected Behavior:
Lifted to a byte wide assignment. Also, p should probably be a char* and not char (*)[0x64], which is probably the cause of the incorrect lifting later. While it would be quite interesting to try and track the array bounds through pointer accesses, this seems like it would defy expectations of both tooling and engineers.
Screenshots/Video Recording:
Binary:
ls.zip
Additional Information:
Discovered this while filing https://github.com/Vector35/binaryninja-api/issues/6689.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue in xgethostbyname by selecting var_98 and changing its type to char[0x64], then compare the resulting HLIL, Pseudo C, and Pseudo Rust output. Done means the access is lifted as a byte-wide assignment and p is represented as char* rather than a pointer to the array.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, rust
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100