Vector35 / Vector35/binaryninja-api

Pseudo views show differently calculated (and incorrect) addresses for variable compared with HLIL

Open
#6,800 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Core Effort: Medium Impact: Low LanguageRep: Pseudo-C
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Bug Description:
Pseudo-C and Pseudo-Rust show different addresses next to a variable in the example binary above that do not align with HLIL or Disassembly.

Steps To Reproduce:
Just go to the function sub_401332 in the attached binary as an example.

Expected Behavior:
The variable var_c should be associated with the address 0x00401343.

Screenshots/Video Recording:

In this screenshot, you can see that HLIL correctly shows int32_t var_c = 0 associated with address 0x00401343 while Pseudo-C (on top) incorrectly shows the C equivalent as being associated with address 0x00401332:

Image

And, in this screenshot, we can see that Pseudo-Rust shows the same (incorrect) address as Pseudo-C. We can also verify in Disassembly, on the bottom, that the mov [rbp-0x4], 0x0 is at address 0x00401343, which matches HLIL:

Image

Binary:
example_strippted_intel.zip

Additional Information:
Reported by a user in Slack.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the attached example_strippted_intel.zip and inspect function sub_401332 in the Pseudo-C and Pseudo-Rust views alongside HLIL and Disassembly. Trace why var_c is associated with 0x00401332 instead of the expected 0x00401343; done means both pseudo views align with HLIL and the mov instruction address.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, rust
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.