Vector35 / Vector35/binaryninja-api
Split Variable at Definition is unreliable with stack variables
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Version and Platform (required):
- Binary Ninja Version: 5.1.7913-dev
- Edition: Non-Commercial
- OS: macOS
- OS Version: 15
- CPU Architecture: x64
Bug Description:
Splitting stack variables doesn't seem to work reliably. Many times it will only create a new variable at the current assignment, with all other references are stuck at the original variable. And since non-assignment references can't be split, there seems to be no way to fix this.
See below for a sample.
Steps To Reproduce:
Please provide all steps required to reproduce the behavior:
- Load the database provided below.
- Right click on
var_948at 0xc20 and select "Split Variable at Definition". - Reply "Yes" to the warning that "This variable appears to have dependencies that prevent it from being split safely."
- The assignment now becomes
var_948_1but no other references tovar_948are updated, for example the one at 0xc40.
Expected Behavior:
I'd expect (at least some) subsequent references to var_948 now refer to var_948_1.
Screenshots/Video Recording:
n/a
Binary:
See proud castle paints happily.
Additional Information:
These might be enhancements, but two things that would help here are:
- Some way to see the "dependencies that prevent [a variable] from being split safely." I tried to look at the MLIL and HLIL debug reports, but there's no way to search for
var_948in the graphs, so I couldn't see if they might have helped. - The ability to specify a scope for the redefinition. This may ultimately be a special case of UDIF that is needed to help the decompiler automatically detect the scope, in which case the above would help me figure out what variables I need to clarify. On the other hand, this might be an enhancement to splitting: rather than split all following references, split only the references that can only be reached following this assignment.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Load the database described in the issue and reproduce the "Split Variable at Definition" action on var_948 at 0xc20, then compare references such as the one at 0xc40. Start by examining the decompiler's variable-splitting and dependency handling; done means eligible subsequent references use var_948_1 while unsafe references remain justified and covered by regression testing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100