Vector35 / Vector35/binaryninja-api

Switch case has case values from jump table

Open
#7,168 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Core Effort: Medium Impact: Medium
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 5.1.7972-dev
  • Edition: Commercial
  • OS: Windows
  • OS Version: 11
  • CPU Architecture: x64

Bug Description:
Sometimes Binary ninja failed to resolve jump tables, that give result like it.
Image

It's actually switch on enum, but cases is seems like address of jump table.
This executable uses LLVM to compile, so I don't know maybe it mean.

Steps To Reproduce:
Please provide all steps required to reproduce the behavior:

  1. Go to 0x14859f696

Binary:
Already was send for another issue. It's quite large.
https://github.com/Vector35/binaryninja-api/issues/6848#issuecomment-2992642363

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Open the linked Binary Ninja issue and use the supplied executable, then navigate to 0x14859f696 as described. Compare the switch-on-enum interpretation with the jump-table case values and determine whether the table is being resolved incorrectly; done means the switch cases are represented as enum values rather than jump-table addresses.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.