Vector35 / Vector35/binaryninja-api

No branch created despite that the jump variable has LookUpTableValue due to incorrect size of the jump table data variable

Open
#7,260 5 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Core Effort: Medium Impact: Medium Scenario: Malware
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Binary: balanced mist remains quietly, address: 0x1f59b0

It can be seen that the expression for the jump target has LookupTableValue, but no branches are created for it:

Image

This might have the same root cause as https://github.com/Vector35/binaryninja-api/issues/6979

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue with the binary balanced mist remains quietly at address 0x1f59b0, then compare the behavior with the suspected root cause in issue #6979. Done means the jump target expression no longer has the reported missing branches when its jump-table data variable has the correct size.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.