Vector35 / Vector35/binaryninja-api

Better workflow for loading and applying the type of an API function

Open
#7,434 2 comments 8 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Type Libraries Effort: Low Impact: Medium Scenario: Malware
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

A very common workflow in malware analysis is to identify API function via hashes (or other ways). Right now, a pain point is that after you identify a specific API function, there is no straightforward way of applying that type to a variable. One would have to 1) find and import the type library, 2) apply the type of the function.

For 1), there is no UI to do it, and we have to do it through the API, which is quite inconvenient. (Python equivalent: type_lib = bv.platform.get_type_libraries_by_name(lib + '.dll')[0]) I would suggest that we add support for it though the typelib browser.

For 2), even if the type library is already imported, we cannot simply press Y and set the type to the API function, e.g., CreateFileA. That is because the type needs to be imported first (Python equivalent: t = bv.import_library_object(name, type_lib)) before it can be used. The next issue I hit is even after the type is imported, I cannot set a variable's type using its name, e..g, I cannot set the type of a variable to CreateFileA -- I know this is because the function types are all named objected rather than types in the type library, though I do not really understand the differences. Another slight inconvenient is that the types in the type library is the type of the function itself, and usually we want a pointer of the type

Related to https://github.com/Vector35/binaryninja-api/issues/3635 and https://github.com/Vector35/debugger/issues/210

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the typelib browser and the type-setting workflow invoked by pressing Y. Review bv.platform.get_type_libraries_by_name and bv.import_library_object to understand library lookup and function-type import, then trace how imported names are resolved for variables. Done means a user can load a library, apply a named API function type, and choose the appropriate pointer form through the UI.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, python
Domain
devtools, reverse-engineering
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.