Vector35 / Vector35/binaryninja-api
Incorrect stack adjustment calculated for function
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Version and Platform (required):
- Binary Ninja Version: 5.2.8614
- Edition: Ultimate
- OS: macOS
- OS Version: 15.5
- CPU Architecture: M1
Bug Description:
The stack adjustment on this function should be trivial to calculate but is being resolved with an incorrect value.
Stack offset of 8 on exit, subtract 4 for the return address, so it should be 4. But it is calculated as 0, confidence 255, and all callers of this function have mismatched stack pointers.
Steps To Reproduce:
- Open this binary: Archive.zip
- Navigate to
Dog::Dog(0x00401ee0) - Python:
>>> current_function.stack_adjustment
OffsetWithConfidence(value=0, confidence=255)
- Observe stack frame offset in LLIL and see that it really shouldn't be 0
- Observe call site at
_main(0x0040626a) and see that the stack misaligns right after the branches join
Expected Behavior:
I expected the stack offsets to resolve properly
Additional Information:
Seems like this is MLIL's doing? Quick step through in the debugger shows that StackAdjustmentResolver gets 4 as its estimate, but MLIL translator ignores that and goes with 0 instead.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue with Archive.zip at Dog::Dog (0x00401ee0), then inspect StackAdjustmentResolver and the MLIL translator, comparing the resolver estimate with the translated stack offset. Check the LLIL frame offset and the call site in _main (0x0040626a). Done means the function reports a stack adjustment of 4 and callers no longer have mismatched stack pointers.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers, reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100