Vector35 / Vector35/binaryninja-api

Incorrect stack adjustment calculated for function

Open
#7,669 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Core Core: MLIL Effort: Low Impact: Medium
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 5.2.8614
  • Edition: Ultimate
  • OS: macOS
  • OS Version: 15.5
  • CPU Architecture: M1

Bug Description:
The stack adjustment on this function should be trivial to calculate but is being resolved with an incorrect value.
Image

Stack offset of 8 on exit, subtract 4 for the return address, so it should be 4. But it is calculated as 0, confidence 255, and all callers of this function have mismatched stack pointers.

Steps To Reproduce:

  1. Open this binary: Archive.zip
  2. Navigate to Dog::Dog (0x00401ee0)
  3. Python:
>>> current_function.stack_adjustment
OffsetWithConfidence(value=0, confidence=255)
  1. Observe stack frame offset in LLIL and see that it really shouldn't be 0
  2. Observe call site at _main (0x0040626a) and see that the stack misaligns right after the branches join

Expected Behavior:
I expected the stack offsets to resolve properly

Additional Information:
Seems like this is MLIL's doing? Quick step through in the debugger shows that StackAdjustmentResolver gets 4 as its estimate, but MLIL translator ignores that and goes with 0 instead.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue with Archive.zip at Dog::Dog (0x00401ee0), then inspect StackAdjustmentResolver and the MLIL translator, comparing the resolver estimate with the translated stack offset. Check the LLIL frame offset and the call site in _main (0x0040626a). Done means the function reports a stack adjustment of 4 and callers no longer have mismatched stack pointers.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers, reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.