Vector35 / Vector35/binaryninja-api

_high_level_il_instruction_is_valid being called with an old instruction index if function body is changed

Open
#7,704 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 5.3.8699-dev Personal (42cbde5c) (but I've met this bug year ago at least)
  • Edition: Non-Commercial

Bug Description:
If you select the token in function and then do something, that makes this token to disappear (for example changing switch-table, thus the functions cfg is shrinking), then when _high_level_il_instruction_is_valid is called, it looks like to use old instruction index on the new IL object, thus there is IndexError is thrown.

Steps To Reproduce:
Please provide all steps required to reproduce the behavior:

  1. Register plugin for high_level_il_instruction
  2. Select token in HLIL
  3. Do something to function, so the token is disappear
  4. Viola, you've got an exception

Expected Behavior:
No exceptions is thrown (logged).

Screenshots/Video Recording:
Image

Additional Information:
Sample plugin i've tested it on:

from binaryninja import BinaryView, HighLevelILInstruction, PluginCommand


def my_plugin(bv: BinaryView, inst: HighLevelILInstruction):
    return


def is_valid(bv: BinaryView, inst: HighLevelILInstruction) -> bool:
    return False


PluginCommand.register_for_high_level_il_instruction(
    "plugin name", "plugin desc", my_plugin, is_valid
)

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading python/plugin.py around _high_level_il_instruction_is_valid and reproduce the failure with the sample high-level IL instruction plugin while changing the function body. Verify that the callback no longer raises IndexError when the selected token disappears and the IL changes.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
devtools, reverse-engineering
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.