Vector35 / Vector35/binaryninja-api

Support changing a variables type in function workflow

Open
#7,902 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Component: Core Core: MLIL Core: Type Propagation Core: Workflow Effort: Medium Impact: High
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Currently changing a variables type after core.function.generateMediumLevelIL will result in a partial update of the related variable analysis, this is because the activity core.function.generateMediumLevelIL encompasses too many independent steps, one of which is type propagation, the ideal fix to this is to split up the activity into smaller ones where we can actually place our activity before type propagation and other related steps.

https://github.com/user-attachments/assets/688e433b-1cff-49ec-aaae-c9459d4fdfd2

To reproduce:

  1. Run this python script
ACTIVITY_NAME = "analysis.plugins.changeVar"
ACTIVITY_CONFIG = r'''{
    "name": "analysis.plugins.changeVar",
    "title" : "Change Variable",
    "description": "Blah",
    "eligibility": {
        "auto": { "default": true },
        "runOnce": false
    }
}'''
workflow = Workflow("core.function.metaAnalysis").clone()

def update_vars(analysis_context: AnalysisContext):
    func = analysis_context.function
    if func.start != 0x402d73:
        return
    mlil = analysis_context.mlil
    var = mlil[0].get_var_for_reg_after('eax')
    func_ty = func.view.parse_type_string("int32_t (* eax)(int32_t, int32_t)")[0]
    func.create_auto_var(var, func_ty, "test_var")
    var2 = func.get_variable_by_name('test_var')
    log_info(f"Activity `{ACTIVITY_NAME}` created {var2}")

workflow.register_activity(Activity(
    ACTIVITY_CONFIG,
    action=update_vars
))
workflow.insert_after("core.function.generateMediumLevelIL", ["analysis.plugins.changeVar"])
workflow.register()
  1. Open hyperbolic depth recurses precisely and go to 0x402d8d
  2. Observe that the type of eax in MLIL is correct at instr 0, but the type is not propagated to esi at instr 1

This is quite an unfortunate issue, we should look to address this soon as it is blocking important functionality regarding https://github.com/Vector35/binaryninja-api/issues/6404#issuecomment-2645934691

Marking this as an enhancement, but it could also just as easily be marked as a bug, I don't really see how this could be intended behavior.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Run the supplied Python workflow against core.function.generateMediumLevelIL and inspect the core.function.metaAnalysis and analysis.plugins.changeVar entry points. Trace the activity ordering around type propagation; done means changing the variable type causes the propagated type to appear on the later MLIL instruction at 0x402d8d.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, python
Domain
backend-api-design, reverse-engineering
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.