Vector35 / Vector35/binaryninja-api

Support changing a variables type in function workflow

Abierto
#7,902 0 comentarios 1 reacción 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Component: Core Core: MLIL Core: Type Propagation Core: Workflow Effort: Medium Impact: High
Lenguaje dominante
C++
Estrellas
1.3k
Forks
298
Merge medio
5 d 5 h
PR fusionados (30 d)
19

Descripción

Currently changing a variables type after core.function.generateMediumLevelIL will result in a partial update of the related variable analysis, this is because the activity core.function.generateMediumLevelIL encompasses too many independent steps, one of which is type propagation, the ideal fix to this is to split up the activity into smaller ones where we can actually place our activity before type propagation and other related steps.

https://github.com/user-attachments/assets/688e433b-1cff-49ec-aaae-c9459d4fdfd2

To reproduce:

  1. Run this python script
ACTIVITY_NAME = "analysis.plugins.changeVar"
ACTIVITY_CONFIG = r'''{
    "name": "analysis.plugins.changeVar",
    "title" : "Change Variable",
    "description": "Blah",
    "eligibility": {
        "auto": { "default": true },
        "runOnce": false
    }
}'''
workflow = Workflow("core.function.metaAnalysis").clone()

def update_vars(analysis_context: AnalysisContext):
    func = analysis_context.function
    if func.start != 0x402d73:
        return
    mlil = analysis_context.mlil
    var = mlil[0].get_var_for_reg_after('eax')
    func_ty = func.view.parse_type_string("int32_t (* eax)(int32_t, int32_t)")[0]
    func.create_auto_var(var, func_ty, "test_var")
    var2 = func.get_variable_by_name('test_var')
    log_info(f"Activity `{ACTIVITY_NAME}` created {var2}")

workflow.register_activity(Activity(
    ACTIVITY_CONFIG,
    action=update_vars
))
workflow.insert_after("core.function.generateMediumLevelIL", ["analysis.plugins.changeVar"])
workflow.register()
  1. Open hyperbolic depth recurses precisely and go to 0x402d8d
  2. Observe that the type of eax in MLIL is correct at instr 0, but the type is not propagated to esi at instr 1

This is quite an unfortunate issue, we should look to address this soon as it is blocking important functionality regarding https://github.com/Vector35/binaryninja-api/issues/6404#issuecomment-2645934691

Marking this as an enhancement, but it could also just as easily be marked as a bug, I don't really see how this could be intended behavior.

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Línea de trabajo

Run the supplied Python workflow against core.function.generateMediumLevelIL and inspect the core.function.metaAnalysis and analysis.plugins.changeVar entry points. Trace the activity ordering around type propagation; done means changing the variable type causes the propagated type to appear on the later MLIL instruction at 0x402d8d.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
cpp, python
Área
backend-api-design, reverse-engineering
Tipo de issue
Nueva funcionalidad
Dificultad
4/5
Tiempo estimado
3-5 días
Estado de actividad
Estancado
Claridad
Bastante claro
Aptitud para principiantes
35/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.