Vector35 / Vector35/binaryninja-api

Functions are being created for jump tables in code sections

Open
#7,992 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Impact: Low
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 5.3.9208-dev Ultimate (8b909a0c)
  • Edition: Ultimate
  • OS: macOS
  • OS Version: 26.3
  • CPU Architecture: M1

Bug Description:
It seems Binary Ninja is overwriting jump tables in code sections with functions even though it has correctly identified them as jump tables. The symbol of the function is a data symbol as well.

Steps To Reproduce:

  1. Open a recent copy of the DYLD Shared Cache with default load settings so libsystem_c.dylib is loaded automatically.
  2. Wait for initial analysis to complete.
  3. Go to any of the unnamed functions (beginning with sub_).
  4. Observe that they all seem to be for jump tables are not actual functions.

Expected Behavior:
Jump tables in code sections shouldn't be overwritten with functions.

Screenshots/Video Recording:

Navigating to the symbol for one of the unnamed functions thats actually a jump table:

Image

Navigate to the reference to the jump table:

Image

It appears the jump table is working correctly as a switch case.

Binary:
DYLD Shared Cache for an iPhone 17 Pro Max running iOS 26.0

Additional Information:
I confirmed the behaviour is exactly the same when running Binary Ninja with plugins disabled.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the report by loading the specified DYLD Shared Cache and inspecting an unnamed sub_ function that is actually a jump table. Trace the analysis path that recognizes jump tables and creates functions, then verify that the data symbol and jump-table contents remain intact without being replaced by a function.

Written by the indexing model from the issue text.

Assessment

Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.