Vector35 / Vector35/binaryninja-api
Functions are being created for jump tables in code sections
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Version and Platform (required):
- Binary Ninja Version: 5.3.9208-dev Ultimate (8b909a0c)
- Edition: Ultimate
- OS: macOS
- OS Version: 26.3
- CPU Architecture: M1
Bug Description:
It seems Binary Ninja is overwriting jump tables in code sections with functions even though it has correctly identified them as jump tables. The symbol of the function is a data symbol as well.
Steps To Reproduce:
- Open a recent copy of the DYLD Shared Cache with default load settings so
libsystem_c.dylibis loaded automatically. - Wait for initial analysis to complete.
- Go to any of the unnamed functions (beginning with
sub_). - Observe that they all seem to be for jump tables are not actual functions.
Expected Behavior:
Jump tables in code sections shouldn't be overwritten with functions.
Screenshots/Video Recording:
Navigating to the symbol for one of the unnamed functions thats actually a jump table:
Navigate to the reference to the jump table:
It appears the jump table is working correctly as a switch case.
Binary:
DYLD Shared Cache for an iPhone 17 Pro Max running iOS 26.0
Additional Information:
I confirmed the behaviour is exactly the same when running Binary Ninja with plugins disabled.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the report by loading the specified DYLD Shared Cache and inspecting an unnamed sub_ function that is actually a jump table. Trace the analysis path that recognizes jump tables and creates functions, then verify that the data symbol and jump-table contents remain intact without being replaced by a function.
Written by the indexing model from the issue text.
Assessment
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100