Vector35 / Vector35/binaryninja-api

Functions are being created for jump tables in code sections

Offen
#7,992 3 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Dieses Issue hat noch niemand übernommen.

Impact: Low
Vorherrschende Sprache
C++
Sterne
1.3k
Forks
298
Ø Merge
5 T. 5 Std.
Gemergte PRs (30 T.)
19

Beschreibung

Version and Platform (required):

  • Binary Ninja Version: 5.3.9208-dev Ultimate (8b909a0c)
  • Edition: Ultimate
  • OS: macOS
  • OS Version: 26.3
  • CPU Architecture: M1

Bug Description:
It seems Binary Ninja is overwriting jump tables in code sections with functions even though it has correctly identified them as jump tables. The symbol of the function is a data symbol as well.

Steps To Reproduce:

  1. Open a recent copy of the DYLD Shared Cache with default load settings so libsystem_c.dylib is loaded automatically.
  2. Wait for initial analysis to complete.
  3. Go to any of the unnamed functions (beginning with sub_).
  4. Observe that they all seem to be for jump tables are not actual functions.

Expected Behavior:
Jump tables in code sections shouldn't be overwritten with functions.

Screenshots/Video Recording:

Navigating to the symbol for one of the unnamed functions thats actually a jump table:

Image

Navigate to the reference to the jump table:

Image

It appears the jump table is working correctly as a switch case.

Binary:
DYLD Shared Cache for an iPhone 17 Pro Max running iOS 26.0

Additional Information:
I confirmed the behaviour is exactly the same when running Binary Ninja with plugins disabled.

Beitragsleitfaden

Für dieses Repository ist kein Beitragsleitfaden indexiert

Erste Schritte

  1. Lies das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreib ins Issue, dass du es übernimmst — das erspart doppelte Arbeit.
  3. Forke das Repository und arbeite in einem Branch.
  4. Öffne einen Pull Request, der die Issue-Nummer nennt.

Rechercherichtung

Reproduce the report by loading the specified DYLD Shared Cache and inspecting an unnamed sub_ function that is actually a jump table. Trace the analysis path that recognizes jump tables and creates functions, then verify that the data symbol and jump-table contents remain intact without being replaced by a function.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Bereich
reverse-engineering
Issue-Typ
Bug
Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Aktivitätsstatus
Veraltet
Klarheit
Größtenteils klar
Anfängerfreundlichkeit
35/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.