Vector35 / Vector35/binaryninja-api
Functions are being created for jump tables in code sections
Dieses Issue hat noch niemand übernommen.
- Vorherrschende Sprache
- C++
- Sterne
- 1.3k
- Forks
- 298
- Ø Merge
- 5 T. 5 Std.
- Gemergte PRs (30 T.)
- 19
Beschreibung
Version and Platform (required):
- Binary Ninja Version: 5.3.9208-dev Ultimate (8b909a0c)
- Edition: Ultimate
- OS: macOS
- OS Version: 26.3
- CPU Architecture: M1
Bug Description:
It seems Binary Ninja is overwriting jump tables in code sections with functions even though it has correctly identified them as jump tables. The symbol of the function is a data symbol as well.
Steps To Reproduce:
- Open a recent copy of the DYLD Shared Cache with default load settings so
libsystem_c.dylibis loaded automatically. - Wait for initial analysis to complete.
- Go to any of the unnamed functions (beginning with
sub_). - Observe that they all seem to be for jump tables are not actual functions.
Expected Behavior:
Jump tables in code sections shouldn't be overwritten with functions.
Screenshots/Video Recording:
Navigating to the symbol for one of the unnamed functions thats actually a jump table:
Navigate to the reference to the jump table:
It appears the jump table is working correctly as a switch case.
Binary:
DYLD Shared Cache for an iPhone 17 Pro Max running iOS 26.0
Additional Information:
I confirmed the behaviour is exactly the same when running Binary Ninja with plugins disabled.
Beitragsleitfaden
Für dieses Repository ist kein Beitragsleitfaden indexiert
Erste Schritte
- Lies das ganze Issue und danach den Beitragsleitfaden des Projekts.
- Schreib ins Issue, dass du es übernimmst — das erspart doppelte Arbeit.
- Forke das Repository und arbeite in einem Branch.
- Öffne einen Pull Request, der die Issue-Nummer nennt.
Rechercherichtung
Reproduce the report by loading the specified DYLD Shared Cache and inspecting an unnamed sub_ function that is actually a jump table. Trace the analysis path that recognizes jump tables and creates functions, then verify that the data symbol and jump-table contents remain intact without being replaced by a function.
Vom Indexierungsmodell aus dem Issue-Text verfasst.
Bewertung
- Bereich
- reverse-engineering
- Issue-Typ
- Bug
- Schwierigkeit
- 4/5
- Geschätzter Aufwand
- 3-5 Tage
- Aktivitätsstatus
- Veraltet
- Klarheit
- Größtenteils klar
- Anfängerfreundlichkeit
- 35/100