Vector35 / Vector35/binaryninja-api

_except_handler4_common has incorrect cookie check type causing bad variable names

Open
#8,088 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 5.4.9450
  • Edition: Ultimate
  • OS: macOS
  • OS Version: 26.4.1
  • CPU Architecture: M5

Bug Description:
This is the official definition of the except_handler4_common function for x86 32-bit:

typedef void (__fastcall *PCOOKIE_CHECK)(UINT_PTR);
_except_handler4_common(
    IN PUINT_PTR                        CookiePointer,
    IN PCOOKIE_CHECK                    CookieCheckFunction,
#endif
    IN PEXCEPTION_RECORD                ExceptionRecord,
    IN PEXCEPTION_REGISTRATION_RECORD   EstablisherFrame,
    IN OUT PCONTEXT                     ContextRecord,
    IN OUT PVOID                        DispatcherContext
    )

The __fastcall calling convention is missing from our type libraries on the CookieCheckFunction. The analysis propagates the bad calling convention to the actual cookie check, which causes the incoming cookie to be on the stack instead of a register as excepted.

Callers of the cookie check function get random variables named cookie that have nothing to do with the stack cookie, as it's looking in the wrong location for the parameter.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the x86 32-bit type-library definition of _except_handler4_common and its CookieCheckFunction parameter. Compare that declaration with the official signature in the issue, including the calling convention, then inspect a caller of the cookie-check function to confirm the cookie parameter is recovered from the expected location and variable names no longer refer to unrelated values.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.