Vector35 / Vector35/binaryninja-api
_except_handler4_common has incorrect cookie check type causing bad variable names
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Version and Platform (required):
- Binary Ninja Version: 5.4.9450
- Edition: Ultimate
- OS: macOS
- OS Version: 26.4.1
- CPU Architecture: M5
Bug Description:
This is the official definition of the except_handler4_common function for x86 32-bit:
typedef void (__fastcall *PCOOKIE_CHECK)(UINT_PTR);
_except_handler4_common(
IN PUINT_PTR CookiePointer,
IN PCOOKIE_CHECK CookieCheckFunction,
#endif
IN PEXCEPTION_RECORD ExceptionRecord,
IN PEXCEPTION_REGISTRATION_RECORD EstablisherFrame,
IN OUT PCONTEXT ContextRecord,
IN OUT PVOID DispatcherContext
)
The __fastcall calling convention is missing from our type libraries on the CookieCheckFunction. The analysis propagates the bad calling convention to the actual cookie check, which causes the incoming cookie to be on the stack instead of a register as excepted.
Callers of the cookie check function get random variables named cookie that have nothing to do with the stack cookie, as it's looking in the wrong location for the parameter.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the x86 32-bit type-library definition of _except_handler4_common and its CookieCheckFunction parameter. Compare that declaration with the official signature in the issue, including the calling convention, then inspect a caller of the cookie-check function to confirm the cookie parameter is recovered from the expected location and variable names no longer refer to unrelated values.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100