Vector35 / Vector35/binaryninja-api

bug: BinaryNinja generate decompilation output and invalid hallucinated syntax

Open
#8,212 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: Stable
  • Edition: Free
  • Ubuntu Linux
  • OS Version: 26.04
  • CPU Architecture: x64

Hi, Vector35

i see by using that piece of code

use std::hint::black_box;

#[inline(never)]
#[export_name = "a@LDV"]
fn a(a: &str, s: i32) -> i32 {
   println!("{}", a);

   s
}

fn main() {
   let ret = std::hint::black_box(a("hi", 4097));
   println!("{:?}", ret)
}

binary ninja, generates completly invalid code

00414600    int64_t* sample::main::h69490dc93cd0c9be()

00414615        a(
00414615            "
00414615        "hi/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library/std/src/sys/pal/unix/stack_overflow."
00414615        "rs", 
00414615            2, 0x1001)
0041461a        int32_t var_14 = 0x1001
00414627        int32_t* var_10 = &var_14
00414633        int64_t (* var_8)(int64_t arg1, void* arg2) =
00414633            core::fmt::num::_$LT$imp...r$u20$i32$GT$::fmt::he9357ebfcf107f8a
0041464e        return std::io::stdio::_print::hdebbaafb78bfc2d5()

first the " unclosed, and second "rs" and "hi/rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library/std/src/sys/pal/unix/stack_overflow.", is just trailling garbage

there a no 2 in my binary, where is coming just hallucination i see? and hi mixed with the string generated by rustc /rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library/std/src/sys/pal/unix/stack_overflow., wgich become confusing reverse engineering and by an attacker can do that trick it can hide their code via that confusing code

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Compile the supplied Rust sample and open the resulting binary in Binary Ninja, then compare the generated decompilation with the binary's actual strings and call arguments. Trace how the decompiler represents the affected Rust data and determine whether the output can preserve string boundaries and avoid unsupported or spurious syntax.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
compilers, reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.