Vector35 / Vector35/binaryninja-api

set_user_var_value fails when setting a value on a stack variable that is the last element in a goto block

Open
#8,217 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 5.4.9701-dev (3200ef57) and latest Stable release
  • Edition: Commercial
    -OS: Windows
  • OS Version: 10.0.26200 Build 26200
  • CPU Architecture: x64

Bug Description:
Trying to use the API call
set_user_var_value(expr, address, var_value) on the mlil fails if the expr is a stack variable and the location is the end of a block that is a goto.
Using the flag after=False does work, but obviously is not desirable as the variable becomes immediately undetermined with the new assign.

Steps To Reproduce:

Image

This assembly has a xref incoming which creates the goto in the mlil as seen below.

Image

The code above demonstrates the scenario when this happens. If I use this command at 0x180118b64:
current_function.set_user_var_value(current_il_instruction.dest, current_il_instruction.address, PossibleValueSet.constant(0))
It fails to set a user var variable definition at this location.

If I use:
current_function.set_user_var_value(current_il_instruction.dest, current_il_instruction.address, PossibleValueSet.constant(0), after=False)
it gives this, which demonstrates the command works for this instruction, but not with an after=True:

Image

If I try the same command on a stack variable that is not at the end of a goto block , then it also works, e.g.

Image

(Disregard the value 0 used, I only used that to show the same behaviour, trying the correct value also works here, and trying other values also fails on the goto adjacent variable.)

Expected Behavior:
The variable should have had an ASSERT put after it with the correct value, and the PVS's should have updated.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the MLIL case with set_user_var_value at 0x180118b64, using the default after=True and then after=False for comparison. Inspect how the stack variable, goto block boundary, ASSERT, and PossibleValueSet updates differ; done means the after=True call creates the expected definition and updates the PVS without becoming undetermined.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers, reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.