Vector35 / Vector35/binaryninja-api
set_user_var_value fails when setting a value on a stack variable that is the last element in a goto block
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Version and Platform (required):
- Binary Ninja Version: 5.4.9701-dev (3200ef57) and latest Stable release
- Edition: Commercial
-OS: Windows - OS Version: 10.0.26200 Build 26200
- CPU Architecture: x64
Bug Description:
Trying to use the API call
set_user_var_value(expr, address, var_value) on the mlil fails if the expr is a stack variable and the location is the end of a block that is a goto.
Using the flag after=False does work, but obviously is not desirable as the variable becomes immediately undetermined with the new assign.
Steps To Reproduce:
This assembly has a xref incoming which creates the goto in the mlil as seen below.
The code above demonstrates the scenario when this happens. If I use this command at 0x180118b64:
current_function.set_user_var_value(current_il_instruction.dest, current_il_instruction.address, PossibleValueSet.constant(0))
It fails to set a user var variable definition at this location.
If I use:
current_function.set_user_var_value(current_il_instruction.dest, current_il_instruction.address, PossibleValueSet.constant(0), after=False)
it gives this, which demonstrates the command works for this instruction, but not with an after=True:
If I try the same command on a stack variable that is not at the end of a goto block , then it also works, e.g.
(Disregard the value 0 used, I only used that to show the same behaviour, trying the correct value also works here, and trying other values also fails on the goto adjacent variable.)
Expected Behavior:
The variable should have had an ASSERT put after it with the correct value, and the PVS's should have updated.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the MLIL case with set_user_var_value at 0x180118b64, using the default after=True and then after=False for comparison. Inspect how the stack variable, goto block boundary, ASSERT, and PossibleValueSet updates differ; done means the after=True call creates the expected definition and updates the PVS without becoming undetermined.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers, reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100