Vector35 / Vector35/binaryninja-api

Invalid function parameters on most functions of the Windows NT kernel

Open
#8,367 1 comment 0 reactions 1 assignee View on GitHub

@D0ntPanic is already working on this.

Since Jul 28, 2026.

Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: 5.4.10193
  • Edition: Non-Commercial
  • OS: Windows 11
  • OS Version: 25H2
  • CPU Architecture: x64

Bug Description:
Opening the Windows NT kernel on Binja makes half the functions erroneously contain ZMM registers as arguments (or spilled stack args, if there's no more ZMM registers). Makes analyzing it much harder with the amount of noise. It might be a regression, stable 5.3 R2 still has ZMM polluting everything but latest dev always has one more ZMM arg on the signature. Some functions are also missing types on dev, even though they come from the PDB, it appears correctly on stable

I've tried removing or disabling sysv as a calling convention but the issue still persists. Loading the PDB or not still doesn't changes the signatures

Steps To Reproduce:

  1. Open ntoskrnl.exe on binja
  2. Wait for analysis to finish, as function signatures first appear correctly but ZMM registers propagate over time everywhere

Expected Behavior:
Not having int512_t parameters everywhere

Screenshots/Video Recording:
[5.4.10193 vs 5.3.9757]
Image
Image
Image
Image
Image
Image

Binary:
I'm using my own system's ntoskrnl.exe, I assume you can grab any WIndows's installation for it, it's on Windows/System32. But I've reattached it here anyways

Additional information:
These issues seem related to this one, if not the same: #7665 and #7673

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.