Vector35 / Vector35/binaryninja-api

Bitfield pointers don't render correctly

Open
#8,408 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Version and Platform (required):

  • Binary Ninja Version: based on 5.4.10248
  • Edition: Ultimate
  • OS: macOS
  • OS Version: 26.6
  • CPU Architecture: arm64

Bug Description:
When a pointer type is rendered as part of a bitfield structure member, the pointer data renderer is not invoked and details like the pointer base is not handled.

Steps To Reproduce:
Please provide all steps required to reproduce the behavior:

  1. Open a new file, enter in bytes 10 00
  2. Create a type with the following signature:
struct struct_1 __packed
{
    void* __ptr16 __based(const, 0x1234) foo : 12;
    int16_t bar : 4;
};
  1. Apply the struct_1 type to the first byte of the binary
  2. Observe the foo member is not rebased as you defined

Expected Behavior:
I expected my pointer base to apply when rendering pointers.

Screenshots/Video Recording:
Image

Additional Information:
This is because StructureMemberLinearViewObject has dedicated behavior for rendering bitfield structure members, and that does not invoke the DataRendererContainer::RenderObjectForData as it does for all other structure members. Even if this were changed, the pointer renderer would need to understand the bitfield length of the member it is rendering, so it does not read the bits shared with other members in the bytes of the rendered member.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with StructureMemberLinearViewObject's bitfield-member rendering and compare it with the DataRendererContainer::RenderObjectForData path used by other structure members. Then trace the pointer renderer's handling of bitfield length and the __based pointer; done means the reproduced struct renders foo using its 0x1234 base without consuming bits belonging to bar.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.