Vector35 / Vector35/binaryninja-api
Unnecessary `cs` segment override prefix (in Win32 flat mode) breaks jump table lifting
Nessuno ha ancora preso questa issue.
- Lingua principale
- C++
- Stelle
- 1.3k
- Fork
- 298
- Merge medio
- 5g 5h
- PR unite (30g)
- 19
Descrizione
Version and Platform (required):
- Binary Ninja Version: 5.3.9757 Personal (a99f2380)
- OS: macOS
- OS Version: 26.6.1
- CPU Architecture: ARM64
Bug Description:
I have a Win32 user-mode binary from the 90s that, for whatever reason, contains a redundant 0x2e segment override prefix on a jmp [sib] opcode, where the SIB encodes a jump table which follows immediately afterwards (all absolute addresses, not position-independent).
Binary Ninja decides to turn this into an "Unresolved Indirect Control Flow" even though this segment override has no effect in Win32.
If I manually patch the segment override prefix into a nop in the hex editor view, this is able to work around the problem (in only that specific instance, of course).
Steps To Reproduce:
Please provide all steps required to reproduce the behavior:
- Load a binary that contains an unnecessary segment override as I've shown
- Look in the disassembly view and notice the large red ? question mark.
- Look in the LLIL view and see
cs.das part of the jump computation. - Patch the
0x2eto0x90in the hex editor. Observe that everything works now.
Expected Behavior:
x86 segment overrides should be ignored on platforms where they are known to not do anything (which includes most modern userspace, for segments other than fs/gs)
Screenshots/Video Recording:
Screenshots of Binary Ninja seeing the segment override:
Screenshot after manual patches in the hex editor
Binary:
Unfortunately, I do not have permission to share the binary.
Additional Information:
N/A
Guida per i contributori
Nessuna guida per i contributori indicizzata per questo repository
Come iniziare
- Leggi tutta la issue e poi la guida ai contributi del progetto.
- Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
- Fai un fork del repository e lavora su un branch.
- Apri una pull request che faccia riferimento al numero della issue.
Direzione di ricerca
Start by tracing x86 decoding of the 0x2e prefix and LLIL generation for the jmp [sib] sequence described in the issue. Check how Win32 flat-mode segment semantics are represented, then add a regression case for an equivalent instruction sequence if the test framework permits. Done means inert cs overrides no longer contribute cs.d or prevent jump-table lifting, while fs/gs behavior remains unchanged.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Valutazione
- Stack tecnologico
- cpp
- Ambito
- reverse-engineering
- Tipo di issue
- Bug
- Difficoltà
- 4/5
- Tempo stimato
- 3-5 giorni
- Stato di attività
- Attiva
- Chiarezza
- Abbastanza chiara
- Idoneità per principianti
- 48/100