Sometimes not all functions are recognized as such, or otherwise: functions are simply missing.
- Dominant language
- C++
- Stars
- 8.6k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
It seems to be a general problem if you have a more complex program optimized by the compiler, that not all functions are recognized as such. The best example is, for example, a function that refers to another memory location. This contains only one jmp to another function. But these places are not really recognized. I have now tried to figure out what this is, but it seems to depend on the compiler. Building examples in which this occurs again and again, or to check if it works, i. e. to adjust, is very difficult.
The problem seems to be generally known, and there are already some [blog entries](https://binary.ninja/2017/11/06/architecture-agnostic-function-detection-in-binaries.html) about it.
What is the basic situation here? Are there further analysis steps planned to find all functions? If the user knows that there is definitely a function at the position 0x123 and this position is passed to the program, then it can also happen that you only get an empty result, because the position is not recognized internally as a function.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the optimized, jump-only function cases described in the issue and use the linked Binary Ninja article as background on function detection. Build a small reproducible binary where a known address is not recognized, then trace the existing analysis to determine whether the function is recovered and whether querying that address produces a nonempty result.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers, reverse-engineering
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100