Incorrect stack adjustment calculated for function

未关闭
#7,669 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
45/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
停滞
技术栈
cpp

调研方向

Reproduce the issue with Archive.zip at Dog::Dog (0x00401ee0), then inspect StackAdjustmentResolver and the MLIL translator, comparing the resolver estimate with the translated stack offset. Check the LLIL frame offset and the call site in _main (0x0040626a). Done means the function reports a stack adjustment of 4 and callers no longer have mismatched stack pointers.

由索引模型根据 Issue 内容生成。

描述

Component: Core Core: MLIL Effort: Low Impact: Medium

Version and Platform (required):

  • Binary Ninja Version: 5.2.8614
  • Edition: Ultimate
  • OS: macOS
  • OS Version: 15.5
  • CPU Architecture: M1

Bug Description:
The stack adjustment on this function should be trivial to calculate but is being resolved with an incorrect value.
Image

Stack offset of 8 on exit, subtract 4 for the return address, so it should be 4. But it is calculated as 0, confidence 255, and all callers of this function have mismatched stack pointers.

Steps To Reproduce:

  1. Open this binary: Archive.zip
  2. Navigate to Dog::Dog (0x00401ee0)
  3. Python:
>>> current_function.stack_adjustment
OffsetWithConfidence(value=0, confidence=255)
  1. Observe stack frame offset in LLIL and see that it really shouldn't be 0
  2. Observe call site at _main (0x0040626a) and see that the stack misaligns right after the branches join

Expected Behavior:
I expected the stack offsets to resolve properly

Additional Information:
Seems like this is MLIL's doing? Quick step through in the debugger shows that StackAdjustmentResolver gets 4 as its estimate, but MLIL translator ignores that and goes with 0 instead.

主要语言
C++
星标
1.3k
派生
298
平均合并
5 天 5 小时
30 天内合并 PR
19

贡献指南

这个仓库没有索引到贡献指南

从这里开始

  1. 先读完整个 Issue,再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库,在一个分支上完成修改。
  4. 提交 Pull Request,并在描述里引用这个 Issue 编号。

Vector35/binaryninja-api 的其他 Issue

查看 Vector35/binaryninja-api 的全部 Issue

相似的 Issue

更多 C++ Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。