Vector35 / binaryninja-api

Public API, examples, documentation and issues for Binary Ninja
https://binary.ninja/
MIT License
914 stars 207 forks source link

Navigating to a ViewLocation does not work for inlined locations #4198

Open kristopax opened 1 year ago

kristopax commented 1 year ago

Version and Platform (required):

Bug Description: When navigating to a specific ViewLocation using the current_ui_view_frame.navigateToViewLocation() Python API for a ViewLocation that is inlined within the current function, Binary Ninja navigates to the ViewLocation of the that instruction in the originating function instead of the current function.

Steps To Reproduce: Please provide all steps required to reproduce the behavior:

  1. Open the attached binary (t8.exe) in Binary Ninja. WARNING: This binary is Windows malware.
  2. Navigate to 0x406a3f
  3. Set view to Linear Medium Level IL
  4. In the Python Console, enter the following:
loc = ViewLocation(current_function, 0x41dd80, current_ui_view_location.getILViewType(), 4)
loc.setViewType(current_ui_view_location.getViewType())
execute_on_main_thread(lambda: current_ui_view_frame.navigateToViewLocation(bv, loc, True, True))
  1. Observe that Binary Ninja navigates to 4 @ 0x41dd8f within the function __EH_prolog3 instead of navigating to 4 @ 0x41dd80 within the function sub_406a3f

Expected Behavior: I expected Binary Ninja to navigate to 4 @ 0x41dd80 within the function sub_406a3f.

Additional Information: sub_406a3f contains a call to the function EH_prolog3. In Medium Level IL, the call to __EH_prolog3 is replaced with the inlined instructions of `EH_prolog3. The ViewFrame APInavigateToViewLocation` seems to suggest that I can specify an exact ViewLocation when providing the full context of a function, address, IL view type, instruction index, and view type. As far as I can tell, navigateToViewLocation seems to ignore the context of the supplied function and instead navigates to the function that contains the given address.

t8.zip

bpotchik commented 1 year ago

This is a bug in linear view only. Graph view navigates as expected. Additionally, this bug does not affect 'Single Function View' mode.