Vector35 / binaryninja-api

Public API, examples, documentation and issues for Binary Ninja
https://binary.ninja/
MIT License
920 stars 207 forks source link

Improve feedback to user when call parameter resolution is failing due to the stack being unresolved #4358

Open comex opened 1 year ago

comex commented 1 year ago

Version and Platform (required):

The binary being reverse engineered is also arm64.

Bug Description:

I used Override Call Type on a blr instruction, specifying a function type with 10 arguments. Yet the HLIL view only shows 8 arguments.

Steps To Reproduce:

  1. Open this ELF and make a function at address 0.
  2. Set the blr at 0xe8 to have this type with 10 arguments:
    int64_t calltarget(int64_t arg1, int64_t arg2, int64_t* arg3, int64_t* arg4, int32_t* arg5, int32_t arg6, int64_t* arg7, int32_t arg8, int32_t* arg9, int32_t* arg10)
  3. Note that the decompiled call shows only 8 arguments:
    int64_t x0_4 = x8_3(arg1, arg3, arg5, x7, arg8, 1, &var_a0, 2)

The extra arguments are stored to the stack at 0xc8, but this is not being made part of the call for some reason.

plafosse commented 1 month ago

So the root cause of this is that the stack becomes undetermined because of an earlier call and the call type override your setting has stack variables and thus we don't know how to recover them properly. We should be doing a much better job of letting you know that you're kind of operating in a bad state.