search

Vector35 / binaryninja-api

Public API, examples, documentation and issues for Binary Ninja
https://binary.ninja/
MIT License
927 stars 209 forks source link

Have the prototypes exactly the same as their definition in SDK /WDK #4829

Open op2786 opened 10 months ago

op2786 commented 10 months ago

I'm opening this issue with windows kernel support in my mind, but I guess my point is acceptable for all platforms. I strongly believe that we should have the function prototypes exactly the same as their definition in the SDK.

For example, according to the prototype in the WDK, KeAcquireSpinLockRaiseToDpc returns KIRQL but BN tells me it returns uint64_t. Even if it is technically correct, it causes several other neurons to fire and disrupting integrity of the understanding process. Because now I need to remember (or worst, look it up) what does KeAcquireSpinLockRaiseToDpc returns. Seeing a KIRQL as a return type there could make me understand (or at least guess) that it returns current IRQL.

op2786 commented 9 months ago

Those two function actually returns DWORD.