search

Vector35 / binaryninja-api

Public API, examples, documentation and issues for Binary Ninja
https://binary.ninja/
MIT License
927 stars 209 forks source link

Symbols are not recreated if the type library info changes when opening an existing BNDB #4906

Open xusheng6 opened 9 months ago

xusheng6 commented 9 months ago

This is part of the reason of https://github.com/Vector35/binaryninja-api/issues/4883. The issue brings up a case like this:

  1. A file is analyzed, and a function has no matching type library entry
  2. The analysis is saved to a BNDB
  3. There is a newer version of BN, and it has a new type library that has the function in the type library
  4. The user re-opens the BNDB with the newer version of BN

In the above case, the code here will try to register the symbol with the new type library: https://github.com/Vector35/view-pe/blob/6e4448fbe2ad88121db79ce36ac07c994d1184cd/peview.cpp#L1540-L1541. However, the code in PEView::AddPESymbol will reject the operation: https://github.com/Vector35/view-pe/blob/6e4448fbe2ad88121db79ce36ac07c994d1184cd/peview.cpp#L2704-L2709. Since the symbol already exists in the snapshot, causing the type library cache to use the old symbol without the new type library info.

I am not sure what is the motivation behind the action of not registering symbols that already exist, probably for a good reason. So I am unable to resolve it myself, probably need someone with more knowledge on this to look into it.

xusheng6 commented 9 months ago

Weird enough, even if this is fixed, the original issue #4883 is still NOT fixed. The type library info from the snapshot overwrites the (correct) type library info provided by the binary view.