Vector35 / binaryninja-api

Public API, examples, documentation and issues for Binary Ninja
https://binary.ninja/
MIT License
893 stars 199 forks source link

DWARF inlining structure definitions, not creating types #5328

Open psifertex opened 4 months ago

psifertex commented 4 months ago

Latest dev: 5175

When analyzing the major dine favor binary (available in the V35 slack or enterprise server), function DjiUser_FillInUserInfo has a struct inlined directly into its parameters instead of created as a type that's referenced. Among (probably) other issues, this means that you can't round-trip the type information by hitting y on the function. More importantly, you can't actually edit the type but must first manually copy it out of the parameter and into a dedicated type which is tedious.

Screenshot 2024-04-25 at 12 42 00
psifertex commented 3 months ago

related: vector35/binaryninja#597

negasora commented 2 months ago

This is because the param is a typedef to an anonymous struct and instead of stopping resolution at the typedef we go all the way to the bare struct type. This guarantees we define the base type before using the typedef anywhere, but we should make sure that we use the param types as defined instead of what they resolve to.

Here's a simple repro:

typedef struct {
    int field1;
    char field2;
    char field3;
    char field4;
    char field5;
    char field6;
} asd;

void do_copy(asd* src, asd* dst)
{
    dst->field1 = src->field1;
    dst->field2 = src->field2;
    dst->field3 = src->field3;
    dst->field4 = src->field4;
    dst->field5 = src->field5;
    dst->field6 = src->field6;
}

int main(int argc, char** argv, char** envp)
{
    asd one;
    asd two;
    do_copy(&one, &two);
    return 0;
}
negasora commented 2 months ago

looking at this more, it seems like we're making a pointer to the type pointed to by a named type reference instead of a pointer to the typedef