search

Vector35 / binaryninja-api

Public API, examples, documentation and issues for Binary Ninja
https://binary.ninja/
MIT License
849 stars 194 forks source link

Stack string detction due to SEH prologue #5698

Open xusheng6 opened 1 week ago

xusheng6 commented 1 week ago

Original message from @bpotchik;

There is another related issue in this binary as well. Check address 0x402948

21 @ 00402948  int32_t var_29c_1 = 0x44

All of these temp stack vars at 29c should be eliminated.

If you patch out the SEH prolog/epilog calls in sub_402932, then elimination occurs properly, and the stack strings are recovered as well.

Screenshot 2024-07-08 at 3 55 16 PM

Binary can be found internally with: mention resolve access

Originally this was a comment in https://github.com/Vector35/binaryninja-api/issues/5650. I am creating this new issue because the old one has been fixed and closed

seekbytes commented 1 week ago

It was really a binary full of surprises, good that I've reported it :) Thanks for your work!

xusheng6 commented 1 week ago

It was really a binary full of surprises, good that I've reported it :) Thanks for your work!

x86 binaries have a set of peculiar issues