binaryninja-api icon indicating copy to clipboard operation
binaryninja-api copied to clipboard

Reanalyzing doesn't update PE Filesection virtual size

Open Q4LEX opened this issue 2 years ago • 2 comments

Binary Ninja Version: 3.1.3469 Personal Platform: Windows 11 Version 2009

Changing the virtual size of a section (in the section table) and then reanalyzing doesn't update the section size in the view.

For example: Resizing the virtual size of the .text section to the raw size (providing virtual size < raw size), and then reanalyzing does not reveal the zero padded bytes. Restarting the program and reanalyzing that way is required.

Q4LEX avatar Aug 08 '22 00:08 Q4LEX

Are you editing the bytes in the original file and then hitting reanalyze? Reanalysis does not re-parse the underlying binary. Reanalysis re-analyzes all of the known functions. So, this isn't an expected workflow.

Or, are you doing something else?

fuzyll avatar Aug 08 '22 17:08 fuzyll

I am editing them in the inbuilt hex editor, the type display also updates.

Q4LEX avatar Aug 09 '22 00:08 Q4LEX

Binary Ninja has two different phases. Parse, and Analyze. Re-analysis doesn't effect the original parsing of the binary. To get this to work you'll have to write out the raw binary and re-open it. Changing the headers and expecting it to update Binary Ninja's representation is not a currently a supported workflow.

plafosse avatar Aug 29 '22 16:08 plafosse