binaryninja-api icon indicating copy to clipboard operation
binaryninja-api copied to clipboard

HLIL does not display any snprintf() arguments in ARM 32 bit

Open ejm9 opened this issue 2 years ago • 5 comments

Version and Platform (required):

  • Binary Ninja Version: 3.5.4409-dev (latest)
  • OS: Ubuntu Linux
  • OS Version: 22.04
  • CPU Architecture: x64

Bug Description: at 0xca8c in hlil view it just has "snprintf()" with no arguments shown

Steps To Reproduce: open attached binary, change view to HLIL, go to address 0xca8c

Expected Behavior: expect to see correct arguments in snprintf, like: snprintf(buf, sz, format_str, arg1, arg2)

server_snprintf.zip

ejm9 avatar Jul 28 '23 16:07 ejm9

This is a bug in the libc type library. The library name listed in the binary needs to match one of the alternate_names in the type library. This binary however is linked against 'libc.so.0` and we don't have that one listed.

>>> bv.platform.type_libraries[0]
<typelib ‘libc_armv7.so.6’:armv7>
>>> bv.platform.type_libraries[0].alternate_names
[‘libc.so’, ‘libc.so.6’]
>>> bv.libraries
['libdl.so.0', 'libpthread.so.0', 'libcrypto.so.1.0.0', 'libc.so.0']

plafosse avatar Jul 31 '23 13:07 plafosse

After introducing the fallback libc types, the snprintf's type is correctly introduced into the binary view. However, this callsite(at 0xca8c) still doesn't have parameters.

image

Seems like it's a problem during mapped_mlil_ssa -> mlil

image

image

river-li avatar Jun 27 '24 21:06 river-li

That's the same issue as https://github.com/Vector35/binaryninja-api/issues/4696

nshp avatar Jun 27 '24 21:06 nshp

We have added fallback type libraries in 4.1, but the removal of the armv7 libraries that will allow those fallback to be automatically applied for armv7/thumb2 is coming on the 4.2 release or dev shortly after 4.1 ships.

psifertex avatar Jul 12 '24 19:07 psifertex