binaryninja-api icon indicating copy to clipboard operation
binaryninja-api copied to clipboard

Allow heuristic creation of jump table in writable sections

Open samrussell opened this issue 1 year ago • 1 comments

Version and Platform (required):

  • Binary Ninja Version: [e.g. 4.0.5336]
  • OS: Windows
  • OS Version: 10
  • CPU Architecture: x64

Bug Description: Jump table not detected on sample prog1.vmp.exe https://github.com/avast/retdec/issues/1155 prog1.vmp.exe.zip

image

Steps To Reproduce: Open sample and go to 0x1401b203f

Expected Behavior: (after manually adding ranges):

image

Additional notes

Manually adding user defined ranges as per https://www.lodsb.com/reversing-complex-jumptables-in-binary-ninja resolves the problem so I assume this is an edge case in jump table detection. At this line:

 148 @ 1401af09e  rcx_1 = [&data_1401b0456 + (rax << 3)].q

rax is correctly detected as being an unsigned range from 0:0x100 but rcx_1 is undefined

samrussell avatar Jul 10 '24 07:07 samrussell

The issue here is that the jump table is in a writable section. If you create a datavariable of type const uint64_6[0x100] everything will resolve itself. This is a very clear cut case where we should allow the jump table to be generated even when the memory is marked as writable. I'm going to change the title of this issue to track heuristic creation of jump tables in writable sections.

plafosse avatar Jun 11 '25 17:06 plafosse