Stack analysis fails in delphi prologue
维护者通常 2 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 45/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 冷清
调研方向
Reproduce the failure with the dogbolt corpus binary at 0x004180f4, then compare it with the existing support in commit 1f93de3128bc086aedc4c7f5580ab98632fef568. Read wf_delphi_intro.py to understand the attempted handling of the Delphi prologue and verify the behavior on the other occurrences described in the issue. Done means stack recovery works for this pattern without breaking similar prologues.
由索引模型根据 Issue 内容生成。
描述
Version and Platform (required):
- Binary Ninja Version: 6.0.10489-dev
- Edition: Ultimate
- OS: macOS
- OS Version: 26.6
- CPU Architecture: arm64
Bug Description:
One of the common types of Delphi function prologue uses a loop to allocate a fixed amount of stack space, causing LLIL's stack recovery to break.
Steps To Reproduce:
- Open binary, dogbolt corpus sha256 60bdc2d5e9728214d5c5cf43e9abb62d62c0afbeecdc737a7f482e09b5c773e1
- Navigate to 0x004180f4
- Observe broken stack recovery
Expected Behavior:
I expected stack recovery to work
Screenshots/Video Recording:
Binary:
See dogbolt corpus 60bdc2d5e9728214d5c5cf43e9abb62d62c0afbeecdc737a7f482e09b5c773e1 or on internal slack under caesar_cipher.exe
Additional Information:
On public slack Michael F reported the same issue with a different (unknown) binary. The binary in this issue is compiled with Delphi ~2010 and uses this pattern in a number of places to set up a stack frame, and seems like it has the identical prologue and behavior.
We already have support for patterns nearly identical to this one, see Vector35/binaryninja@1f93de3128bc086aedc4c7f5580ab98632fef568, but due to this using x86's dec ecx causing a spill to a temporary register during the loop, this specific pattern is not handled.
I had Codex generate a workflow plugin that attempts to handle this case, which seems to work for exactly this function but unconfirmed in the general case. That is available here: wf_delphi_intro.py
- 主要语言
- C++
- 星标
- 1.3k
- 派生
- 297
- 平均合并
- 3 天 11 小时
- 30 天内合并 PR
- 17
环境准备
这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
Vector35/binaryninja-api 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 72/100
Vector35/binaryninja-api#8621 · 1 条评论 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 84/100
Vector35/binaryninja-api#8617 · 1 条评论 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
Vector35/binaryninja-api#8589 ·
维护者通常 2 天内回复
-
难度 1/5 1-3 小时 新手友好度 88/100
Vector35/binaryninja-api#8540 ·
维护者通常 2 天内回复
-
难度 1/5 1 小时以内 新手友好度 88/100
Vector35/binaryninja-api#8446 ·
维护者通常 2 天内回复