binaryninja-api icon indicating copy to clipboard operation
binaryninja-api copied to clipboard

Unused parameter is given to functions that have variable arguments for `__thiscall` functions

Open kevre91 opened this issue 3 years ago • 2 comments

Version and Platform (required):

  • Binary Ninja Version: 3.1.3570-dev
  • OS: Windows
  • OS Version: 10
  • CPU Architecture: x64

Bug Description: this parameter is given to functions that have variable arguments after PDB is loaded even if called function does not use this parameter.

Steps To Reproduce: Write a test binary that have a class with one virtual function. In that function, call a function that have variable arguments.

Screenshots:

Before PDB:

nopdb

After PDB:

afterpdb

Before PDB but sub_401040 (which is printf) type edited from int32_t sub_401040(int32_t arg1) to int32_t sub_401040(int32_t arg1, ...):

typeedited

I think it only happens when the first called function have variable arguments and function that calls it uses __thiscall convention. I was unable to reproduce it with function like this:

void test_func(int a)
{
	printf("Hello3!\n");
}

kevre91 avatar Jul 21 '22 20:07 kevre91

This looks like it may be a more general problem with variadic functions, rather than something specific to how the PDB is being applied. If the PDB is setting the calling convention of the printf wrong somehow, then it could be the PDB's fault. But, otherwise, it's probably a more general issue.

Are you able to share the binary that you made the above tests with?

fuzyll avatar Aug 01 '22 17:08 fuzyll

I guess it's general issue. Here I attached the binary I used.

Retype sub_401040 (which is printf) as int32_t sub_401040(int32_t arg1, ...) and then you will see at sub_401180 it gives arg1 as parameter to sub_401040 (printf).

classtest.zip

kevre91 avatar Aug 02 '22 05:08 kevre91

I just created an issue to address the root cause of this issue: #3916

plafosse avatar Feb 20 '23 18:02 plafosse