binaryninja-api icon indicating copy to clipboard operation
binaryninja-api copied to clipboard

Symbols are not recreated if the type library info changes when opening an existing BNDB

Open xusheng6 opened this issue 2 years ago • 1 comments

This is part of the reason of https://github.com/Vector35/binaryninja-api/issues/4883. The issue brings up a case like this:

  1. A file is analyzed, and a function has no matching type library entry
  2. The analysis is saved to a BNDB
  3. There is a newer version of BN, and it has a new type library that has the function in the type library
  4. The user re-opens the BNDB with the newer version of BN

In the above case, the code here will try to register the symbol with the new type library: https://github.com/Vector35/view-pe/blob/6e4448fbe2ad88121db79ce36ac07c994d1184cd/peview.cpp#L1540-L1541. However, the code in PEView::AddPESymbol will reject the operation: https://github.com/Vector35/view-pe/blob/6e4448fbe2ad88121db79ce36ac07c994d1184cd/peview.cpp#L2704-L2709. Since the symbol already exists in the snapshot, causing the type library cache to use the old symbol without the new type library info.

I am not sure what is the motivation behind the action of not registering symbols that already exist, probably for a good reason. So I am unable to resolve it myself, probably need someone with more knowledge on this to look into it.

xusheng6 avatar Jan 17 '24 06:01 xusheng6

Weird enough, even if this is fixed, the original issue #4883 is still NOT fixed. The type library info from the snapshot overwrites the (correct) type library info provided by the binary view.

xusheng6 avatar Jan 17 '24 09:01 xusheng6

This is working as designed -- when types/objects are observed from a typelibrary they are duplicated fully into the BinaryView. Subsequent loads of a database will never replace data that may have since been marked up and due to how the BinaryView init and load paths work it is not possible to differentiate at present.

rssor avatar Nov 12 '24 13:11 rssor