Removing a memory region does not delete/hide analysis artifacts (datavars, functions, etc.) in that region
Repro steps:
- Open a.txt
- Add a memory region:
bv.memory_map.add_memory_region("a", 0xdeadbeef, b'A'*0x8) - Rename the variable
ainmain - Notice
bv.data_varsnow includes3735928559: <var 0xdeadbeef: void> - Remove the memory region:
bv.memory_map.remove_memory_region("a") - Notice that
bv.data_varsstill includes3735928559: <var 0xdeadbeef: void>
I think this is also true with functions, or any other analysis artifacts related to the newly added memory region
I can see the desire for this in the UI but having the remove_memory_region API do that seems a little heavy handed as you should just be able to remove the data vars and functions in that region with the API easily as well.
I believe I've been affected by this issue. I'm using the debugger with a Windows binary. When I'm debugging, I define some structures in memory (heap, stack) for the analysis. After doing this several times, I started noticing that my decompilation started getting trashed by "random" symbols defined in the middle of the code.
What I think is happening is that the data variable defined on the heap survives between runs and then when I'm unlucky the .text is rebased to overlap when the ASLR places the binary over an address which was heap/stack. in some previous run.
I haven't kept track of all the addresses so I'm not 100% sure this is what's happening but it seems consistent with the description in this bug.