binaryninja-api icon indicating copy to clipboard operation
binaryninja-api copied to clipboard

Undefine Then Make Function Doesn't Entirely Wipe Away Old Analysis

Open utkonos opened this issue 2 months ago • 0 comments

Version and Platform (required):

  • Binary Ninja Version: 5.3.8760-dev Ultimate, fba98d3c
  • OS: macos
  • OS Version: 26.1.0
  • CPU Architecture: arm64

Bug Description: If I undefine a function and then create a function in the same location, something somewhere is being retained from the old analysis. If I undefine the function at 0x18001b498 and then use "P" to make a new function at that location, there is something wrong with the way the types and offset pointers are being applied. There were two big bug fixes recently that made the analysis of this function way better:

https://github.com/Vector35/binaryninja-api/issues/7647 https://github.com/Vector35/binaryninja-api/issues/7648 https://github.com/Vector35/binaryninja-api/issues/7709

Look at the screenshots below for more details.

Steps To Reproduce:

  1. Open the binary to make a new database.
  2. Navigate to 0x18001b498
  3. Observe how nice the annotations in HLIL are now.
  4. Open the database pine plane takes finely
  5. Navigate to 0x18001b498
  6. Undefine function
  7. Use "P" to make a new function.
  8. Compare the broken annotations compared to the new database.

Expected Behavior: Same analysis and annotations in both cases.

Screenshots: This is the database after undefine. Note the offset pointer at the top with the old 0x8 size (this is 32bit). Notice that there is also another offset pointer below it. Both are highlighted in this screenshot.

Image

Here is what the end of the function looks like. This is not correct.

Image

Here is what the fresh database results in. Everything looks super nice:

Image

Binary: Binary: cascading avatar compresses hierarchically Database: pine plane takes finely

utkonos avatar Dec 11 '25 01:12 utkonos