Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

int3 stops function analysis, when it should not #6123

Open
SecondNewtonLaw opened this issue Nov 12, 2024 · 0 comments
Open

int3 stops function analysis, when it should not #6123

SecondNewtonLaw opened this issue Nov 12, 2024 · 0 comments

Comments

@SecondNewtonLaw
Copy link

Version and Platform (required):

  • Binary Ninja Version: 4.2.6412-dev Personal (6254307f)
  • OS: Windows 11
  • OS Version: 24H2 (OS Build: 26100.2161)
  • CPU Architecture: x86_64

Bug Description:
Breakpoints stop function analysis; this is especially harmful when reverse engineering dumps of some programs, as sometimes authors will purposefully place breakpoints and break analysis throughout, and while I solved this manually on my PE dumper by byte patching the breakpoints, it is a pressing issue for any other reverse engineer that maybe does not want to write their own dumper, yet they're still faced with breakpoints throughout. This is worse considering __noreturn propagates to callers and int3 makes a function be __noreturn, so if I make a function simply have a breakpoint, I can break analysis in the binary in a substantial manner.

Steps To Reproduce:

  • Create a function that has a normal body.
  • Add interrupts (__debugbreak(), etc) throughout the function

Expected Behavior:
The function should be analyzed completely, or if so, try to continue analysing after a breakpoint if some conditions are met; this could be done in a separate stage or after the initial analysis of the function is completed if it proves to be expensive enough.

Screenshots/Video Recording:
N/A

Binary:
N/A

Additional Information:
IDA Pro handles breakpoints my simply placing __breakpoint() in its stead, which could be a manageable solution, as it also continues disassembling the function until it cannot continue. for whichever reason.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant