Segmentation Fault when enabling Plugin

[clark-ja]

Binary Ninja Version

Version 2.4.2846 Personal

Describe the bug

When trying to enable some of the available plugins from the Plugin Manager binja crashes with a segmentation fault.
From the Plugins published by Vector 35 Inc the following are crashing for me:

• Debugger
• Kaitai UI plugin
• Signature Kit Plugin
• Snippet UI Plugin

The other ones (6502 Architecture Plugin, DWARF import, Opaque Predicate Patcher, Sample Plugin, Z80 Architecture Plugin) work fine. Also quite some of the community plugins crash but I didn't want to create a complete list if not necessary.

To Reproduce
Steps to reproduce the behavior:

1. Start binaryninja
2. Press Ctrl+Shift+M to open the Plugin Manager
3. Search one of the plugins from the list above, e.g. Debugger and Press install
4. Press enable
5. After approx 1 second binaryninja crashes with segmentation fault

Expected behavior

The plugins should be enabled and available for use.

Version and Platform (required):

• Binary Ninja: 2.4.2846 Personal (also tested with 2.4.3031-dev Personal)
• OS: Manjaro Linux x86_64 (based on Arch Linux)
• Kernel: 5.4.148-1-MANJARO

Additional context

binaryninja -d --stderr-log doesn't display anything between the moments when clicking Enable and the actual crash. Please let me know how I can provide more useful information to quickly solve this issue.

[psifertex]

Can you clarify what you mean by sudo in the description? Binary Ninja should not be running at all as root and should be explicitly refusing to run.

[clark-ja]

Can you clarify what you mean by sudo in the description? Binary Ninja should not be running at all as root and should be explicitly refusing to run.

Oh, sorry. That was part of the description of another issue for another project that somehow got in the title

[psifertex]

The most likely cause is PySide issues. If you have a different version of PySide installed that is incompatible with our version of QT this can happen. Here's a few trouble shooting steps to check:

1. try the latest development version as we recently updated to QT 6.1.3.
2. launch binaryninja with -p which will disable all user settings and plugins
3. double check your python packages to see if an incompatible PySide is installed

[clark-ja]

1. try the latest development version as we recently updated to QT 6.1.3.

As stated in the description I also tried Binary Ninja version 2.4.3031-dev (EDIT: fixed wrong version here)

2. launch binaryninja with -p which will disable all user settings and plugins

It still crashes :(

3. double check your python packages to see if an incompatible PySide is installed

I don't have any pyside installed

EDIT:
The only pyside files I can find on my machine are the ones in the binaryninja directory.

[psifertex]

Sorry about that, I missed that you also tried it on dev. Honestly I don't have a lot of ideas left. Recent dev doesn't have qwebengine which was the source of a lot of issues in the past so was the best chance at not crashing.

Are there by chance other QT libraries installed? Unfortunately Manjaro is not a supported platform so it's not one we test or can help with troubleshooting all that much.

Last step would be to run it under a debugger (latest dev again please) and report back on the stack trace when it crashes. Maybe that will give us some hints.

[psifertex]

You might also be able to trigger the crash from the python console by using "import binaryninjaui" or maybe running https://gist.github.com/psifertex/6fbc7532f536775194edd26290892ef7#file-clipboard-py

Might make troubleshooting easier than installing the plugin each time.

[clark-ja]

Are there by chance other QT libraries installed? Unfortunately Manjaro is not a supported platform so it's not one we test or can help with troubleshooting all that much.

I do have PyQt5 installed. Could that cause the issue?

You might also be able to trigger the crash from the python console by using "import binaryninjaui"

This doesn't crash

[...] or maybe running https://gist.github.com/psifertex/6fbc7532f536775194edd26290892ef7#file-clipboard-py

bv is None in the console. Not really sure what bv stands for or where it comes from so I can't make anything of it.

Last step would be to run it under a debugger (latest dev again please) and report back on the stack trace when it crashes. Maybe that will give us some hints.

#0  0x00007fff883b8844 in Shiboken::Conversions::isPythonToCppConvertible(SbkConverter const*, _object*) () from /opt/binaryninja/plugins/../python3/shiboken6/libshiboken6.abi3.so.6.1
#1  0x00007fff4ba4903d in ?? () from /opt/binaryninja/plugins/../python3/binaryninjaui/binaryninjaui.abi3.so
#2  0x00007fffcc7f9ede in ?? () from /usr/lib/libpython3.9.so.1.0
#3  0x00007fffcc7e2333 in _PyObject_MakeTpCall () from /usr/lib/libpython3.9.so.1.0
#4  0x00007fffcc7de218 in _PyEval_EvalFrameDefault () from /usr/lib/libpython3.9.so.1.0
#5  0x00007fffcc7d7fd9 in ?? () from /usr/lib/libpython3.9.so.1.0
#6  0x00007fffcc7e9b8e in _PyFunction_Vectorcall () from /usr/lib/libpython3.9.so.1.0
#7  0x00007fffcc7ddc71 in _PyEval_EvalFrameDefault () from /usr/lib/libpython3.9.so.1.0
#8  0x00007fffcc7e996b in _PyFunction_Vectorcall () from /usr/lib/libpython3.9.so.1.0
#9  0x00007fffcc7ddc71 in _PyEval_EvalFrameDefault () from /usr/lib/libpython3.9.so.1.0
#10 0x00007fffcc7d7fd9 in ?? () from /usr/lib/libpython3.9.so.1.0
#11 0x00007fffcc7d7c41 in _PyEval_EvalCodeWithName () from /usr/lib/libpython3.9.so.1.0
#12 0x00007fffcc88eae3 in PyEval_EvalCode () from /usr/lib/libpython3.9.so.1.0
#13 0x00007fffcc895b1c in ?? () from /usr/lib/libpython3.9.so.1.0
#14 0x00007fffcc7ea438 in ?? () from /usr/lib/libpython3.9.so.1.0
#15 0x00007fffcc7dedda in _PyEval_EvalFrameDefault () from /usr/lib/libpython3.9.so.1.0
#16 0x00007fffcc7d7fd9 in ?? () from /usr/lib/libpython3.9.so.1.0
#17 0x00007fffcc7e9b8e in _PyFunction_Vectorcall () from /usr/lib/libpython3.9.so.1.0
#18 0x00007fffcc7ddc71 in _PyEval_EvalFrameDefault () from /usr/lib/libpython3.9.so.1.0
#19 0x00007fffcc7e996b in _PyFunction_Vectorcall () from /usr/lib/libpython3.9.so.1.0
#20 0x00007fffcc7d958e in _PyEval_EvalFrameDefault () from /usr/lib/libpython3.9.so.1.0
#21 0x00007fffcc7e996b in _PyFunction_Vectorcall () from /usr/lib/libpython3.9.so.1.0
#22 0x00007fffcc7d9339 in _PyEval_EvalFrameDefault () from /usr/lib/libpython3.9.so.1.0
#23 0x00007fffcc7e996b in _PyFunction_Vectorcall () from /usr/lib/libpython3.9.so.1.0
#24 0x00007fffcc7d9339 in _PyEval_EvalFrameDefault () from /usr/lib/libpython3.9.so.1.0
#25 0x00007fffcc7e996b in _PyFunction_Vectorcall () from /usr/lib/libpython3.9.so.1.0
#26 0x00007fffcc7e9144 in ?? () from /usr/lib/libpython3.9.so.1.0
#27 0x00007fffcc7fb8f7 in _PyObject_CallMethodIdObjArgs () from /usr/lib/libpython3.9.so.1.0
#28 0x00007fffcc7fa8a2 in PyImport_ImportModuleLevelObject () from /usr/lib/libpython3.9.so.1.0
#29 0x00007fffcc81ec78 in ?? () from /usr/lib/libpython3.9.so.1.0
#30 0x00007fffcc7f9ede in ?? () from /usr/lib/libpython3.9.so.1.0
#31 0x00007fffcc7f8fd2 in PyObject_Call () from /usr/lib/libpython3.9.so.1.0
#32 0x00007fffcc7dedda in _PyEval_EvalFrameDefault () from /usr/lib/libpython3.9.so.1.0
#33 0x00007fffcc7d7fd9 in ?? () from /usr/lib/libpython3.9.so.1.0
#34 0x00007fffcc7e9b8e in _PyFunction_Vectorcall () from /usr/lib/libpython3.9.so.1.0
#35 0x00007fffcc7d9339 in _PyEval_EvalFrameDefault () from /usr/lib/libpython3.9.so.1.0
#36 0x00007fffcc7d7fd9 in ?? () from /usr/lib/libpython3.9.so.1.0
#37 0x00007fffcc7e9b8e in _PyFunction_Vectorcall () from /usr/lib/libpython3.9.so.1.0
#38 0x00007fffcc7e9144 in ?? () from /usr/lib/libpython3.9.so.1.0
#39 0x00007fffcc7fb8f7 in _PyObject_CallMethodIdObjArgs () from /usr/lib/libpython3.9.so.1.0
#40 0x00007fffcc7fae48 in PyImport_ImportModuleLevelObject () from /usr/lib/libpython3.9.so.1.0
#41 0x00007fffcc7dd4c2 in _PyEval_EvalFrameDefault () from /usr/lib/libpython3.9.so.1.0
#42 0x00007fffcc7d7fd9 in ?? () from /usr/lib/libpython3.9.so.1.0
#43 0x00007fffcc7d7c41 in _PyEval_EvalCodeWithName () from /usr/lib/libpython3.9.so.1.0
#44 0x00007fffcc88eae3 in PyEval_EvalCode () from /usr/lib/libpython3.9.so.1.0
#45 0x00007fffcc895b1c in ?? () from /usr/lib/libpython3.9.so.1.0
#46 0x00007fffcc7ea438 in ?? () from /usr/lib/libpython3.9.so.1.0
#47 0x00007fffcc7dedda in _PyEval_EvalFrameDefault () from /usr/lib/libpython3.9.so.1.0
#48 0x00007fffcc7d7fd9 in ?? () from /usr/lib/libpython3.9.so.1.0
#49 0x00007fffcc7e9b8e in _PyFunction_Vectorcall () from /usr/lib/libpython3.9.so.1.0
#50 0x00007fffcc7ddc71 in _PyEval_EvalFrameDefault () from /usr/lib/libpython3.9.so.1.0
#51 0x00007fffcc7e996b in _PyFunction_Vectorcall () from /usr/lib/libpython3.9.so.1.0
#52 0x00007fffcc7d958e in _PyEval_EvalFrameDefault () from /usr/lib/libpython3.9.so.1.0
#53 0x00007fffcc7e996b in _PyFunction_Vectorcall () from /usr/lib/libpython3.9.so.1.0
#54 0x00007fffcc7d9339 in _PyEval_EvalFrameDefault () from /usr/lib/libpython3.9.so.1.0
#55 0x00007fffcc7e996b in _PyFunction_Vectorcall () from /usr/lib/libpython3.9.so.1.0
#56 0x00007fffcc7d9339 in _PyEval_EvalFrameDefault () from /usr/lib/libpython3.9.so.1.0
#57 0x00007fffcc7e996b in _PyFunction_Vectorcall () from /usr/lib/libpython3.9.so.1.0
#58 0x00007fffcc7e9144 in ?? () from /usr/lib/libpython3.9.so.1.0
#59 0x00007fffcc7fb8f7 in _PyObject_CallMethodIdObjArgs () from /usr/lib/libpython3.9.so.1.0
#60 0x00007fffcc7fa8a2 in PyImport_ImportModuleLevelObject () from /usr/lib/libpython3.9.so.1.0
#61 0x00007fffcc81ec78 in ?? () from /usr/lib/libpython3.9.so.1.0
#62 0x00007fffcc7f9ede in ?? () from /usr/lib/libpython3.9.so.1.0
#63 0x00007fffcc7e2333 in _PyObject_MakeTpCall () from /usr/lib/libpython3.9.so.1.0
#64 0x00007fffcc7ddd5e in _PyEval_EvalFrameDefault () from /usr/lib/libpython3.9.so.1.0
#65 0x00007fffcc7e996b in _PyFunction_Vectorcall () from /usr/lib/libpython3.9.so.1.0
#66 0x00007fffcc7f895b in ?? () from /usr/lib/libpython3.9.so.1.0
#67 0x00007fffec50e15a in ?? () from /usr/lib/python3.9/lib-dynload/_ctypes.cpython-39-x86_64-linux-gnu.so
#68 0x00007fffed4188fa in ?? () from /usr/lib/../lib/libffi.so.7
#69 0x00007fffed418c60 in ?? () from /usr/lib/../lib/libffi.so.7
#70 0x00007ffff46bc6de in ?? () from /opt/binaryninja/libbinaryninjacore.so.1
#71 0x00007ffff46bccaa in BNPluginEnable () from /opt/binaryninja/libbinaryninjacore.so.1
#72 0x000055555566bfa0 in ?? ()
#73 0x00007ffff2aa26a3 in QObject::event(QEvent*) () from /opt/binaryninja/libQt6Core.so.6
#74 0x00007ffff70cc8bb in QWidget::event(QEvent*) () from /opt/binaryninja/libQt6Widgets.so.6
#75 0x00007ffff707383c in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /opt/binaryninja/libQt6Widgets.so.6
#76 0x00007ffff707d9f0 in QApplication::notify(QObject*, QEvent*) () from /opt/binaryninja/libQt6Widgets.so.6
#77 0x00007ffff2a4f543 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from /opt/binaryninja/libQt6Core.so.6
#78 0x00007ffff2a52e56 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) () from /opt/binaryninja/libQt6Core.so.6
#79 0x00007ffff2beae20 in QEventDispatcherUNIX::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /opt/binaryninja/libQt6Core.so.6
#80 0x00007fffee06425e in ?? () from /opt/binaryninja/qt/platforms/../../libQt6XcbQpa.so.6
#81 0x00007ffff2a5bafa in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /opt/binaryninja/libQt6Core.so.6
#82 0x00007ffff2a573b6 in QCoreApplication::exec() () from /opt/binaryninja/libQt6Core.so.6
#83 0x00005555555ced8e in ?? ()
#84 0x00007ffff2398b25 in __libc_start_main () from /usr/lib/libc.so.6
#85 0x00005555555daa1a in ?? ()

Does this help somehow?

[psifertex]

Bv comes from having a file open. Re run that script after opening any file or modify it to just copy a fixed string instead. I just pointed to that example since it uses pyside.

Yes, a different QT installed can absolutely cause problems. Can either try uninstalling or checking paths/environment variables to see if it's loaded. The problem is that pyside might be trying to find QT on its own which would be why the native product is fine but UI plugins are failing.

[psifertex]

Hmm, the crash dump doesn't immediately give me any insight but I can ask the rest of the team next week if they have ideas.

[clark-ja]

when running import PySide2 (as in the Gist you suggested) I get this error:

Traceback (most recent call last):
  File "<console>", line 1, in <module>
  File "/opt/binaryninja/plugins/../python3/PySide2/__init__.py", line 1, in <module>
    raise ImportError("Qt 6 must import PySide6 instead of PySide2")
ImportError: Qt 6 must import PySide6 instead of PySide2

and I'm a bit confused about it. According to https://docs.binary.ninja/about/open-source.html#building-qt Binary Ninja uses "Qt 5.15 or Qt 6.0" (which one is it actually?). Qt 5.x would be supported by PySide2 (according to their docs), but Qt 6.x needs PySide6. So the dev version of Binary Ninja seems to use Qt 6.x but doesn't ship the correct PySide python package?

EDIT: nvm, I just overlooked it. PySide6 is there as well.

[clark-ja]

Ok, so replacing PySide2 with PySide6 in the Gist you suggested, Binary Ninja (2.4.3031-dev) does not crash. So maybe not a Qt issue at all but something else entirely?

I have Qt5 installed on this system for other applications but unfortunately I can't uninstall it for testing without removing a lot of programs.

EDIT: If it were at Qt issue wouldn't I also notice it just running plain Binary Ninja without Plugins? Why would the issue only occur with the plugins?

[psifertex]

Binary Ninja is linked against the specific QT it ships with. PySide in the other hand has a complicated linking process that is more fragile.

If the outside example works I'm surprised that plug-ins are also failing. You can also try running strace on the version that crashes and see if you see the process accessing the "wrong" QT when trying to activate the plugins that are not working.

[clark-ja]

For Binary Ninja version 2.4.3031-dev this is the complete list of accessed python packages between the click on Enable (in this case of the Debugger plugin) and the segmentation fault. I used FRIDA to get it:

binaryninjaui
PySide6
shiboken6

So no access to a wrong Qt version here.

Other than that only files for the plugin are accessed (e.g. no system Qt libs). This is the complete list of accessed files when trying to enable the Debugger plugin (apart from the python modules mentioned above):

HOME_DIR/.binaryninja/repositories/official/plugins/Vector35_debugger/binjaplug.py
HOME_DIR/.binaryninja/repositories/official/plugins/Vector35_debugger/dbgeng.py
HOME_DIR/.binaryninja/repositories/official/plugins/Vector35_debugger/DebugAdapter.py
HOME_DIR/.binaryninja/repositories/official/plugins/Vector35_debugger/dockwidgets/BreakpointsWidget.py
HOME_DIR/.binaryninja/repositories/official/plugins/Vector35_debugger/dockwidgets/__pycache__/BreakpointsWidget.cpython-39.pyc
HOME_DIR/.binaryninja/repositories/official/plugins/Vector35_debugger/gdblike.py
HOME_DIR/.binaryninja/repositories/official/plugins/Vector35_debugger/__init__.py
HOME_DIR/.binaryninja/repositories/official/plugins/Vector35_debugger/plugin.json
HOME_DIR/.binaryninja/repositories/official/plugins/Vector35_debugger/ProcessView.py
HOME_DIR/.binaryninja/repositories/official/plugins/Vector35_debugger/__pycache__/binjaplug.cpython-39.pyc
HOME_DIR/.binaryninja/repositories/official/plugins/Vector35_debugger/__pycache__/dbgeng.cpython-39.pyc
HOME_DIR/.binaryninja/repositories/official/plugins/Vector35_debugger/__pycache__/DebugAdapter.cpython-39.pyc
HOME_DIR/.binaryninja/repositories/official/plugins/Vector35_debugger/__pycache__/gdblike.cpython-39.pyc
HOME_DIR/.binaryninja/repositories/official/plugins/Vector35_debugger/__pycache__/__init__.cpython-39.pyc
HOME_DIR/.binaryninja/repositories/official/plugins/Vector35_debugger/__pycache__/ProcessView.cpython-39.pyc
HOME_DIR/.binaryninja/repositories/official/plugins/Vector35_debugger/__pycache__/QueuedAdapter.cpython-39.pyc
HOME_DIR/.binaryninja/repositories/official/plugins/Vector35_debugger/__pycache__/rsp.cpython-39.pyc
HOME_DIR/.binaryninja/repositories/official/plugins/Vector35_debugger/__pycache__/ui.cpython-39.pyc
HOME_DIR/.binaryninja/repositories/official/plugins/Vector35_debugger/QueuedAdapter.py
HOME_DIR/.binaryninja/repositories/official/plugins/Vector35_debugger/rsp.py
HOME_DIR/.binaryninja/repositories/official/plugins/Vector35_debugger/ui.py

EDIT: of course I can't rule out that some other resource (e.g. a wrong Qt version) was already loaded into memory at an earlier point in time and used at the time of the crash but I haven't found such a resource even when tracing binaryninja since the program start - but maybe I'm not looking for the right resource :/

[clark-ja]

not sure if that helps but I narrowed the crash, when trying to enable the Debugger plugin, down to this python line (in HOME_DIR/.binaryninja/repositories/official/plugins/Vector35_debugger/dockwidgets/widget.py) :

# added the parameter values at the time of the crash for clarity
dock_handler.addDockWidget(
    name="Debugger Breakpoints",
    lambda n,p,d: create_widget(widget_class=<class 'Vector35_debugger.dockwidgets.BreakpointsWidget.DebugBreakpointsWidget'>, n, p, d),
    area=PySide6.QtCore.Qt.DockWidgetArea.BottomDockWidgetArea,
    orientation=PySide6.QtCore.Qt.Orientation.Horizontal,
    default_visibility=False
)

so the crash happens when this Cpp function is called (in /opt/binaryninja/python3/binaryninjaui/binaryninjaui.abi3.so):

bool DockHandler::addDockWidget (
    const QString & name,
    const std::function< QWidget *(const QString &, ViewFrame *, BinaryViewRef)> &  createWidget,
    Qt::DockWidgetArea area = Qt::BottomDockWidgetArea,
    Qt::Orientation orientation = Qt::Horizontal,
    bool defaultVisibility = false
)