Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Analysis is not updated after patching code #26

Closed
xusheng6 opened this issue Nov 25, 2021 · 3 comments
Closed

Analysis is not updated after patching code #26

xusheng6 opened this issue Nov 25, 2021 · 3 comments
Labels
Effort: Medium functionality core functionalities of a debugger Impact: Medium

Comments

@xusheng6
Copy link
Member

xusheng6 commented Nov 25, 2021

Currently, patching and writing to memory work fine. However, after the code is patched, the analysis is not updated and the graph still displays the old code. A reanalysis fixes the problem.

There are multiple ways to fix this. One way is to register a binary data notification and update the analysis from within in. However, when we patch the code normally (i.e., when there is no debugger attached), the analysis is updated, and it does not rely on binary data notification. I am yet to understand why it works.

@xusheng6 xusheng6 added Effort: Medium functionality core functionalities of a debugger Impact: Medium labels Nov 25, 2021
@xusheng6
Copy link
Member Author

Related to Vector35/binaryninja-api#2105

@xusheng6
Copy link
Member Author

The target's code does get patched properly -- we just lack an update in the BN

@xusheng6
Copy link
Member Author

xusheng6 commented Dec 10, 2021

The problem turns out to be that BinaryDataNotifications are not called for any custom binary view that overrides PerformWrite(). The notification callback marks the binary view for update. In commit 0ad5529, I explicitly called BinaryView::NotifyDataWritten() and now it works.

However, there might still be a problem since it is hard for people outside of the dev team to figure out this. Also, BinaryData does other things besides notifying the callbacks, most notably, updating the binaryview's modification status. Although missing that is fine for debugger, since a modification status itself for the DebugProcessView is not very meaningful/helpful.

The Python debugger seems not bothered by this. The binary view is properly updated after making patches. It uses two BinaryViews, one to hold the memory content, the other one to provide higher-level functionalities. However, in the C++ version, we are only having one view. We should experiment whether using two views resolve the issue, in a better way.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Effort: Medium functionality core functionalities of a debugger Impact: Medium
Projects
None yet
Development

No branches or pull requests

1 participant