Skip to content

Invalid function parameters on most functions of the Windows NT kernel #8367

Description

@joaquimbc

Version and Platform (required):

  • Binary Ninja Version: 5.4.10193
  • Edition: Non-Commercial
  • OS: Windows 11
  • OS Version: 25H2
  • CPU Architecture: x64

Bug Description:
Opening the Windows NT kernel on Binja makes half the functions erroneously contain ZMM registers as arguments (or spilled stack args, if there's no more ZMM registers). Makes analyzing it much harder with the amount of noise. It might be a regression, stable 5.3 R2 still has ZMM polluting everything but latest dev always has one more ZMM arg on the signature. Some functions are also missing types on dev, even though they come from the PDB, it appears correctly on stable

I've tried removing or disabling sysv as a calling convention but the issue still persists. Loading the PDB or not still doesn't changes the signatures

Steps To Reproduce:

  1. Open ntoskrnl.exe on binja
  2. Wait for analysis to finish, as function signatures first appear correctly but ZMM registers propagate over time everywhere

Expected Behavior:
Not having int512_t parameters everywhere

Screenshots/Video Recording:
[5.4.10193 vs 5.3.9757]
Image
Image
Image
Image
Image
Image

Binary:
I'm using my own system's ntoskrnl.exe, I assume you can grab any WIndows's installation for it, it's on Windows/System32. But I've reattached it here anyways

Additional information:
These issues seem related to this one, if not the same: #7665 and #7673

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions