Skip to content

Unnecessary cs segment override prefix (in Win32 flat mode) breaks jump table lifting #8477

Description

@ArcaneNibble

Version and Platform (required):

  • Binary Ninja Version: 5.3.9757 Personal (a99f2380)
  • OS: macOS
  • OS Version: 26.6.1
  • CPU Architecture: ARM64

Bug Description:
I have a Win32 user-mode binary from the 90s that, for whatever reason, contains a redundant 0x2e segment override prefix on a jmp [sib] opcode, where the SIB encodes a jump table which follows immediately afterwards (all absolute addresses, not position-independent).

Binary Ninja decides to turn this into an "Unresolved Indirect Control Flow" even though this segment override has no effect in Win32.

If I manually patch the segment override prefix into a nop in the hex editor view, this is able to work around the problem (in only that specific instance, of course).

Steps To Reproduce:
Please provide all steps required to reproduce the behavior:

  1. Load a binary that contains an unnecessary segment override as I've shown
  2. Look in the disassembly view and notice the large red ? question mark.
  3. Look in the LLIL view and see cs.d as part of the jump computation.
  4. Patch the 0x2e to 0x90 in the hex editor. Observe that everything works now.

Expected Behavior:
x86 segment overrides should be ignored on platforms where they are known to not do anything (which includes most modern userspace, for segments other than fs/gs)

Screenshots/Video Recording:
Screenshots of Binary Ninja seeing the segment override:

Image Image

Screenshot after manual patches in the hex editor

Image

Binary:
Unfortunately, I do not have permission to share the binary.

Additional Information:
N/A

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions