diff options
| author | Mark Rowe <mark@vector35.com> | 2025-08-11 10:42:07 -0700 |
|---|---|---|
| committer | Mark Rowe <mark@vector35.com> | 2025-08-27 19:15:49 -0700 |
| commit | 2303f75b080f6dd0c9a5c669a71f64ce830f5650 (patch) | |
| tree | a49d80ea0a8131a50c16f85e767722679ff08c85 /docs | |
| parent | b302d7ba796f41b1102ee61feed8b8e212299997 (diff) | |
Rewrite Obj-C workflow in Rust
This is functionally equivalent to the previous workflow_objc, with the
following changes:
1. It mutates the `core.function.metaAnalysis` workflow rather than
registering a new named workflow. The activities now all check for
the presence of the Objective-C metadata added by `ObjCProcessor` to
determine whether they should do work, rather than relying on
`MachoView` to override the function workflow when Objective-C
metadata is present. This fixes
https://github.com/Vector35/binaryninja-api/issues/6779.
2. The auto-inlining of `objc_msgSend` selector stub functions is
performed in a separate activity from the processing of
`objc_msgSend` call sites. The selector stub inlining activity is
configured so that it does not run in `DSCView` as the shared cache
needs different behavior for stub functions more generally that
`SharedCacheWorkflow` already provides.
3. The way that types like `id` and `SEL` are referenced is fixed so
that they show up as `id` rather than `objc_struct*`.
This also replaces the Objective-C portion of the shared cache's
workflow, and incorporates several bug fixes that had been applied to it
but not the standalone Objective-C workflow.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/guide/objectivec.md | 41 | ||||
| -rw-r--r-- | docs/img/objc-workflow-selected.png | bin | 71140 -> 0 bytes | |||
| -rw-r--r-- | docs/img/pseudo-objc-menu-item.png | bin | 0 -> 258631 bytes |
3 files changed, 23 insertions, 18 deletions
diff --git a/docs/guide/objectivec.md b/docs/guide/objectivec.md index 5fef33bc..3c4414b9 100644 --- a/docs/guide/objectivec.md +++ b/docs/guide/objectivec.md @@ -1,35 +1,40 @@ # Objective-C -Binary Ninja ships with [an additional plugin](https://github.com/Vector35/workflow_objc) for assisting with Objective-C analysis. +Binary Ninja ships with built-in functionality for assisting with Objective-C analysis. A brief summary of the features offered is as follows: -- **Function Call Cleanup.** When using the Objective-C workflow, calls to - `objc_msgSend` can be replaced with direct calls to the relevant function's - implementation. - - **Name and Type Recovery.** Using runtime information embedded in the - binary, Binary Ninja can automatically apply names and type information to + binary, Binary Ninja automatically applies names and type information to Objective-C functions. - **Structure Markup.** Data variables are automatically created for Objective-C structures such as classes and method lists to enable easy navigation. -- **Data Renderers.** Formatting of Objective-C types such as tagged and/or - (image-)relative pointers is improved via custom data renderers. +- **String Literal Handling.** Data variables are automatically created for all + `CFString` or `NSString` instances present in the binary. -- **CFString Handling.** Data variables are automatically created for all - `CFString` instances present in the binary. +- **Automatic Call Type Adjustments.** Binary Ninja automatically infers the number of arguments and their names + for individual calls to `objc_msgSend` and `objc_msgSendSuper2`. Argument names are derived from the selector + components, and argument types are inferred in limited cases. -## Usage +- **Pseudo Objective-C Language.** Decompiled code can be displayed using a _Pseudo Objective-C_ + language syntax. This renders `objc_msgSend` and other Objective-C runtime calls using the + `[receiver message:argument other:argument2]` syntax found in Objective-C source code. + Additionally, literals such as `CFString` or `NSString` are displayed inline as `@"string"`. -If you have an Objective-C binary opening in Binary Ninja should automatically process -the information. This is handled by the view, e.g. MACH-O & Shared Cache. +- **Direct Call Rewriting.** Calls to `objc_msgSend` can be rewritten to be direct calls to + the first known method implementation for that selector. + + This is disabled by default as it will give potentially confusing results for any selector + that has more than one implementation or for common selector names. That said, some users may + still find it to be useful. It can be enabled via `analysis.objectiveC.resolveDynamicDispatch` + setting. + +## Usage -### Workflow +Objective-C metadata will be automatically processed when you open a Mach-O or DYLD shared cache binary in Binary Ninja. -To utilize function call cleanup, the Objective-C workflow must be chosen when loading a binary for analysis. +The Pseudo Objective-C Language representation is available via the language pop-up menu at the top of Linear and Graph views: - + -This will automatically apply structure analysis as the binary is analyzed and -also translate `objc_msgSend` calls to direct method calls, where possible. diff --git a/docs/img/objc-workflow-selected.png b/docs/img/objc-workflow-selected.png Binary files differdeleted file mode 100644 index 14d4c4ac..00000000 --- a/docs/img/objc-workflow-selected.png +++ /dev/null diff --git a/docs/img/pseudo-objc-menu-item.png b/docs/img/pseudo-objc-menu-item.png Binary files differnew file mode 100644 index 00000000..e0db6c4a --- /dev/null +++ b/docs/img/pseudo-objc-menu-item.png |
