summaryrefslogtreecommitdiff
path: root/docs
diff options
context:
space:
mode:
authorMark Rowe <mark@vector35.com>2025-08-11 10:42:07 -0700
committerMark Rowe <mark@vector35.com>2025-08-27 19:15:49 -0700
commit2303f75b080f6dd0c9a5c669a71f64ce830f5650 (patch)
treea49d80ea0a8131a50c16f85e767722679ff08c85 /docs
parentb302d7ba796f41b1102ee61feed8b8e212299997 (diff)
Rewrite Obj-C workflow in Rust
This is functionally equivalent to the previous workflow_objc, with the following changes: 1. It mutates the `core.function.metaAnalysis` workflow rather than registering a new named workflow. The activities now all check for the presence of the Objective-C metadata added by `ObjCProcessor` to determine whether they should do work, rather than relying on `MachoView` to override the function workflow when Objective-C metadata is present. This fixes https://github.com/Vector35/binaryninja-api/issues/6779. 2. The auto-inlining of `objc_msgSend` selector stub functions is performed in a separate activity from the processing of `objc_msgSend` call sites. The selector stub inlining activity is configured so that it does not run in `DSCView` as the shared cache needs different behavior for stub functions more generally that `SharedCacheWorkflow` already provides. 3. The way that types like `id` and `SEL` are referenced is fixed so that they show up as `id` rather than `objc_struct*`. This also replaces the Objective-C portion of the shared cache's workflow, and incorporates several bug fixes that had been applied to it but not the standalone Objective-C workflow.
Diffstat (limited to 'docs')
-rw-r--r--docs/guide/objectivec.md41
-rw-r--r--docs/img/objc-workflow-selected.pngbin71140 -> 0 bytes
-rw-r--r--docs/img/pseudo-objc-menu-item.pngbin0 -> 258631 bytes
3 files changed, 23 insertions, 18 deletions
diff --git a/docs/guide/objectivec.md b/docs/guide/objectivec.md
index 5fef33bc..3c4414b9 100644
--- a/docs/guide/objectivec.md
+++ b/docs/guide/objectivec.md
@@ -1,35 +1,40 @@
# Objective-C
-Binary Ninja ships with [an additional plugin](https://github.com/Vector35/workflow_objc) for assisting with Objective-C analysis.
+Binary Ninja ships with built-in functionality for assisting with Objective-C analysis.
A brief summary of the features offered is as follows:
-- **Function Call Cleanup.** When using the Objective-C workflow, calls to
- `objc_msgSend` can be replaced with direct calls to the relevant function's
- implementation.
-
- **Name and Type Recovery.** Using runtime information embedded in the
- binary, Binary Ninja can automatically apply names and type information to
+ binary, Binary Ninja automatically applies names and type information to
Objective-C functions.
- **Structure Markup.** Data variables are automatically created for Objective-C
structures such as classes and method lists to enable easy navigation.
-- **Data Renderers.** Formatting of Objective-C types such as tagged and/or
- (image-)relative pointers is improved via custom data renderers.
+- **String Literal Handling.** Data variables are automatically created for all
+ `CFString` or `NSString` instances present in the binary.
-- **CFString Handling.** Data variables are automatically created for all
- `CFString` instances present in the binary.
+- **Automatic Call Type Adjustments.** Binary Ninja automatically infers the number of arguments and their names
+ for individual calls to `objc_msgSend` and `objc_msgSendSuper2`. Argument names are derived from the selector
+ components, and argument types are inferred in limited cases.
-## Usage
+- **Pseudo Objective-C Language.** Decompiled code can be displayed using a _Pseudo Objective-C_
+ language syntax. This renders `objc_msgSend` and other Objective-C runtime calls using the
+ `[receiver message:argument other:argument2]` syntax found in Objective-C source code.
+ Additionally, literals such as `CFString` or `NSString` are displayed inline as `@"string"`.
-If you have an Objective-C binary opening in Binary Ninja should automatically process
-the information. This is handled by the view, e.g. MACH-O & Shared Cache.
+- **Direct Call Rewriting.** Calls to `objc_msgSend` can be rewritten to be direct calls to
+ the first known method implementation for that selector.
+
+ This is disabled by default as it will give potentially confusing results for any selector
+ that has more than one implementation or for common selector names. That said, some users may
+ still find it to be useful. It can be enabled via `analysis.objectiveC.resolveDynamicDispatch`
+ setting.
+
+## Usage
-### Workflow
+Objective-C metadata will be automatically processed when you open a Mach-O or DYLD shared cache binary in Binary Ninja.
-To utilize function call cleanup, the Objective-C workflow must be chosen when loading a binary for analysis.
+The Pseudo Objective-C Language representation is available via the language pop-up menu at the top of Linear and Graph views:
-![](../img/objc-workflow-selected.png)
+![](../img/pseudo-objc-menu-item.png)
-This will automatically apply structure analysis as the binary is analyzed and
-also translate `objc_msgSend` calls to direct method calls, where possible.
diff --git a/docs/img/objc-workflow-selected.png b/docs/img/objc-workflow-selected.png
deleted file mode 100644
index 14d4c4ac..00000000
--- a/docs/img/objc-workflow-selected.png
+++ /dev/null
Binary files differ
diff --git a/docs/img/pseudo-objc-menu-item.png b/docs/img/pseudo-objc-menu-item.png
new file mode 100644
index 00000000..e0db6c4a
--- /dev/null
+++ b/docs/img/pseudo-objc-menu-item.png
Binary files differ