Move workflow_objc to API repo, remove CFString & relptr renderers

1 files changed, 299 insertions, 0 deletions

diff --git a/plugins/workflow_objc/Workflow.cpp b/plugins/workflow_objc/Workflow.cpp
new file mode 100644
index 00000000..3be2a042
--- /dev/null
+++ b/plugins/workflow_objc/Workflow.cpp
@@ -0,0 +1,299 @@
+/*
+ * Copyright (c) 2022-2023 Jon Palmisciano. All rights reserved.
+ *
+ * Use of this source code is governed by the BSD 3-Clause license; the full
+ * terms of the license can be found in the LICENSE.txt file.
+ */
+
+#include "Workflow.h"
+
+#include "Constants.h"
+#include "GlobalState.h"
+#include "Performance.h"
+
+#include <lowlevelilinstruction.h>
+
+#include <queue>
+#include "binaryninjaapi.h"
+
+static std::mutex g_initialAnalysisMutex;
+
+using SectionRef = BinaryNinja::Ref<BinaryNinja::Section>;
+using SymbolRef = BinaryNinja::Ref<BinaryNinja::Symbol>;
+
+namespace {
+
+std::vector<std::string> splitSelector(const std::string& selector) {
+    std::vector<std::string> components;
+    std::istringstream stream(selector);
+    std::string component;
+
+    while (std::getline(stream, component, ':')) {
+        if (!component.empty()) {
+            components.push_back(component);
+        }
+    }
+
+    return components;
+}
+
+// Given a selector component such as `initWithPath' and a prefix of `initWith`, returns `path`.
+std::optional<std::string> SelectorComponentWithoutPrefix(std::string_view prefix, std::string_view component)
+{
+    if (component.size() <= prefix.size() || component.rfind(prefix.data(), 0) != 0
+        || !isupper(component[prefix.size()])) {
+        return std::nullopt;
+    }
+
+    std::string result(component.substr(prefix.size()));
+
+    // Lowercase the first character if the second character is not also uppercase.
+    // This ensures we leave initialisms such as `URL` alone.
+    if (result.size() > 1 && islower(result[1]))
+        result[0] = tolower(result[0]);
+
+    return result;
+}
+
+std::string ArgumentNameFromSelectorComponent(std::string component)
+{
+    // TODO: Handle other common patterns such as <do some action>With<arg>: and <do some action>For<arg>:
+    for (const auto& prefix : { "initWith", "with", "and", "using", "set", "read", "to", "for" }) {
+        if (auto argumentName = SelectorComponentWithoutPrefix(prefix, component); argumentName.has_value())
+            return std::move(*argumentName);
+    }
+
+    return component;
+}
+
+std::vector<std::string> generateArgumentNames(const std::vector<std::string>& components) {
+    std::vector<std::string> argumentNames;
+
+    for (const std::string& component : components) {
+        size_t startPos = component.find_last_of(" ");
+        std::string argumentName = (startPos == std::string::npos) ? component : component.substr(startPos + 1);
+        argumentNames.push_back(ArgumentNameFromSelectorComponent(std::move(argumentName)));
+    }
+
+    return argumentNames;
+}
+
+} // unnamed namespace
+
+bool Workflow::rewriteMethodCall(LLILFunctionRef ssa, size_t insnIndex)
+{
+    const auto bv = ssa->GetFunction()->GetView();
+    const auto llil = ssa->GetNonSSAForm();
+    const auto insn = ssa->GetInstruction(insnIndex);
+    const auto params = insn.GetParameterExprs<LLIL_CALL_SSA>();
+
+    // The second parameter passed to the objc_msgSend call is the address of
+    // either the selector reference or the method's name, which in both cases
+    // is dereferenced to retrieve a selector.
+    if (params.size() < 2)
+        return false;
+    uint64_t rawSelector = 0;
+    if (params[1].operation == LLIL_REG_SSA)
+    {
+        const auto selectorRegister = params[1].GetSourceSSARegister<LLIL_REG_SSA>();
+        rawSelector = ssa->GetSSARegisterValue(selectorRegister).value;
+    }
+    else if (params[0].operation == LLIL_SEPARATE_PARAM_LIST_SSA)
+    {
+        if (params[0].GetParameterExprs<LLIL_SEPARATE_PARAM_LIST_SSA>().size() == 0)
+        {
+            return false;
+        }
+        const auto selectorRegister = params[0].GetParameterExprs<LLIL_SEPARATE_PARAM_LIST_SSA>()[1].GetSourceSSARegister<LLIL_REG_SSA>();
+        rawSelector = ssa->GetSSARegisterValue(selectorRegister).value;
+    }
+    if (rawSelector == 0)
+        return false;
+
+    // -- Do callsite override
+    auto reader = BinaryNinja::BinaryReader(bv);
+    reader.Seek(rawSelector);
+    auto selector = reader.ReadCString(500);
+    auto additionalArgumentCount = std::count(selector.begin(), selector.end(), ':');
+
+    auto retType = bv->GetTypeByName({ "id" });
+    if (!retType)
+        retType = BinaryNinja::Type::PointerType(ssa->GetArchitecture(), BinaryNinja::Type::VoidType());
+
+    std::vector<BinaryNinja::FunctionParameter> callTypeParams;
+    auto cc = bv->GetDefaultPlatform()->GetDefaultCallingConvention();
+
+    callTypeParams.push_back({"self", retType, true, BinaryNinja::Variable()});
+
+    auto selType = bv->GetTypeByName({ "SEL" });
+    if (!selType)
+        selType = BinaryNinja::Type::PointerType(ssa->GetArchitecture(), BinaryNinja::Type::IntegerType(1, true));
+    callTypeParams.push_back({"sel", selType, true, BinaryNinja::Variable()});
+
+    std::vector<std::string> selectorComponents = splitSelector(selector);
+    std::vector<std::string> argumentNames = generateArgumentNames(selectorComponents);
+
+    for (size_t i = 0; i < additionalArgumentCount; i++)
+    {
+        auto argType = BinaryNinja::Type::IntegerType(bv->GetAddressSize(), true);
+        if (argumentNames.size() > i && !argumentNames[i].empty())
+            callTypeParams.push_back({argumentNames[i], argType, true, BinaryNinja::Variable()});
+        else
+            callTypeParams.push_back({"arg" + std::to_string(i), argType, true, BinaryNinja::Variable()});
+    }
+
+    auto funcType = BinaryNinja::Type::FunctionType(retType, cc, callTypeParams);
+    ssa->GetFunction()->SetAutoCallTypeAdjustment(ssa->GetFunction()->GetArchitecture(), insn.address, {funcType, BN_DEFAULT_CONFIDENCE});
+    // --
+
+    if (!BinaryNinja::Settings::Instance()->Get<bool>("core.function.objectiveC.rewriteMessageSendTarget", bv))
+        return false;
+
+    // Check the analysis info for a selector reference corresponding to the
+    // current selector. It is possible no such selector reference exists, for
+    // example, if the selector is for a method defined outside the current
+    // binary. If this is the case, there are no meaningful changes that can be
+    // made to the IL, and the operation should be aborted.
+
+    // k: also check direct selector value (x64 does this)
+    const auto info = GlobalState::analysisInfo(bv);
+    if (!info)
+        return false;
+
+    // Attempt to look up the implementation for the given selector, first by
+    // using the raw selector, then by the address of the selector reference. If
+    // the lookup fails in both cases, abort.
+    std::vector<uint64_t> imps;
+    if (const auto& it = info->selRefToImp.find(rawSelector); it != info->selRefToImp.end())
+        imps = it->second;
+    else if (const auto& iter = info->selToImp.find(rawSelector); iter != info->selToImp.end())
+        imps = iter->second;
+
+    if (imps.empty())
+        return false;
+
+    // k: This is the same behavior as before, however it is more apparent now by implementation
+    //      that we are effectively just guessing which method this hits. This has _obvious_ drawbacks,
+    //      but until we have more robust typing and objective-c type libraries, fixing this would
+    //      make the objective-c workflow do effectively nothing.
+    uint64_t implAddress = imps[0];
+    if (!implAddress)
+        return false;
+
+    const auto llilIndex = ssa->GetNonSSAInstructionIndex(insnIndex);
+    auto llilInsn = llil->GetInstruction(llilIndex);
+
+    // Change the destination expression of the LLIL_CALL operation to point to
+    // the method implementation. This turns the "indirect call" piped through
+    // `objc_msgSend` and makes it a normal C-style function call.
+    auto callDestExpr = llilInsn.GetDestExpr<LLIL_CALL>();
+    callDestExpr.Replace(llil->ConstPointer(callDestExpr.size, implAddress, callDestExpr));
+    llilInsn.Replace(llil->Call(callDestExpr.exprIndex, llilInsn));
+
+    return true;
+}
+
+void Workflow::inlineMethodCalls(AnalysisContextRef ac)
+{
+    const auto func = ac->GetFunction();
+    const auto arch = func->GetArchitecture();
+    const auto bv = func->GetView();
+
+    if (GlobalState::viewIsIgnored(bv))
+        return;
+
+    const auto log = BinaryNinja::LogRegistry::GetLogger(PluginLoggerName);
+
+    // Ignore the view if it has an unsupported architecture.
+    //
+    // The reasoning for querying the default architecture here rather than the
+    // architecture of the function being analyzed is that the view needs to
+    // have a default architecture for the Objective-C runtime types to be
+    // defined successfully.
+    auto defaultArch = bv->GetDefaultArchitecture();
+    auto defaultArchName = defaultArch ? defaultArch->GetName() : "";
+    if (defaultArchName != "aarch64" && defaultArchName != "x86_64" && defaultArchName != "armv7" && defaultArchName != "thumb2") {
+        if (!defaultArch)
+            log->LogError("View must have a default architecture.");
+        else
+            log->LogError("Architecture '%s' is not supported", defaultArchName.c_str());
+
+        GlobalState::addIgnoredView(bv);
+        return;
+    }
+
+    if (auto info = GlobalState::analysisInfo(bv))
+    {
+        if (info->hasObjcStubs && func->GetStart() > info->objcStubsStartEnd.first && func->GetStart() < info->objcStubsStartEnd.second)
+        {
+            func->SetAutoInlinedDuringAnalysis({true, BN_FULL_CONFIDENCE});
+            // Do no further cleanup, this is a stub and it will be cleaned up after inlining
+            return;
+        }
+    }
+
+    auto messageHandler = GlobalState::messageHandler(bv);
+    if (!messageHandler->hasMessageSendFunctions()) {
+        //log->LogError("Cannot perform Objective-C IL cleanup; no objc_msgSend candidates found");
+        //GlobalState::addIgnoredView(bv);
+        //return;
+    }
+
+    const auto llil = ac->GetLowLevelILFunction();
+    if (!llil) {
+        // log->LogError("(Workflow) Failed to get LLIL for 0x%llx", func->GetStart());
+        return;
+    }
+    const auto ssa = llil->GetSSAForm();
+    if (!ssa) {
+        // log->LogError("(Workflow) Failed to get LLIL SSA form for 0x%llx", func->GetStart());
+        return;
+    }
+
+    const auto rewriteIfEligible = [bv, messageHandler, ssa](size_t insnIndex) {
+        auto insn = ssa->GetInstruction(insnIndex);
+
+        if (insn.operation == LLIL_CALL_SSA)
+        {
+            // Filter out calls that aren't to `objc_msgSend`.
+            auto callExpr = insn.GetDestExpr<LLIL_CALL_SSA>();
+            bool isMessageSend = messageHandler->isMessageSend(callExpr.GetValue().value);
+            if (auto symbol = bv->GetSymbolByAddress(callExpr.GetValue().value))
+                isMessageSend = isMessageSend || symbol->GetRawName() == "_objc_msgSend";
+            if (!isMessageSend)
+                return false;
+
+            return rewriteMethodCall(ssa, insnIndex);
+        }
+
+        return false;
+    };
+
+    bool isFunctionChanged = false;
+    for (const auto& block : ssa->GetBasicBlocks())
+        for (size_t i = block->GetStart(), end = block->GetEnd(); i < end; ++i)
+            if (rewriteIfEligible(i))
+                isFunctionChanged = true;
+
+    if (!isFunctionChanged)
+        return;
+
+    // Updates found, regenerate SSA form
+    llil->GenerateSSAForm();
+}
+
+static constexpr auto WorkflowInfo = R"({
+  "title": "Objective-C",
+  "description": "Enhanced analysis for Objective-C code.",
+  "capabilities": []
+})";
+
+void Workflow::registerActivities()
+{
+    const auto wf = BinaryNinja::Workflow::Instance("core.function.baseAnalysis")->Clone("core.function.objectiveC");
+    wf->RegisterActivity(new BinaryNinja::Activity(
+        ActivityID::ResolveMethodCalls, &Workflow::inlineMethodCalls));
+    wf->Insert("core.function.translateTailCalls", ActivityID::ResolveMethodCalls);
+
+    BinaryNinja::Workflow::RegisterWorkflow(wf, WorkflowInfo);
+}