| Age | Commit message (Collapse) | Author |
|---|
|
|
|
|
|
|
|
The addends were correctly stored in the relocation info and displayed
as offsets in linear view, but the relocation handlers never applied
them. Reading from an address containing such a relocation would give an
incorrect value.
|
|
Fixes https://github.com/Vector35/binaryninja-api/issues/7989.
Also corrects an oversight from d92b3684 in handling of library ordinals
>= 128.
|
|
These lookup modes are negative values that are encoded in the library
ordinal, an unsigned field, of an import fixup entry. Incorrect sign
extension when converting these ordinals back to signed values led
to them being misinterpreted.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
wrong time
|
|
The `FileAccessorCache`'s LRU eviction could discard a file's mapped
data after slide info had already been applied to it. Future accesses to
the file produced a fresh mapping, but failed to reapply the slide info.
This could result in pointers not correctly being slid, such as in
https://github.com/Vector35/binaryninja-api/issues/7689.
The LRU cache existed to stay within OS file descriptor limits, since
the old `MappedFile` held its fd open for the lifetime of the mapping.
There's no real reason for it to hold the file descriptor open like
this. Closing it after `mmap` is sufficient to avoid the file descriptor
limits.
`MappedFileRegion` replaces the combination of `FileAccessorCache`,
`WeakFileAccessor`, and `MappedFileAccessor`. It closes the fd
immediately after mmap, so all files can stay mapped without consuming
descriptors, making the cache unnecessary.
`MappedFileRegion` is owned directly by the `CacheEntry` for its full
lifetime. Slide info is applied exactly once to each `MappedFileRegion`.
|
|
Co-authored-by: Mason Reed <mason@vector35.com>
|
|
This builds on the existing support for opening kernel caches directly from IM4P payload files,
and allows opening macOS kernel caches directly from
`/System/Volumes/Preboot/<apfs-uuid>/boot/<boot-manifest-hash>/System/Library/Caches/com.apple.kernelcaches/kernelcache`.
|
|
This reverts commit bcc40473b3660005e83f51150bdc17ae177768dc.
|
|
This reverts commit 4573354f23da495099983dac4b665988cd837ff5.
|
|
|
|
|
|
Register plugins which are available outside the context of a binary view
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Allow users to easily create, diff, dump and validate type libraries
Supports the following formats:
- C header files (via core type parsers)
- Binary files (collects exported and imported functions)
- WinMD files (via `windows-metadata` crate)
- Existing type library files (for easy fixups)
- Apiset files (to resolve through forwarded windows dlls)
Can be invoked as a regular plugin via UI commands or via CLI.
Processing of type libraries inherently requires external linking, processing will automatically merge and deduplicate colliding type libraries so prefer to use inside a project or a directory and process all information (for a given platform) at once, rather than smaller invocations.
|
|
|
|
Previously you must have written the type library to disk
|
|
`TypeLibrary::remove_named_type`
|
|
|
|
`TypeLibrary.remove_named_type`
|
|
Useful when relocating information between type libraries before finalization
|
|
|
|
|
|
Use these when you intend to query through the `FileMetadata::project_file`, if you do not use these then you will be in a detached binary view from the originating project
|
|
automatically
|
|
pulling remote projects
|
|
|
|
|
|
|
|
- Rename and retype `FileMetadata::filename` and make the assignment required to happen at time of construction.
- Add `FileMetadata::display_name` which is only to be used for presentation purposes.
- Add `FileMetadata::virtual_path` for containers.
- Rename `FileMetadata::modified` to `FileMetadata::is_modified` to be more consistent across codebase.
- Add some missing documentation.
- Add `BinaryView::from_metadata` with accompanying documentation.
|
|
|
