| Age | Commit message (Collapse) | Author |
|---|
|
operations
A new activity is added that will remove calls to `objc_retain`,
`objc_release`, `objc_autorelease`, and related functions. It is
disabled by default due to the fact it changes the semantics of the
code. It can be enabled on a per-function basis via the Function
Settings context menu or command palette entry. Alternatively, it can be
enabled in Open with Options or in user settings if a user would prefer
it be on for an entire file or for all files they open.
For now the activity is only eligible within arm64 binaries. Supporting
x86_64 will require matching some slightly different IL patterns.
|
|
|
|
|
|
|
|
`LC_FUNCTION_STARTS` includes both functions and jump tables. We want to
avoid calling `AddFunctionForAnalysis` on jump tables since it can
result in a function being created at the jump table's location with a
bogus body.
We already skip adding functions for entries in `LC_FUNCTION_STARTS` if
the lifting of their first few bytes end up including `LLIL_UNDEF`.
However, arm64 intentionally lifts `udf` instructions (i.e., opcodes in
the Permanently Undefined range) to `LLIL_TRAP` in order to preserve the
immediate portion of the instruction.
To address this, `MachoView::IsValidFunctionStart` now returns false if
the first lifted instruction is `LLIL_TRAP` in addition to when the
lifting contains `LLIL_UNDEF`.
|
|
|
|
|
|
|
|
|
|
Most members were initialized within the constructor, but a couple were
only initialized later and could in some cases be accessed before being
initialized.
Members of types without default constructors are now initialized via
default member initializers unless they're initialized in the class's
member initializer list.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
LowLevelILFunction objects can be constructed without a owner
function. BNGetLowLevelILOwnerFunction can return NULL and must be
checked before creating a Function object.
|
|
Required for implementing guided analysis mode in custom
implementations of analyze_basic_blocks
|
|
|
|
This allows types to propagate to thunks in cases where there are
GOT entries for internal functions
|
|
|
|
|
|
|
|
|
|
|
|
by default
The table views previously visually suggested they were being sorted by
address, but in practice they were not sorted until the user set an
explicit sort order by clicking on a column header.
|
|
|
|
Alongside this I also added support for decoding:
* LDR / STR (table)
* PMULLB / PMULLT
* ABS / CNT / CTZ
* SMIN / SMAX / UMIN / UMAX
* RPRFM
* PSEL
Note that while these instructions will now be disassembled, they are
not yet lifted to LLIL.
Additionally, I fixed a number of errors in the decoding of some less
commonly occurring instructions.
|
|
|
|
expr index
|
|
|
|
1. In the client license, we refer to sections "6 through 14" in section
2, but there are only 13 sections. This has been updated.
2. In the server license, an extra newline caused numbering to be wrong
for all other sections past section 3. This has been corrected.
|
|
|
|
Removed instruction for password protection when uploading malware.
|
|
|
|
|
|
Calls to `objc_msgSendSuper2` with a selector in the `init` family are
detected and their arguments are analyzed to determine the receiver
class. A call type adjustment is added to update the return type.
This handles most calls to `[super init]` from Objective-C code as the
compiler generates a straightforward code sequence for these calls. Some
calls from Swift are handled, but the Swift compiler generates more varied
code so additional work is needed for complete coverage.
|
|
|
|
|
|
These files are present alongside iOS 26 shared caches. Explicitly
ignoring them avoids an error being logged to the console.
|
|
In some iOS 15 caches, the .symbols file's mapping has an address of 0.
This would cause it to be returned by `SharedCache::GetEntryContaining`
and loaded into the view.
The .symbols file contains the local symbol tables for images in the
shared cache. It is not intended to be mapped into the same address
space as the rest of the shared cache.
`SharedCache` now tracks the symbols cache entry separately from other
entries. A dedicated `VirtualMemory` region is used when accessing the
data it contains. This could be a `FileAccessor`, but that would require
additional changes within `SharedCacheMachOHeader`.
`SharedCacheMachOProcessor` now directly accesses the local symbols
cache entry rather than needing to search for it.
|
|
Prior to macOS 13 / iOS 16, the base offset to use for relative direct
selector references within Objective-C message lists was stored within
the `__TEXT,__objc_opt_ro` section of /usr/lib/libobjc.A.dylib.
|
|
A mapping from imported symbol names to libraries is added to metadata.
This is used to populate external links for files within projects,
following the lead of `PEView`.
|
|
implementations
|
|
|
|
|
|
|
|
|
|
|
|
|
