summaryrefslogtreecommitdiff
path: root/view/kernelcache
AgeCommit message (Collapse)Author
2026-05-22Refactor calling conventions to support correct representation of structuresRusty Wagner
2026-05-19Fix leaks due to missing parenting of Qt objectsMark Rowe
2026-04-22Always show the triage view when opening a shared cache or kernel cacheMark Rowe
BinaryViewType gains a HasNoInitialContent function that views can use to suppress layout restoration when opening a file. The layout will still be restored when the view is loaded from a saved database. Fixes https://github.com/Vector35/binaryninja-api/issues/8083.
2026-02-23[KernelCache] Automatically unwrap kernel caches within a full IMG4 containerMark Rowe
This builds on the existing support for opening kernel caches directly from IM4P payload files, and allows opening macOS kernel caches directly from `/System/Volumes/Preboot/<apfs-uuid>/boot/<boot-manifest-hash>/System/Library/Caches/com.apple.kernelcaches/kernelcache`.
2026-02-06Add regex and case sensitivity options to FilterEditJosh Ferrell
2026-01-30Improve filename handling for container files.Brian Potchik
2026-01-01update copyrights for 2026Jordan Wiens
2025-12-20Fix many of the warnings that show up when compiling with GCC 15.2Mark Rowe
2025-12-08[KernelCache] Wrap section creation within BeginBulkAddSegments / ↵Mark Rowe
EndBulkAddSegments This defers rebuilding of the section map until after all sections for an image have been added, rather than having the section map be rebuilt after adding each section.
2025-12-08Introduce an RAII type for managing bulk symbol modificationsMark Rowe
Fixes https://github.com/Vector35/binaryninja-api/issues/7666. Correctly managing the state of bulk symbol modifications via `BeginBulkModifySymbols` / `EndBulkModifySymbols` is error-prone in the face of exceptions and early returns. Leaking a bulk symbol modification can leave the view in a state where no further changes to symbols will be applied. All users of the C++ API are encouraged to move from `BeginBulkModifySymbols` / `EndBulkModifySymbols` to the new `BulkSymbolModification` class.
2025-11-26[KernelCache] Place synthetic sections after the cache's address rangeMark Rowe
This ensures they do not overlap with any images that may later be loaded from the kernel cache. Fixes https://github.com/Vector35/binaryninja-api/issues/7634.
2025-11-11[KernelCache] Remove 'Load Selected Image and Dependencies'Mark Rowe
Fixes https://github.com/Vector35/binaryninja-api/issues/7615. The dependency loading for kernel cache images was copied from the shared cache code, and looks for `LC_LOAD_DYLIB` load commands to determine the direct dependencies of an image. Images in kernel caches don't use `LC_LOAD_DYLIB` load commands so no dependencies were ever loaded. It could, however, result in a crash.
2025-11-04Update FilterEdit and FilterTarget to preserve existing selectionsMark Rowe
The down and enter keys now preserve an existing selection in the associated list or table views, rather than unconditionally selecting or activating the first item.
2025-10-23[KernelCache] Set segment permissions based on how XNU initially maps themMark Rowe
XNU maps kernel cache segments in with different permissions than the load commands indicate. For instance, `__DATA_CONST` is initially mapped as read-write before later being re-mapped as read-only. Treating it as read-only results in analysis falsely assuming that global variables cannot change. To work around this we maintain a mapping from segment name to initial permissions (i.e., most lax permissions) and favor them over permissions derived from the segment load command. Section semantics are also derived from the segment's permissions when the segment is present in the mapping. The mapping is based on the initial permissions established by `arm_vm_prot_init` within the XNU source.
2025-10-18Add DecodeWithContext to LZFSETransform.Brian Potchik
2025-10-11Fix demo ifdefsJosh Ferrell
2025-10-10Add password prompting for encrypted containers in Container Browser.Brian Potchik
2025-10-07Remove old banners from DSC and KC pluginsMason Reed
Extra noise in the CMake configure step, much of the value from these has been removed after the refactor(s), e.g. metadata version is no longer used
2025-10-03Add zero-copy data pointer access for BinaryData objects for API-side ↵Brian Potchik
container transforms.
2025-10-03Update IMG4 transform to use DecodeWithContext and synthesize a filename for ↵Brian Potchik
the payload.
2025-10-01Cleanup for some container format handling.Brian Potchik
2025-09-30Initial support for opening container formats.Brian Potchik
2025-09-25Sort table views in the shared cache / kernel cache triage views by address ↵Mark Rowe
by default The table views previously visually suggested they were being sorted by address, but in practice they were not sorted until the user set an explicit sort order by clicking on a column header.
2025-09-05[KernelCache] Pass the correct flags when adding an image's segmentsMark Rowe
Fixes https://github.com/Vector35/binaryninja-api/issues/7354.
2025-09-02[SharedCache] Move plugin_rpath calls into BN_INTERNAL_BUILD blocksMark Rowe
These calls set the rpaths used for release builds of the dylibs using a macro that isn't available in the API repository. They are not necessary when building the shared cache plug-in outside of the context of the app.
2025-08-20Fix memory leak in LZFSE transform along with some other fixes.Brian Potchik
2025-08-14[Mac] Consistently specify rpaths for plug-insMark Rowe
C++ plug-ins now consistently use the `plugin_rpath` or `ui_plugin_rpath` macros to ensure they have `SKIP_BUILD_RPATH` set when building on Mac (i.e., no `LC_RPATH` is added). Rust plug-ins have their build.rs updated to only specify `-Wl,-rpath` when building for Linux. It is not needed on macOS. On macOS we instead explicitly specify an `@rpath`-relative install name. This doesn't change any behavior, but avoids leaving an absolute path as the library's install name and is consistent with CMake's behavior for C++ plug-ins.
2025-07-30Add dependency tracking to the Python code generationMark Rowe
This ensures that the Python source files are only generated and copied into the output directory if inputs have changed, rather than being done unconditionally.
2025-07-30[CMake] Specify CONFIGURE_DEPENDS for all file(GLOB ..)Mark Rowe
This ensures that CMake detects when files that match the glob are added or removed.
2025-07-28Improve and migrate to fmt logging functions in Mach-O/KernelCache/SharedCachekat
2025-07-23KernelCache: Fix double-click load dialog in symbol listkat
2025-07-22Fix an incorrect offset used in KernelCache header parsingkat
2025-07-16Mach-O/KernelCache warning cleanupkat
2025-07-15Added search placeholder for DSCView and KCView.Hongyu Chen
2025-07-15[KernelCache] Fix misc warningsMason Reed
2025-07-15Fix shared cache cmake artifact in kernel cacheMason Reed
2025-07-07KernelCache rewritekat
2025-06-25Fix cxx20 compiler warnings.Alexander Taylor
2025-06-25Update CXX_STANDARD to 20.Alexander Taylor
Also update minimum CMake version.
2025-06-25Remove implicit conversions from Confidence to underlying type, these can ↵Rusty Wagner
cause bugs and also issues with C++20
2025-06-04Fix calls to BNFreeString in kernel cache APIAlexander Khosrowshahi
Amends calls to BNFreeString in kernel cache API that were causing `get_macho_header_for_address`, `get_macho_header_for_image`, `get_image_name_for_address`, and `get_name_for_address` to fail. Fixes https://github.com/Vector35/binaryninja-api/issues/6855
2025-05-13[CMake] Report compatibility with 3.15 to silence deprecation warningsGlenn Smith
2025-04-16Clean up navigable views and prioritiesGlenn Smith
2025-04-16Fix various views not being marked executableGlenn Smith
2025-04-16Accidentally made wrong column interactive...Alexander Taylor
2025-04-16Better column sizing for DSC and KC triage views.Alexander Taylor
2025-04-16Add loaded column for kernel cache view.Alexander Taylor
Required adding an API to determine if an image is loaded.
2025-04-14Fixes for multiple issues in DSC/KC Triage views.Alexander Taylor
1. Crash on kernel cache image load 2. Duplicate Load Image buttons in kernel cache view 3. Improper selection behavior in both views 4. Address column should no longer resize to be smaller than contents 5. Symbol tables should now be properly sortable
2025-04-14Prevent nullptr deref if we don't find image.Alexander Taylor
2025-04-09Shared cache and kernel cache UI cleanup.Alexander Taylor
One day, these will share more code, but today is not quite that day.