| Age | Commit message (Collapse) | Author |
|---|
|
|
|
|
|
objc_release_xN
The type library for the Objective-C runtime does not apply the custom
calling conventions these functions use. Detect these functions when
creating symbols for imported functions and apply the custom calling
convention to them.
Fixes https://github.com/Vector35/binaryninja-api/issues/8031.
|
|
Container Browser
Add the ui.files.universal.dedicatedPicker setting, allowing users to choose
between the dedicated architecture picker dialog and the standard container
browser for opening Universal (fat) Mach-O binaries. Previously the dedicated
picker was always used with no way to opt out.
Implementing this required restructuring how Universal binaries are handled
during file open. The previous approach intercepted Universal binaries during
container processing, bypassing the container browser's normal pipeline with
dedicated routing logic. This tightly coupled Universal-specific behavior into
the container system, prevented the container browser from handling Universal
binaries natively, and introduced several bugs around exclusion settings,
nested containers, and multi-child container hierarchies.
Bug fixes:
- The previous implementation always intercepted Universal binaries during
container processing with its own routing logic, bypassing the container
browser entirely. There was no way for the container browser to handle
Universal binaries natively, even when that was the desired behavior.
- Universal binaries inside multi-child containers were not detected. The
previous implementation only traversed single-child paths in the container
hierarchy, silently ignoring Universal binaries that appeared as siblings
among multiple children.
- Nested containers (e.g., archives) inside Universal slices were not
handled. The previous implementation intercepted Universal binaries at the
transform routing level before the container browser could perform
recursive delayering. When the dedicated picker is disabled, the container
browser now processes the full hierarchy including Universal slices and any
containers within them.
- Reverted incorrect IsInteractive to IsUIEnabled change in
UniversalTransform. The previous change conflated headless mode with
non-interactive processing. The UI can be enabled while still performing a
non-interactive auto-open (e.g., container browser auto-resolving with a
preferred architecture). The IsInteractive() flag captures the actual
intent and enables the transform to produce only the preferred
architecture child for non-interactive sessions, avoiding unnecessary
BinaryView construction for all slices.
|
|
Responsibility for selecting an architecture is moved out of
`UniversalTransform` and into a new `ContainerOpenRequest` class.
`UniversalTransform` still handles architecture selection in headless
operation (for now).
|
|
Fixes https://github.com/Vector35/binaryninja-api/issues/7989.
Also corrects an oversight from d92b3684 in handling of library ordinals
>= 128.
|
|
These lookup modes are negative values that are encoded in the library
ordinal, an unsigned field, of an import fixup entry. Incorrect sign
extension when converting these ordinals back to signed values led
to them being misinterpreted.
|
|
|
|
This was done for kernel cache in
https://github.com/Vector35/binaryninja-api/pull/7519, and is now being
extended to Mach-O images that appear to be XNU kernels (that is, they
contain `__KLD` segments). This improves the experience when opening
kernels from the macOS Kernel Debug Kit.
|
|
1. A section's `flags` are masked with `SECTION_TYPE` before being
compared. This prevents misclassifying a section when its low bits
are shared with other section types.
2. `__mod_init_func` and `__init_offsets` are identified by section type
flags, rather than by name. There's no documented reason why these
were being matched by name.
3. A fallback is added to detect `__got` sections by name. This is
necessary as some kext bundles that have their `__got` sections as
`S_REGULAR` rather than `S_NON_LAZY_SYMBOL_POINTERS`. This fixes
https://github.com/Vector35/binaryninja-api/issues/7891.
Thanks to @WHW0x455 for these fixes.
|
|
|
|
|
|
|
|
Fixes https://github.com/Vector35/binaryninja-api/issues/7781.
|
|
Fixes https://github.com/Vector35/binaryninja-api/issues/7666.
Correctly managing the state of bulk symbol modifications via
`BeginBulkModifySymbols` / `EndBulkModifySymbols` is error-prone in the
face of exceptions and early returns. Leaking a bulk symbol modification
can leave the view in a state where no further changes to symbols will
be applied.
All users of the C++ API are encouraged to move from
`BeginBulkModifySymbols` / `EndBulkModifySymbols` to the new
`BulkSymbolModification` class.
|
|
|
|
correspond to
|
|
Clang, MSVC and GCC all have different opinions about what's permissible with initialization from a braced initializer list.
|
|
|
|
The parsing of fix-up chains is moved out of `MachoView` and into its
own class. It deals purely in terms of offsets into the Mach-O slice.
`MachoView` translates those offsets to mapped addresses when needed.
This is primarily aimed at fixing incorrect handling of pointer formats
that use offsets where in some cases the relocations would be applied at
incorrect addresses due to confusion between file offsets, Mach-O slice
offsets, and VM offsets.
It incidentally fixes addends from bind operations not being respected.
These show up most frequently in C++ RTTI information.
|
|
`LC_FUNCTION_STARTS` includes both functions and jump tables. We want to
avoid calling `AddFunctionForAnalysis` on jump tables since it can
result in a function being created at the jump table's location with a
bogus body.
We already skip adding functions for entries in `LC_FUNCTION_STARTS` if
the lifting of their first few bytes end up including `LLIL_UNDEF`.
However, arm64 intentionally lifts `udf` instructions (i.e., opcodes in
the Permanently Undefined range) to `LLIL_TRAP` in order to preserve the
immediate portion of the instruction.
To address this, `MachoView::IsValidFunctionStart` now returns false if
the first lifted instruction is `LLIL_TRAP` in addition to when the
lifting contains `LLIL_UNDEF`.
|
|
A mapping from imported symbol names to libraries is added to metadata.
This is used to populate external links for files within projects,
following the lead of `PEView`.
|
|
This is functionally equivalent to the previous workflow_objc, with the
following changes:
1. It mutates the `core.function.metaAnalysis` workflow rather than
registering a new named workflow. The activities now all check for
the presence of the Objective-C metadata added by `ObjCProcessor` to
determine whether they should do work, rather than relying on
`MachoView` to override the function workflow when Objective-C
metadata is present. This fixes
https://github.com/Vector35/binaryninja-api/issues/6779.
2. The auto-inlining of `objc_msgSend` selector stub functions is
performed in a separate activity from the processing of
`objc_msgSend` call sites. The selector stub inlining activity is
configured so that it does not run in `DSCView` as the shared cache
needs different behavior for stub functions more generally that
`SharedCacheWorkflow` already provides.
3. The way that types like `id` and `SEL` are referenced is fixed so
that they show up as `id` rather than `objc_struct*`.
This also replaces the Objective-C portion of the shared cache's
workflow, and incorporates several bug fixes that had been applied to it
but not the standalone Objective-C workflow.
|
|
message
|
|
This ensures that CMake detects when files that match the glob are added
or removed.
|
|
|
|
Fixes #7117
|
|
|
|
|
|
This reverts commit 5bafe5c7bdb0b56037a0b5c573236f9c6367353a.
|
|
|
|
|
|
`__objc_stubs` is not technically Objective-C metadata, but binaries
containing Objective-C stubs need the same processing.
`MachoView` was previously only enabling the Objective-C workflow if it
thinks there is type metadata. The same criteria was used to determine
whether to process Objective-C metadata via `MachoObjCProcessor`.
This meant binaries with `__objc_stubs` but no Objective-C type metadata
were not running the Objective-C workflow, preventing stub functions
from being inlined during analysis.
|
|
This would leak if parsing of CFStrings was enabled while parsing of
Objective-C metadata was disabled.
It would also leak if exceptions were thrown or early returns were taken
in the ~500 lines between where the object was allocated and it was
deleted.
|
|
This adds support for the `__objc_arrayobj`, `_objc_dictobj`,
`__objc_intobj`, `__objc_floatobj`, `__objc_doubleobj` and
`__objc_dateobj` sections that contain Objective-C constants. These are
emitted by Apple's versions of Clang for `const` literals, amongst other
things.
|
|
|
|
|
|
|
|
Also update minimum CMake version.
|
|
cause bugs and also issues with C++20
|
|
backed by a database
|
|
The target of the bind opcode has its symbol applied when the dynamic
symbol table is parsed.
This was previously adding a symbol at the fixed-up address with the
name of the symbol being bound. This was resulting in dozens of
`_OBJC_CLASS_$_NSObject`, `_OBJC_METACLASS_$_NSObject`, and
`__objc_empty_cache` symbols being created: one for each `objc_class`
that referenced those symbols.
|
|
|
|
|
|
|
|
|
|
They show up in some macOS system executables.
|
|
|
|
This avoids the 3 errors on view initialization for all supported kernel
caches that aren't "real".
|
|
This reverts commit 9169a13c818fc7f3b09246360c31e200b01bda23.
|
