| Age | Commit message (Collapse) | Author |
|---|
|
inlining during analysis
Previously the address of the instruction in the function being inlined
was used as the new instruction's address when copying it during
inlining. Now there is an additional option: use the address of the
call instruction that is being replaced as the new instruction's
address.
This new mode is useful when inlining thunks or stub functions, but care
must be taken if using it beyond that.
The benefit is that it ensures that when a function contains multiple
calls to the same stub function, each inlined copy ends up with distinct
addresses. This ensures that call type adjustments and other overrides
that are stored on the function and keyed by address can be applied
independently to each callsite that was inlined.
The trade-off is that if the function being inlined contains non-trivial
logic, all of the inlined instructions sharing an address will limit
what type of adjustments can be applied to them.
The Objective-C and shared cache workflows are updated to take advantage
of this new mode when they enable inlining of stub functions. This will
make it possible for multiple calls to the same runtime function within
a single function to have separate call type adjustments applied in the
future.
|
|
This is functionally equivalent to the previous workflow_objc, with the
following changes:
1. It mutates the `core.function.metaAnalysis` workflow rather than
registering a new named workflow. The activities now all check for
the presence of the Objective-C metadata added by `ObjCProcessor` to
determine whether they should do work, rather than relying on
`MachoView` to override the function workflow when Objective-C
metadata is present. This fixes
https://github.com/Vector35/binaryninja-api/issues/6779.
2. The auto-inlining of `objc_msgSend` selector stub functions is
performed in a separate activity from the processing of
`objc_msgSend` call sites. The selector stub inlining activity is
configured so that it does not run in `DSCView` as the shared cache
needs different behavior for stub functions more generally that
`SharedCacheWorkflow` already provides.
3. The way that types like `id` and `SEL` are referenced is fixed so
that they show up as `id` rather than `objc_struct*`.
This also replaces the Objective-C portion of the shared cache's
workflow, and incorporates several bug fixes that had been applied to it
but not the standalone Objective-C workflow.
|
|
Calls to `Workflow::Instance` that were looking up a built-in workflow
name are updated to use `Workflow::Get`. Others use `Workflow::GetOrCreate`.
|
|
- Removed last use of user object creation in objective-c
- Fixed function type info being omitted from certain images loaded automatically
- Add TODO about undo action in view init. This is not critical, just a non-actionable warning because of a design flaw
I will restate this again for anyone in the future, until the undo action system is thread-safe avoid calling it from any thread other than the main thread, it is very easy to deadlock or cause other issues. That goes for basically all user analysis object creation.
|
|
This occurred because prior to the change made in build `7484` we short-circuited when the pointer pointed to a read only segment, now that we consult the section the sections semantics were incorrect and failed, this fixes the dyld data sections to have correct semantics.
|
|
named workflow
Activities are registered with a `viewType` predicate to ensure they
only run in shared cache views.
Adding activities to `core.function.metaAnalysis` lets activities
registered by plug-ins run in the shared cache without the plug-ins
having to be aware of the shared cache.
Work towards #6779.
|
|
Fixed branch island regions being skipped
|
|
|
|
Fixes the case of stub functions being applied with mangled names.
|
|
|
|
|
|
Fixes https://github.com/Vector35/binaryninja-api/issues/6550
|
|
|
|
expression operation
|
|
|
|
|
|
oops!
|
|
Still have the issue with newer IOS stubs not having their direct function address taken
|
|
In absence of a better name, this commit refactors the shared cache code.
|
|
Moved some code to a helper function and removed dead code and other oddities
|
|
Find the relative selector base address in the Objective-C optimization
data pointed to by the shared cache header, rather than via
`__objc_scoffs`. This is only present on iOS, and not for every iOS
version that encodes selectors via direct offsets.
This also includes some related improvements:
1. Direct selectors get their own pointer type so they're rendered
correctly in the view.
2. Method lists encoded as lists of lists are now handled.
3. The `dyld_cache_header` type added to the view is truncated to the
length in the loaded cache. This ensures it is applied to the view.
4. A couple of methods that process method IMPs and selectors are
updated to check whether the address is valid before attempting to
process them. They would otherwise fail by throwing an exception if
they proceed, but checking for validity is quicker and makes
exception breakpoints usable.
|
|
|
|
|
|
|
|
This is an early release of our DSC processing plugin. We're still hard at work improving this feature. You should be able to just drop in a dyld_shared_cache and use the 'Shared Cache Triage' view to load and analyze images.
|
