| Age | Commit message (Collapse) | Author |
|
If we hit a got entry outside the valid regions of memory we can safely assume the tables to be malformed.
|
|
Fixes https://github.com/Vector35/binaryninja/issues/1472
|
|
Addresses feedback from PR #8188.
|
|
Closes #6630.
|
|
Closes #8020 and #8021.
|
|
|
|
|
|
|
|
- Remove the "viral" `BinaryViewExt` trait and its blanket impl
- Split up the binary view type from the custom trait impl
- Simplify and fix bugs regarding custom binary view initialization
- Rewrite Minidump binary view example, parses the PE headers to create proper sections now
- Add some extra documentation
- Add unit test for custom binary view
|
|
|
|
BinaryViewType gains a HasNoInitialContent function that views can use
to suppress layout restoration when opening a file. The layout will
still be restored when the view is loaded from a saved database.
Fixes https://github.com/Vector35/binaryninja-api/issues/8083.
|
|
|
|
|
|
|
|
The processed Objective-C metadata is not saved to the .bdnb. It must be
recomputed when the view is loaded.
Fixes https://github.com/Vector35/binaryninja-api/issues/8030.
|
|
|
|
objc_release_xN
The type library for the Objective-C runtime does not apply the custom
calling conventions these functions use. Detect these functions when
creating symbols for imported functions and apply the custom calling
convention to them.
Fixes https://github.com/Vector35/binaryninja-api/issues/8031.
|
|
Container Browser
Add the ui.files.universal.dedicatedPicker setting, allowing users to choose
between the dedicated architecture picker dialog and the standard container
browser for opening Universal (fat) Mach-O binaries. Previously the dedicated
picker was always used with no way to opt out.
Implementing this required restructuring how Universal binaries are handled
during file open. The previous approach intercepted Universal binaries during
container processing, bypassing the container browser's normal pipeline with
dedicated routing logic. This tightly coupled Universal-specific behavior into
the container system, prevented the container browser from handling Universal
binaries natively, and introduced several bugs around exclusion settings,
nested containers, and multi-child container hierarchies.
Bug fixes:
- The previous implementation always intercepted Universal binaries during
container processing with its own routing logic, bypassing the container
browser entirely. There was no way for the container browser to handle
Universal binaries natively, even when that was the desired behavior.
- Universal binaries inside multi-child containers were not detected. The
previous implementation only traversed single-child paths in the container
hierarchy, silently ignoring Universal binaries that appeared as siblings
among multiple children.
- Nested containers (e.g., archives) inside Universal slices were not
handled. The previous implementation intercepted Universal binaries at the
transform routing level before the container browser could perform
recursive delayering. When the dedicated picker is disabled, the container
browser now processes the full hierarchy including Universal slices and any
containers within them.
- Reverted incorrect IsInteractive to IsUIEnabled change in
UniversalTransform. The previous change conflated headless mode with
non-interactive processing. The UI can be enabled while still performing a
non-interactive auto-open (e.g., container browser auto-resolving with a
preferred architecture). The IsInteractive() flag captures the actual
intent and enables the transform to produce only the preferred
architecture child for non-interactive sessions, avoiding unnecessary
BinaryView construction for all slices.
|
|
Responsibility for selecting an architecture is moved out of
`UniversalTransform` and into a new `ContainerOpenRequest` class.
`UniversalTransform` still handles architecture selection in headless
operation (for now).
|
|
Finally closes #5463.
|
|
|
|
https://github.com/Vector35/binaryninja-api/issues/4052, fix https://github.com/Vector35/binaryninja-api/issues/5607
|
|
|
|
Fixes https://github.com/Vector35/binaryninja-api/issues/7989.
Also corrects an oversight from d92b3684 in handling of library ordinals
>= 128.
|
|
These lookup modes are negative values that are encoded in the library
ordinal, an unsigned field, of an import fixup entry. Incorrect sign
extension when converting these ordinals back to signed values led
to them being misinterpreted.
|
|
The `FileAccessorCache`'s LRU eviction could discard a file's mapped
data after slide info had already been applied to it. Future accesses to
the file produced a fresh mapping, but failed to reapply the slide info.
This could result in pointers not correctly being slid, such as in
https://github.com/Vector35/binaryninja-api/issues/7689.
The LRU cache existed to stay within OS file descriptor limits, since
the old `MappedFile` held its fd open for the lifetime of the mapping.
There's no real reason for it to hold the file descriptor open like
this. Closing it after `mmap` is sufficient to avoid the file descriptor
limits.
`MappedFileRegion` replaces the combination of `FileAccessorCache`,
`WeakFileAccessor`, and `MappedFileAccessor`. It closes the fd
immediately after mmap, so all files can stay mapped without consuming
descriptors, making the cache unnecessary.
`MappedFileRegion` is owned directly by the `CacheEntry` for its full
lifetime. Slide info is applied exactly once to each `MappedFileRegion`.
|
|
This builds on the existing support for opening kernel caches directly from IM4P payload files,
and allows opening macOS kernel caches directly from
`/System/Volumes/Preboot/<apfs-uuid>/boot/<boot-manifest-hash>/System/Library/Caches/com.apple.kernelcaches/kernelcache`.
|
|
This reverts commit bcc40473b3660005e83f51150bdc17ae177768dc.
|
|
This reverts commit 4573354f23da495099983dac4b665988cd837ff5.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
This was done for kernel cache in
https://github.com/Vector35/binaryninja-api/pull/7519, and is now being
extended to Mach-O images that appear to be XNU kernels (that is, they
contain `__KLD` segments). This improves the experience when opening
kernels from the macOS Kernel Debug Kit.
|
|
These binaries can be ELF64 or ELF32 format, if the user specifies
linux-x32 or linux-ilp32 platforms the BinaryView's default address size
needs to be 4, even if it's an ELF64
|
|
|
|
|
|
Closes #7851.
|
|
|
|
1. A section's `flags` are masked with `SECTION_TYPE` before being
compared. This prevents misclassifying a section when its low bits
are shared with other section types.
2. `__mod_init_func` and `__init_offsets` are identified by section type
flags, rather than by name. There's no documented reason why these
were being matched by name.
3. A fallback is added to detect `__got` sections by name. This is
necessary as some kext bundles that have their `__got` sections as
`S_REGULAR` rather than `S_NON_LAZY_SYMBOL_POINTERS`. This fixes
https://github.com/Vector35/binaryninja-api/issues/7891.
Thanks to @WHW0x455 for these fixes.
|
|
|
|
inlining during analysis
Previously the address of the instruction in the function being inlined
was used as the new instruction's address when copying it during
inlining. Now there is an additional option: use the address of the
call instruction that is being replaced as the new instruction's
address.
This new mode is useful when inlining thunks or stub functions, but care
must be taken if using it beyond that.
The benefit is that it ensures that when a function contains multiple
calls to the same stub function, each inlined copy ends up with distinct
addresses. This ensures that call type adjustments and other overrides
that are stored on the function and keyed by address can be applied
independently to each callsite that was inlined.
The trade-off is that if the function being inlined contains non-trivial
logic, all of the inlined instructions sharing an address will limit
what type of adjustments can be applied to them.
The Objective-C and shared cache workflows are updated to take advantage
of this new mode when they enable inlining of stub functions. This will
make it possible for multiple calls to the same runtime function within
a single function to have separate call type adjustments applied in the
future.
|
|
view callbacks
|
|
- Added more documentation
- Replaced global named logger for plugins, fixing the issue when the CU has multiple (e.g. statically linked demo)
- Simplified some misc code
This is a breaking change, but I believe there is no better time to make it, we cannot continue to use the `log` crate, it is too limited for our needs.
|
|
|
|
|
|
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
|
|
Fixes https://github.com/Vector35/binaryninja-api/issues/7781.
|