| Age | Commit message (Collapse) | Author |
|---|
|
To keep backwards compatibility for commonly referenced code we re-export them within the architecture module.
Also does some light refactoring of some newly added APIs to keep them more consistent with other parts of the codebase.
|
|
EndBulkAddSegments
This defers rebuilding of the section map until after all sections for
an image have been added, rather than having the section map be rebuilt
after adding each section.
|
|
This defers rebuilding of the section map until after all sections for
an image have been added, rather than having the section map be rebuilt
after adding each section.
|
|
Fixes https://github.com/Vector35/binaryninja-api/issues/7666.
Correctly managing the state of bulk symbol modifications via
`BeginBulkModifySymbols` / `EndBulkModifySymbols` is error-prone in the
face of exceptions and early returns. Leaking a bulk symbol modification
can leave the view in a state where no further changes to symbols will
be applied.
All users of the C++ API are encouraged to move from
`BeginBulkModifySymbols` / `EndBulkModifySymbols` to the new
`BulkSymbolModification` class.
|
|
unbacked regions
Fixes https://github.com/Vector35/binaryninja-api/issues/7724
|
|
This ensures they do not overlap with any images that may later be loaded from the shared cache.
|
|
This ensures they do not overlap with any images that may later be loaded from the kernel cache.
Fixes https://github.com/Vector35/binaryninja-api/issues/7634.
|
|
|
|
|
|
Fixes https://github.com/Vector35/binaryninja-api/issues/7615.
The dependency loading for kernel cache images was copied from the
shared cache code, and looks for `LC_LOAD_DYLIB` load commands to
determine the direct dependencies of an image. Images in kernel caches
don't use `LC_LOAD_DYLIB` load commands so no dependencies were ever
loaded. It could, however, result in a crash.
|
|
correspond to
|
|
The down and enter keys now preserve an existing selection in the
associated list or table views, rather than unconditionally selecting or
activating the first item.
|
|
|
|
XNU maps kernel cache segments in with different permissions than the
load commands indicate. For instance, `__DATA_CONST` is initially mapped
as read-write before later being re-mapped as read-only. Treating it as
read-only results in analysis falsely assuming that global variables
cannot change.
To work around this we maintain a mapping from segment name to initial
permissions (i.e., most lax permissions) and favor them over permissions
derived from the segment load command. Section semantics are also
derived from the segment's permissions when the segment is present in
the mapping.
The mapping is based on the initial permissions established by
`arm_vm_prot_init` within the XNU source.
|
|
Clang, MSVC and GCC all have different opinions about what's permissible with initialization from a braced initializer list.
|
|
|
|
The parsing of fix-up chains is moved out of `MachoView` and into its
own class. It deals purely in terms of offsets into the Mach-O slice.
`MachoView` translates those offsets to mapped addresses when needed.
This is primarily aimed at fixing incorrect handling of pointer formats
that use offsets where in some cases the relocations would be applied at
incorrect addresses due to confusion between file offsets, Mach-O slice
offsets, and VM offsets.
It incidentally fixes addends from bind operations not being respected.
These show up most frequently in C++ RTTI information.
|
|
infinite loop)
|
|
|
|
|
|
See https://github.com/Vector35/binaryninja-api/issues/7247#issuecomment-3392192797 for details.
|
|
|
|
|
|
Extra noise in the CMake configure step, much of the value from these has been removed after the refactor(s), e.g. metadata version is no longer used
|
|
container transforms.
|
|
the payload.
|
|
`LC_FUNCTION_STARTS` includes both functions and jump tables. We want to
avoid calling `AddFunctionForAnalysis` on jump tables since it can
result in a function being created at the jump table's location with a
bogus body.
We already skip adding functions for entries in `LC_FUNCTION_STARTS` if
the lifting of their first few bytes end up including `LLIL_UNDEF`.
However, arm64 intentionally lifts `udf` instructions (i.e., opcodes in
the Permanently Undefined range) to `LLIL_TRAP` in order to preserve the
immediate portion of the instruction.
To address this, `MachoView::IsValidFunctionStart` now returns false if
the first lifted instruction is `LLIL_TRAP` in addition to when the
lifting contains `LLIL_UNDEF`.
|
|
|
|
|
|
This allows types to propagate to thunks in cases where there are
GOT entries for internal functions
|
|
|
|
by default
The table views previously visually suggested they were being sorted by
address, but in practice they were not sorted until the user set an
explicit sort order by clicking on a column header.
|
|
These files are present alongside iOS 26 shared caches. Explicitly
ignoring them avoids an error being logged to the console.
|
|
In some iOS 15 caches, the .symbols file's mapping has an address of 0.
This would cause it to be returned by `SharedCache::GetEntryContaining`
and loaded into the view.
The .symbols file contains the local symbol tables for images in the
shared cache. It is not intended to be mapped into the same address
space as the rest of the shared cache.
`SharedCache` now tracks the symbols cache entry separately from other
entries. A dedicated `VirtualMemory` region is used when accessing the
data it contains. This could be a `FileAccessor`, but that would require
additional changes within `SharedCacheMachOHeader`.
`SharedCacheMachOProcessor` now directly accesses the local symbols
cache entry rather than needing to search for it.
|
|
Prior to macOS 13 / iOS 16, the base offset to use for relative direct
selector references within Objective-C message lists was stored within
the `__TEXT,__objc_opt_ro` section of /usr/lib/libobjc.A.dylib.
|
|
A mapping from imported symbol names to libraries is added to metadata.
This is used to populate external links for files within projects,
following the lead of `PEView`.
|
|
Fixes https://github.com/Vector35/binaryninja-api/issues/7354.
|
|
These calls set the rpaths used for release builds of the dylibs using a
macro that isn't available in the API repository. They are not necessary
when building the shared cache plug-in outside of the context of the
app.
|
|
This is functionally equivalent to the previous workflow_objc, with the
following changes:
1. It mutates the `core.function.metaAnalysis` workflow rather than
registering a new named workflow. The activities now all check for
the presence of the Objective-C metadata added by `ObjCProcessor` to
determine whether they should do work, rather than relying on
`MachoView` to override the function workflow when Objective-C
metadata is present. This fixes
https://github.com/Vector35/binaryninja-api/issues/6779.
2. The auto-inlining of `objc_msgSend` selector stub functions is
performed in a separate activity from the processing of
`objc_msgSend` call sites. The selector stub inlining activity is
configured so that it does not run in `DSCView` as the shared cache
needs different behavior for stub functions more generally that
`SharedCacheWorkflow` already provides.
3. The way that types like `id` and `SEL` are referenced is fixed so
that they show up as `id` rather than `objc_struct*`.
This also replaces the Objective-C portion of the shared cache's
workflow, and incorporates several bug fixes that had been applied to it
but not the standalone Objective-C workflow.
|
|
Calls to `Workflow::Instance` that were looking up a built-in workflow
name are updated to use `Workflow::Get`. Others use `Workflow::GetOrCreate`.
|
|
|
|
C++ plug-ins now consistently use the `plugin_rpath` or
`ui_plugin_rpath` macros to ensure they have `SKIP_BUILD_RPATH` set when
building on Mac (i.e., no `LC_RPATH` is added).
Rust plug-ins have their build.rs updated to only specify `-Wl,-rpath`
when building for Linux. It is not needed on macOS. On macOS we instead
explicitly specify an `@rpath`-relative install name. This doesn't
change any behavior, but avoids leaving an absolute path as the
library's install name and is consistent with CMake's behavior for C++
plug-ins.
|
|
When the section list gets large GetSectionsAt becomes quite slow instead the the whole list of sections outside the loop and just encour that hit once. It could probably be made even faster if we used an interval tree but then we have to pay the cost of building the tree which may be more nauanced
|
|
|
|
|
|
|
|
message
|
|
This ensures that the Python source files are only generated and copied
into the output directory if inputs have changed, rather than being done
unconditionally.
|
|
This ensures that CMake detects when files that match the glob are added
or removed.
|
|
|
