From 25cc02431b61097b2adfc2fbc493b648b0300c3b Mon Sep 17 00:00:00 2001 From: Mason Reed Date: Mon, 10 Mar 2025 11:05:40 -0400 Subject: [SharedCache] Refactor Shared Cache In absence of a better name, this commit refactors the shared cache code. --- view/sharedcache/core/MachO.h | 76 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 76 insertions(+) create mode 100644 view/sharedcache/core/MachO.h (limited to 'view/sharedcache/core/MachO.h') diff --git a/view/sharedcache/core/MachO.h b/view/sharedcache/core/MachO.h new file mode 100644 index 00000000..37b82915 --- /dev/null +++ b/view/sharedcache/core/MachO.h @@ -0,0 +1,76 @@ +#pragma once + +#include "VirtualMemory.h" + +// TODO: Including this adds a bunch of binary ninja specific stuff :ugh: +#include "view/macho/machoview.h" + +struct CacheSymbol; + +struct SharedCacheMachOHeader +{ + uint64_t textBase = 0; + uint64_t loadCommandOffset = 0; + BinaryNinja::mach_header_64 ident; + // NOTE: This should never be empty. + std::string identifierPrefix; + std::string installName; + + std::vector> entryPoints; + std::vector m_entryPoints; // list of entrypoints + + BinaryNinja::symtab_command symtab; + BinaryNinja::dysymtab_command dysymtab; + BinaryNinja::dyld_info_command dyldInfo; + BinaryNinja::routines_command_64 routines64; + BinaryNinja::function_starts_command functionStarts; + std::vector moduleInitSections; + BinaryNinja::linkedit_data_command exportTrie; + BinaryNinja::linkedit_data_command chainedFixups {}; + + uint64_t relocationBase; + // Section and program headers, internally use 64-bit form as it is a superset of 32-bit + std::vector segments; // only three types of sections __TEXT, __DATA, __IMPORT + BinaryNinja::segment_command_64 linkeditSegment; + std::vector sections; + std::vector sectionNames; + + std::vector symbolStubSections; + std::vector symbolPointerSections; + + std::vector dylibs; + + BinaryNinja::build_version_command buildVersion; + std::vector buildToolVersions; + + std::string exportTriePath; + + bool linkeditPresent = false; + bool dysymPresent = false; + bool dyldInfoPresent = false; + bool exportTriePresent = false; + bool chainedFixupsPresent = false; + bool routinesPresent = false; + bool functionStartsPresent = false; + bool relocatable = false; + + // The base address of the link edit file. + // Use this if you want to read offsets relative to the file containing the link edit segment. + uint64_t GetLinkEditFileBase() const { return linkeditSegment.vmaddr - linkeditSegment.fileoff; }; + + static std::optional ParseHeaderForAddress( + std::shared_ptr vm, uint64_t address, const std::string& imagePath); + + // TODO: Replace view with address size? + std::vector ReadSymbolTable(BinaryNinja::BinaryView& view, VirtualMemory& vm) const; + + std::optional AddExportTerminalSymbol( + const std::string& symbolName, const uint8_t* current, const uint8_t* end) const; + + bool ProcessLinkEditTrie(std::vector& symbols, const std::string& currentText, const uint8_t* begin, + const uint8_t* current, const uint8_t* end) const; + + std::vector ReadExportSymbolTrie(VirtualMemory& vm) const; + + std::vector ReadFunctionTable(VirtualMemory& vm) const; +}; -- cgit v1.3.1