From e937b89628f3b3ce039d641fe849796cc295c41a Mon Sep 17 00:00:00 2001 From: Mark Rowe Date: Sat, 13 Sep 2025 16:17:43 -0700 Subject: [DSC] Rework handling of .symbols files to be compatible with iOS 15 In some iOS 15 caches, the .symbols file's mapping has an address of 0. This would cause it to be returned by `SharedCache::GetEntryContaining` and loaded into the view. The .symbols file contains the local symbol tables for images in the shared cache. It is not intended to be mapped into the same address space as the rest of the shared cache. `SharedCache` now tracks the symbols cache entry separately from other entries. A dedicated `VirtualMemory` region is used when accessing the data it contains. This could be a `FileAccessor`, but that would require additional changes within `SharedCacheMachOHeader`. `SharedCacheMachOProcessor` now directly accesses the local symbols cache entry rather than needing to search for it. --- view/sharedcache/core/MachOProcessor.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'view/sharedcache/core/MachOProcessor.h') diff --git a/view/sharedcache/core/MachOProcessor.h b/view/sharedcache/core/MachOProcessor.h index 4b014f4e..86772c99 100644 --- a/view/sharedcache/core/MachOProcessor.h +++ b/view/sharedcache/core/MachOProcessor.h @@ -21,4 +21,6 @@ public: uint64_t ApplyHeaderSections(SharedCacheMachOHeader& header); void ApplyHeaderDataVariables(SharedCacheMachOHeader& header); + + void ApplyUnmappedLocalSymbols(const SharedCache& cache, const SharedCacheMachOHeader& header, BinaryNinja::Ref typeLib); }; -- cgit v1.3.1