From aa408cfdeaa3cd0c4319598223a4548b18731290 Mon Sep 17 00:00:00 2001
From: Mark Rowe <mrowe@bdash.net.nz>
Date: Sun, 24 Nov 2024 22:28:04 -0800
Subject: [SharedCache] Fix handling of relative selectors in macOS shared
 caches

Find the relative selector base address in the Objective-C optimization
data pointed to by the shared cache header, rather than via
`__objc_scoffs`. This is only present on iOS, and not for every iOS
version that encodes selectors via direct offsets.

This also includes some related improvements:
1. Direct selectors get their own pointer type so they're rendered
   correctly in the view.
2. Method lists encoded as lists of lists are now handled.
3. The `dyld_cache_header` type added to the view is truncated to the
   length in the loaded cache. This ensures it is applied to the view.
4. A couple of methods that process method IMPs and selectors are
   updated to check whether the address is valid before attempting to
   process them. They would otherwise fail by throwing an exception if
   they proceed, but checking for validity is quicker and makes
   exception breakpoints usable.
---
 view/sharedcache/core/SharedCache.cpp | 44 +++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)

(limited to 'view/sharedcache/core/SharedCache.cpp')

diff --git a/view/sharedcache/core/SharedCache.cpp b/view/sharedcache/core/SharedCache.cpp
index 0f61da63..b9150c31 100644
--- a/view/sharedcache/core/SharedCache.cpp
+++ b/view/sharedcache/core/SharedCache.cpp
@@ -75,6 +75,8 @@ struct SharedCache::State
 	std::vector<MemoryRegion> dyldDataRegions;
 	std::vector<MemoryRegion> nonImageRegions;
 
+	std::optional<std::pair<size_t, size_t>> objcOptimizationDataRange;
+
 	std::string baseFilePath;
 	SharedCacheFormat cacheFormat;
 	DSCViewState viewState = DSCViewStateUnloaded;
@@ -311,6 +313,10 @@ void SharedCache::PerformInitialLoad()
 			MutableState().cacheFormat = iOS16CacheFormat;
 	}
 
+	if (primaryCacheHeader.objcOptsOffset && primaryCacheHeader.objcOptsSize) {
+		MutableState().objcOptimizationDataRange = {primaryCacheHeader.objcOptsOffset, primaryCacheHeader.objcOptsSize};
+	}
+
 	switch (State().cacheFormat)
 	{
 	case RegularCacheFormat:
@@ -3673,4 +3679,42 @@ const std::unordered_map<uint64_t, SharedCacheMachOHeader>& SharedCache::AllImag
 {
 	return State().headers;
 }
+size_t SharedCache::GetBaseAddress() const {
+	if (State().backingCaches.empty()) {
+		return 0;
+	}
+
+	const BackingCache& primaryCache = State().backingCaches[0];
+	if (!primaryCache.isPrimary) {
+		abort();
+		return 0;
+	}
+
+	if (primaryCache.mappings.empty()) {
+		return 0;
+	}
+
+	return primaryCache.mappings[0].address;
+}
+
+// Intentionally takes a copy to avoid modifying the cursor position in the original reader.
+std::optional<ObjCOptimizationHeader> SharedCache::GetObjCOptimizationHeader(VMReader reader) const {
+	if (!State().objcOptimizationDataRange) {
+		return {};
+	}
+
+	ObjCOptimizationHeader header{};
+	// Ignoring `objcOptsSize` in favor of `sizeof(ObjCOptimizationHeader)` matches dyld's behavior.
+	reader.Read(&header, GetBaseAddress() + State().objcOptimizationDataRange->first, sizeof(ObjCOptimizationHeader));
+
+	return header;
+}
+
+size_t SharedCache::GetObjCRelativeMethodBaseAddress(const VMReader& reader) const {
+	if (auto header = GetObjCOptimizationHeader(reader); header.has_value()) {
+		return GetBaseAddress() + header->relativeMethodSelectorBaseAddressOffset;
+	}
+	return 0;
+}
+
 }  // namespace SharedCacheCore
-- 
cgit v1.3.1