From ea47d4c85e78533ea7e88adc442159414feb3f7f Mon Sep 17 00:00:00 2001 From: Mason Reed Date: Sun, 13 Apr 2025 00:47:36 -0400 Subject: [SharedCache] Apply .symbols file information when applying an image This improves symbol recovery drastically on newer shared caches Related PR: https://github.com/Vector35/binaryninja-api/pull/6210 --- view/sharedcache/core/SharedCache.cpp | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) (limited to 'view/sharedcache/core/SharedCache.cpp') diff --git a/view/sharedcache/core/SharedCache.cpp b/view/sharedcache/core/SharedCache.cpp index 717ec6aa..dced1660 100644 --- a/view/sharedcache/core/SharedCache.cpp +++ b/view/sharedcache/core/SharedCache.cpp @@ -80,10 +80,14 @@ std::optional CacheEntry::FromFile(const std::string& filePath, cons // We found a single dyld data cache entry file. Mark it as such! type = CacheEntryType::DyldData; } - else if (fileName.find(".symbols") != std::string::npos) + else if (fileName.find(".symbols") != std::string::npos && mappings.size() == 1) { // We found a single symbols cache entry file. Mark it as such! type = CacheEntryType::Symbols; + // Adjust the mapping for the symbol file, they seem to be only for the header. + // If we do not adjust the mapping than we will not be able to read the symbol table through the virtual memory. + mappings[0].fileOffset = 0; + mappings[0].size = file->Length(); } else if (mappings.size() == 1 && header.imagesCountOld == 0 && header.imagesCount == 0 && header.imagesTextOffset == 0) @@ -154,8 +158,7 @@ std::optional CacheEntry::GetMappedAddress(uint64_t fileOffset) const SharedCache::SharedCache(uint64_t addressSize) { - m_addressSize = addressSize; - m_vm = std::make_shared(); + m_vm = std::make_shared(addressSize); m_namedSymMutex = std::make_unique(); } @@ -321,7 +324,7 @@ void SharedCache::ProcessEntryRegions(const CacheEntry& entry) // Collect pool addresses as non image memory regions. for (size_t i = 0; i < entryHeader.branchPoolsCount; i++) { - auto branchPoolAddr = entryHeader.branchPoolsOffset + (i * m_addressSize); + auto branchPoolAddr = entryHeader.branchPoolsOffset + (i * m_vm->GetAddressSize()); auto header = SharedCacheMachOHeader::ParseHeaderForAddress( m_vm, branchPoolAddr, "dyld_shared_cache_branch_islands_" + std::to_string(i)); // Stop processing branch pools if a header fails to parse. -- cgit v1.3.1