analysis_objc.c File Reference

#include <rz_core.h>
#include "core_private.h"

Go to the source code of this file.

Classes
struct	RzCoreObjc

Functions
static void	array_add (RzCoreObjc *o, ut64 va, ut64 xrefs_to)
static void	kv_array_free (HtUPKv *kv)
static bool	isValid (ut64 addr)
static bool	isInvalid (ut64 addr)
static bool	inBetween (RzBinSection *s, ut64 addr)
static ut32	readDword (RzCoreObjc *objc, ut64 addr, bool *success)
static ut64	readQword (RzCoreObjc *objc, ut64 addr, bool *success)
static void	objc_analyze (RzCore *core)
static ut64	getRefPtr (RzCoreObjc *o, ut64 classMethodsVA, bool *rfound)
static bool	objc_build_refs (RzCoreObjc *objc)
static RzCoreObjc *	core_objc_new (RzCore *core)
static void	core_objc_free (RzCoreObjc *o)
static bool	objc_find_refs (RzCore *core)
RZ_API bool	cmd_analysis_objc (RzCore *core, bool auto_analysis)

Variables
const size_t	objc2ClassSize = 0x28
const size_t	objc2ClassInfoOffs = 0x20
const size_t	objc2ClassMethSize = 0x18
const size_t	objc2ClassBaseMethsOffs = 0x20
const size_t	objc2ClassMethImpOffs = 0x10

Function Documentation

array_add()

static void array_add ( RzCoreObjc *  o, ut64  va, ut64  xrefs_to  )

static

Definition at line 30 of file analysis_objc.c.

                                                             {
    bool found = false;
    RzVector *vec = ht_up_find(o->up, va, &found);
    if (!found || !vec) {
        vec = rz_vector_new(sizeof(ut64), NULL, NULL);
        ht_up_insert(o->up, va, vec);
    }
    ut64 *addr;
    rz_vector_foreach(vec, addr) {
        if (xrefs_to == *addr) {
            return;
        }
    }
    // extend vector and insert new element
    rz_vector_push(vec, &xrefs_to);
}

References addr, found, NULL, rz_vector_foreach, rz_vector_new(), rz_vector_push(), RzCoreObjc::up, and ut64().

Referenced by objc_build_refs().

cmd_analysis_objc()

RZ_API bool cmd_analysis_objc	(	RzCore *	core,
		bool	auto_analysis
	)

Definition at line 301 of file analysis_objc.c.

                                                                {
    rz_return_val_if_fail(core, 0);
    if (!auto_analysis) {
        objc_analyze(core);
    }
    return objc_find_refs(core);
}

References objc_analyze(), objc_find_refs(), and rz_return_val_if_fail.

Referenced by rz_analyze_all_objc_references_handler(), and rz_core_analysis_everything().

core_objc_free()

static void core_objc_free ( RzCoreObjc *  o )

static

Definition at line 208 of file analysis_objc.c.

                                          {
    if (o) {
        ht_up_free(o->up);
        free(o);
    }
}

References free(), and RzCoreObjc::up.

Referenced by objc_find_refs().

core_objc_new()

static RzCoreObjc* core_objc_new ( RzCore *  core )

static

Definition at line 173 of file analysis_objc.c.

                                               {
    RzList *sections = rz_bin_get_sections(core->bin);
    if (!sections) {
        return false;
    }
    RzCoreObjc *o = RZ_NEW0(RzCoreObjc);
    o->core = core;
    o->word_size = (core->rasm->bits == 64) ? 8 : 4;
    if (o->word_size != 8) {
        RZ_LOG_WARN("aao is experimental on 32bit binaries\n");
    }
 
    RzBinSection *s;
    RzListIter *iter;
    rz_list_foreach (sections, iter, s) {
        const char *name = s->name;
        if (strstr(name, "__objc_data")) {
            o->_data = s;
        } else if (strstr(name, "__objc_selrefs")) {
            o->_selrefs = s;
        } else if (strstr(name, "__objc_msgrefs")) {
            o->_msgrefs = s;
        } else if (strstr(name, "__objc_const")) {
            o->_const = s;
        }
    }
    if (!o->_const || ((o->_selrefs || o->_msgrefs) && !(o->_data && o->_const))) {
        free(o);
        return NULL;
    }
    o->up = ht_up_new(NULL, kv_array_free, NULL);
 
    return o;
}

References RzCoreObjc::_const, RzCoreObjc::_data, RzCoreObjc::_msgrefs, RzCoreObjc::_selrefs, rz_core_t::bin, rz_asm_t::bits, RzCoreObjc::core, free(), kv_array_free(), NULL, rz_core_t::rasm, rz_bin_get_sections(), RZ_LOG_WARN, RZ_NEW0, s, sections(), RzCoreObjc::up, and RzCoreObjc::word_size.

Referenced by objc_find_refs().

getRefPtr()

static ut64 getRefPtr ( RzCoreObjc *  o, ut64  classMethodsVA, bool *  rfound  )

static

Definition at line 93 of file analysis_objc.c.

                                                                        {
    *rfound = false;
 
    bool readSuccess;
    ut64 namePtr = readQword(o, classMethodsVA, &readSuccess);
    if (!readSuccess) {
        return UT64_MAX;
    }
 
    size_t cnt = 0;
    ut64 ref = UT64_MAX;
    bool isMsgRef = false;
 
    RzVector *vec = ht_up_find(o->up, namePtr, rfound);
    if (!*rfound || !vec) {
        *rfound = false;
        return false;
    }
    ut64 *addr;
    rz_vector_foreach(vec, addr) {
        const ut64 at = *addr;
        if (inBetween(o->_selrefs, at)) {
            isMsgRef = false;
            ref = at;
        } else if (inBetween(o->_msgrefs, at)) {
            isMsgRef = true;
            ref = at;
        } else if (inBetween(o->_const, at)) {
            cnt++;
        }
    }
    if (cnt > 1 || ref == 0 || ref == UT64_MAX) {
        *rfound = false;
        return UT64_MAX;
    }
    return isMsgRef ? ref - 8 : ref;
}

References RzCoreObjc::_const, RzCoreObjc::_msgrefs, RzCoreObjc::_selrefs, addr, inBetween(), readQword(), rz_vector_foreach, RzCoreObjc::up, ut64(), and UT64_MAX.

Referenced by objc_find_refs().

inBetween()

static bool inBetween ( RzBinSection *  s, ut64  addr  )

inlinestatic

Definition at line 59 of file analysis_objc.c.

                                                         {
    if (!s || isInvalid(addr)) {
        return false;
    }
    const ut64 from = s->vaddr;
    const ut64 to = from + s->vsize;
    return RZ_BETWEEN(from, addr, to);
}

References addr, from, isInvalid(), RZ_BETWEEN, s, to, and ut64().

Referenced by getRefPtr().

isInvalid()

static bool isInvalid ( ut64  addr )

inlinestatic

Definition at line 55 of file analysis_objc.c.

                                        {
    return !isValid(addr);
}

References addr, and isValid().

Referenced by inBetween(), and objc_find_refs().

isValid()

static bool isValid ( ut64  addr )

inlinestatic

Definition at line 51 of file analysis_objc.c.

                                      {
    return (addr != 0LL && addr != UT64_MAX);
}

References addr, and UT64_MAX.

Referenced by is_delta_pointer_table(), isInvalid(), objc_build_refs(), rz_analysis_get_delta_jmptbl_info(), and rz_analysis_get_jmptbl_info().

kv_array_free()

static void kv_array_free ( HtUPKv *  kv )

static

Definition at line 47 of file analysis_objc.c.

                                      {
    rz_vector_free(kv->value);
}

References rz_vector_free().

Referenced by core_objc_new().

objc_analyze()

static void objc_analyze ( RzCore *  core )

static

Definition at line 80 of file analysis_objc.c.

                                       {
    const char *notify = "Analyzing code to find selfref references";
    rz_core_notify_begin(core, "%s", notify);
    (void)rz_core_analysis_refs(core, 0);
    if (!strcmp("arm", rz_config_get(core->config, "asm.arch"))) {
        const bool emu_lazy = rz_config_get_i(core->config, "emu.lazy");
        rz_config_set_i(core->config, "emu.lazy", true);
        rz_core_analysis_esil_default(core);
        rz_config_set_i(core->config, "emu.lazy", emu_lazy);
    }
    rz_core_notify_done(core, "%s", notify);
}

References rz_core_t::config, rz_config_get(), rz_config_get_i(), rz_config_set_i(), rz_core_analysis_esil_default(), rz_core_analysis_refs(), rz_core_notify_begin(), and rz_core_notify_done().

Referenced by cmd_analysis_objc().

objc_build_refs()

static bool objc_build_refs ( RzCoreObjc *  objc )

static

Definition at line 131 of file analysis_objc.c.

                                              {
    ut64 off;
    rz_return_val_if_fail(objc->_const && objc->_selrefs, false);
 
    const ut64 va_const = objc->_const->vaddr;
    size_t ss_const = objc->_const->vsize;
    const ut64 va_selrefs = objc->_selrefs->vaddr;
    size_t ss_selrefs = objc->_selrefs->vsize;
 
    // TODO: check if ss_const or ss_selrefs are too big before going further
    size_t maxsize = RZ_MAX(ss_const, ss_selrefs);
    ut8 *buf = calloc(1, maxsize);
    if (!buf) {
        return false;
    }
    const size_t word_size = objc->word_size; // assuming 8 because of the read_le64
    if (!rz_io_read_at(objc->core->io, objc->_const->vaddr, buf, ss_const)) {
        RZ_LOG_ERROR("aao: Cannot read the whole const section %zu\n", ss_const);
        return false;
    }
    for (off = 0; off + word_size < ss_const; off += word_size) {
        ut64 va = va_const + off;
        ut64 xrefs_to = rz_read_le64(buf + off);
        if (isValid(xrefs_to)) {
            array_add(objc, va, xrefs_to);
        }
    }
    if (!rz_io_read_at(objc->core->io, va_selrefs, buf, ss_selrefs)) {
        RZ_LOG_ERROR("aao: Cannot read the whole selrefs section\n");
        return false;
    }
    for (off = 0; off + word_size < ss_selrefs; off += word_size) {
        ut64 va = va_selrefs + off;
        ut64 xrefs_to = rz_read_le64(buf + off);
        if (isValid(xrefs_to)) {
            array_add(objc, xrefs_to, va);
        }
    }
    free(buf);
    return true;
}

References RzCoreObjc::_const, RzCoreObjc::_selrefs, array_add(), calloc(), RzCoreObjc::core, free(), rz_core_t::io, isValid(), off, rz_io_read_at(), RZ_LOG_ERROR, RZ_MAX, rz_read_le64(), rz_return_val_if_fail, ut64(), rz_bin_section_t::vaddr, rz_bin_section_t::vsize, and RzCoreObjc::word_size.

Referenced by objc_find_refs().

objc_find_refs()

static bool objc_find_refs ( RzCore *  core )

static

Definition at line 215 of file analysis_objc.c.

                                         {
    RzCoreObjc *objc = core_objc_new(core);
    if (!objc) {
        RZ_LOG_DEBUG("Could not find necessary Objective-C sections...\n");
        return false;
    }
 
    if (!objc_build_refs(objc)) {
        core_objc_free(objc);
        return false;
    }
    const char *notify = "Parsing metadata in ObjC to find hidden xrefs";
    rz_core_notify_begin(core, "%s", notify);
 
    size_t total_xrefs = 0;
    bool readSuccess = true;
    for (ut64 off = 0; off < objc->_data->vsize && readSuccess; off += objc2ClassSize) {
        if (!readSuccess || rz_cons_is_breaked()) {
            break;
        }
 
        ut64 va = objc->_data->vaddr + off;
        // XXX do a single rz_io_read_at() and just rz_read_le64() here
        ut64 classRoVA = readQword(objc, va + objc2ClassInfoOffs, &readSuccess);
        if (!readSuccess || isInvalid(classRoVA)) {
            continue;
        }
        ut64 classMethodsVA = readQword(objc, classRoVA + objc2ClassBaseMethsOffs, &readSuccess);
        if (!readSuccess || isInvalid(classMethodsVA)) {
            continue;
        }
 
        ut32 count = readDword(objc, classMethodsVA + 4, &readSuccess);
        if (!readSuccess || ((ut32)count == UT32_MAX)) {
            continue;
        }
 
        classMethodsVA += 8; // advance to start of class methods array
        ut64 to = classMethodsVA + (objc2ClassMethSize * count);
        if (classMethodsVA > to || classMethodsVA + 0xfffff < to) {
            RZ_LOG_WARN("objc: the input binary might be malformed or this could be a bug.\n");
            continue;
        }
        for (va = classMethodsVA; va < to; va += objc2ClassMethSize) {
            if (rz_cons_is_breaked()) {
                break;
            }
            bool found = false;
            ut64 selRefVA = getRefPtr(objc, va, &found);
            if (!found) {
                continue;
            }
            bool succ = false;
            ut64 funcVA = readQword(objc, va + objc2ClassMethImpOffs, &succ);
            if (!succ) {
                break;
            }
 
            RzList *list = rz_analysis_xrefs_get_to(core->analysis, selRefVA);
            if (list) {
                RzListIter *iter;
                RzAnalysisXRef *xref;
                rz_list_foreach (list, iter, xref) {
                    rz_analysis_xrefs_set(core->analysis, xref->from, funcVA, RZ_ANALYSIS_XREF_TYPE_CODE);
                    total_xrefs++;
                }
            }
        }
    }
    rz_core_notify_done(core, "%s", notify);
 
    const ut64 va_selrefs = objc->_selrefs->vaddr;
    const ut64 ss_selrefs = va_selrefs + objc->_selrefs->vsize;
 
    rz_core_notify_begin(core, "Found %zu objc xrefs...", total_xrefs);
    size_t total_words = 0;
    const size_t word_size = objc->word_size;
    for (ut64 a = va_selrefs; a < ss_selrefs; a += word_size) {
        rz_meta_set(core->analysis, RZ_META_TYPE_DATA, a, word_size, NULL);
        total_words++;
    }
    rz_core_notify_done(core, "Found %zu objc xrefs in %zu dwords.", total_xrefs, total_words);
    core_objc_free(objc);
    return true;
}

References RzCoreObjc::_data, RzCoreObjc::_selrefs, a, rz_core_t::analysis, core_objc_free(), core_objc_new(), count, found, rz_analysis_ref_t::from, getRefPtr(), isInvalid(), list(), NULL, objc2ClassBaseMethsOffs, objc2ClassInfoOffs, objc2ClassMethImpOffs, objc2ClassMethSize, objc2ClassSize, objc_build_refs(), off, readDword(), readQword(), RZ_ANALYSIS_XREF_TYPE_CODE, rz_analysis_xrefs_get_to(), rz_analysis_xrefs_set(), rz_cons_is_breaked(), rz_core_notify_begin(), rz_core_notify_done(), RZ_LOG_DEBUG, RZ_LOG_WARN, rz_meta_set(), RZ_META_TYPE_DATA, to, UT32_MAX, ut64(), rz_bin_section_t::vaddr, rz_bin_section_t::vsize, and RzCoreObjc::word_size.

Referenced by cmd_analysis_objc().

readDword()

static ut32 readDword ( RzCoreObjc *  objc, ut64  addr, bool *  success  )

static

Definition at line 68 of file analysis_objc.c.

                                                                  {
    ut8 buf[4];
    *success = rz_io_read_at(objc->core->io, addr, buf, sizeof(buf));
    return rz_read_le32(buf);
}

References addr, RzCoreObjc::core, rz_core_t::io, rz_io_read_at(), and rz_read_le32().

Referenced by objc_find_refs().

readQword()

static ut64 readQword ( RzCoreObjc *  objc, ut64  addr, bool *  success  )

static

Definition at line 74 of file analysis_objc.c.

                                                                  {
    ut8 buf[8] = { 0 };
    *success = rz_io_read_at(objc->core->io, addr, buf, sizeof(buf));
    return rz_read_le64(buf);
}

References addr, RzCoreObjc::core, rz_core_t::io, rz_io_read_at(), and rz_read_le64().

Referenced by getRefPtr(), and objc_find_refs().

Variable Documentation

objc2ClassBaseMethsOffs

const size_t objc2ClassBaseMethsOffs = 0x20

Definition at line 27 of file analysis_objc.c.

Referenced by objc_find_refs().

objc2ClassInfoOffs

const size_t objc2ClassInfoOffs = 0x20

Definition at line 25 of file analysis_objc.c.

Referenced by objc_find_refs().

objc2ClassMethImpOffs

const size_t objc2ClassMethImpOffs = 0x10

Definition at line 28 of file analysis_objc.c.

Referenced by objc_find_refs().

objc2ClassMethSize

const size_t objc2ClassMethSize = 0x18

Definition at line 26 of file analysis_objc.c.

Referenced by objc_find_refs().

objc2ClassSize

const size_t objc2ClassSize = 0x28

Definition at line 24 of file analysis_objc.c.

Referenced by objc_find_refs().