search

ReverseApple / GhidraApple

Better Apple binary analysis for Ghidra
GNU General Public License v3.0
40 stars 3 forks source link

Inject Type Info via objc_alloc #15

Closed fmagin closed 2 days ago

fmagin commented 1 month ago

With the types from #14 we can now start applying them:

We need an analysis that over all objc_alloc callsites (i.e. all P-Code CALL ops with the first argument being the objc_alloc address) and then retrieve the constant value behind the second argument. It won't be a const varnode directly but a unique varnode, so you will have to go backwards via the definitions to the const varnode.

Then we need to map the address back to the type somehow. I see a few options for this, not sure which works best. The most straightforward one is probably getting the symbol at that address and looking for a matching type name. Later we might want to coordinate this via some class or service that keeps track of those mappings.

Then we need use the same API to override the call signature at an address which is used by OverridePrototypeAction

AnalyzerType.FUNCTION_ANALYZER with AnalysisPriority.FUNCTION_ANALYSIS.after()

AngeloD2022 commented 3 weeks ago

It won't be a const varnode directly but a unique varnode, so you will have to go backwards via the definitions to the const varnode.

When looking at the HighFunction pcode, the arguments for the CALL were immediately available and seemingly directly associated with the op.

...
 ---  CBRANCH (ram, 0x100007cf0, 1) , (unique, 0x18f80, 1)
(VARIABLE, 0x0, 16) CALL (ram, 0x100041c00, 8) , (ram, 0x10008eea0, 8)
...

0x100041c00 -> _objc_alloc 0x10008eea0 -> PTR__OBJC_CLASS_$_NSPopUpButton_10008ee90

Do we intend on using the lower-level pcode for this?

fmagin commented 3 weeks ago

Nope, if you can get it directly that's good. I'm surprised that you got that refined P-Code though? Which API did you use?

AngeloD2022 commented 3 weeks ago

I wrote a plugin that dumps the pcode from the decompiler interface.

fmagin commented 3 weeks ago

Those are the same APIs I was typically using, I'll look into this, but for now you can just use that, makes the whole analysis even easier.

AngeloD2022 commented 2 weeks ago

Experiencing some issues with applying the types. The identification works, but for whatever reason, Ghidra will not mutate the data type for a Varnode. I pushed my failed attempt.

AngeloD2022 commented 2 weeks ago

I'm going to see if the way they're doing it here works: https://github.com/NationalSecurityAgency/ghidra/blob/d87add933eb9bd5ae753f5533a2e1997eb21538c/Ghidra/Features/Decompiler/src/main/java/ghidra/app/plugin/core/decompile/actions/RetypeLocalAction.java#L54