Vector35 / binaryninja-api

Public API, examples, documentation and issues for Binary Ninja
https://binary.ninja/
MIT License
947 stars 213 forks source link

Multiple issues with MH_FILESET loading on an iOS 17 kernelcache #4651

Open 0cyn opened 1 year ago

0cyn commented 1 year ago

Version and Platform (required):

Bug Description: Loading an iOS 17 MH_FILESET cache appears to have multiple issues with which segments are properly loaded and where.

Steps To Reproduce:

  1. Open the following kernelcache located in the root of this iOS update package

As shown in the below image, the segment which contains the actual file header and should be loaded into memory at 0xfffffff027004000 is not loaded. Additionally, whichever header was loaded at the top of the file (possibly the first image? however this address does not correspond with anything in other tools) is not the appropriate header, and was not typed automatically whatsoever, indicating deeper issues with the header processing.

image

rickmark commented 11 months ago

Seems there's some progress with this in the -dev 3.6 path, as its loading MHFILESET pretty well, but the big issue is that it doesn't seem to 1) actually group using the component API, and that the parsing of the symbol names doesn't occur leaving you living in `sub*` land...

My presumption is that whatever is to pick up the symbols isn't aligned yet, but most of the other support is there.