arandomdev / DyldExtractor

Extract Binaries from Apple's Dyld Shared Cache
MIT License
404 stars 40 forks source link

Wrong selector resolved in CameraUI framework iOS 14.6 #26

Closed PoomSmart closed 3 years ago

PoomSmart commented 3 years ago

Describe the bug

Consider this method: -[CAMTopBar _allowedControlsForVideoMode].

image

At 1A8BDF328, the selector is resolved as selRef__frameForModeView+3 and this is incorrect. I know for the fact that this method keeps adding an object to a NSMutableArray via addObject: selector. Only the first instance is resolved correctly, see the pseudocode below.

image

Happens also with -[CAMTopBar _allowedControlsForPortraitMode] and -[CAMTopBar _allowedControlsForSquareMode] and -[CAMTopBar _allowedControlsForStillImageMode].

To Reproduce

  1. iOS 14.6
  2. DYLD target device and identifier https://ipsw.me/download/iPhone10,6/18F72
  3. DyldExtractor 1.0.4

Additional context Add any other context about the problem here.

arandomdev commented 3 years ago

So I looked at the example, and it seems I have to rewrite _ObjCSelectorFixer 😅. It'll probably take a while again.

To elaborate, I assumed that each selector reference has one pair of ADRP and ADD instructions. But it seems that this assumption is wrong, and that multiple ADD instructions can reference the same ADRP instruction.

arandomdev commented 3 years ago

Okay, I think I fixed this with 922180978e526e9ad1127e70e1a044614be8ba67 on the BetterSelectorReferences branch. Can you test it out and let me know how it is?

PoomSmart commented 3 years ago

@arandomdev Working. 👍🏻 image

arandomdev commented 3 years ago

Closed with df998841ed702242cf4cbe341a58044490a97a04.