search

trailofbits / multiplier

Code auditing productivity multiplier.
Apache License 2.0
438 stars 27 forks source link

Handle AppleClang-specific builtins #331

Open pgoodman opened 1 year ago

pgoodman commented 1 year ago

To find them:

strings /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang | grep -E '^__builtin_[a-zA-Z0-9_]+$' | sort | uniq > /tmp/apple_builtins
strings /Users/pag/Build/Release/multiplier/bin/Index/mx-index | grep -E '^__builtin_[a-zA-Z0-9_]+$' | sort | uniq > /tmp/mx_builtins
a = set(l.strip() for l in open("/tmp/apple_builtins"))
v = set(l.strip() for l in open("/tmp/mx_builtins"))
for b in sorted(m for m in a if m not in v):
  print(f" - [ ] {b}")
pgoodman commented 1 year ago

Good process to find them for IDA Pro:

strings -t x /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang | grep __builtin_xnu_

That gets us addresses like:

43f4550 __builtin_xnu_type_signature
43f456d __builtin_xnu_type_summary
43f4588 __builtin_xnu_types_compatible
4486b96 __builtin_xnu_type_signature
4486bb3 __builtin_xnu_type_summary
4486bce __builtin_xnu_types_compatible
4487788 __builtin_xnu_type_signature
44877a5 __builtin_xnu_type_summary

Then go to 10<address> in IDA, e.g. 1043f4550:

image

Then, double click on the data reference, and decompile:

image
pgoodman commented 1 year ago

Sometimes we won't find a coderef, and if IDA isn't telling us the DREFs, then we can go searching for them using search for bytes, using a hex string of bytes. Those results can get you the TARGET_BUILTIN info, e.g. the feature set:

image
pgoodman commented 1 year ago

The order of TARGET_BUILTIN info is:


#define TARGET_BUILTIN(id, type, attrs, features) \
  {#id, type, attrs, kNoHeaderName, \
   clang::LanguageID::ALL_LANGUAGES, features},
struct Info {
  const char *Name, *Type, *Attributes, *HeaderName;
  LanguageID Langs;
  const char *Features;
};

We can type it as:

struct clang_Builtin_Info {
  const char *Name, *Type, *Attributes, *HeaderName;
  int Langs;
  const char *Features;
};

In: Open Subviews > Local Types, right click insert.

Click on an address and key in y to apply the new structure type, clang_Builtin_Info. Then right click on the address to make an array if there are a bunch of them that you want to make.

image