Nixyri/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2025-02-14 14:40:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

GP-2176: Some dyld_shared_cache fixes

Browse Source
This commit is contained in:
Ryan Kurtz 2022-08-10 06:39:19 -04:00
parent 60401040e2
commit 2d51b95cd4
3 changed files with 42 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheHeader.java
View File

@ -310,7 +310,14 @@ public class DyldCacheHeader implements StructConverter {
subCacheArrayCount = reader.readNextInt();
}
if (reader.getPointerIndex() < mappingOffset) {
symbolFileUUID = reader.readNextByteArray(16);
symbolFileUUID = null;
byte[] temp = reader.readNextByteArray(16);
for (int i = 0; i < temp.length; i++) {
if (temp[i] != 0) {
symbolFileUUID = temp;
break;
}
}
}
if (reader.getPointerIndex() < mappingOffset) {
rosettaReadOnlyAddr = reader.readNextLong();
@ -330,6 +337,10 @@ public class DyldCacheHeader implements StructConverter {
if (reader.getPointerIndex() < mappingOffset) {
imagesCount = reader.readNextInt();
}
// HEADER 9: <unknown>
if (reader.getPointerIndex() < mappingOffset) {
headerType = 9;
}
headerSize = (int) (reader.getPointerIndex() - startIndex);
@ -503,15 +514,6 @@ public class DyldCacheHeader implements StructConverter {
return NumericUtilities.convertBytesToString(uuid);
}
/**
* Gets the cache type
*
* @return The cache type
*/
public long getCacheType() {
return cacheType;
}
/**
* Gets the {@link List} of {@link DyldCacheMappingInfo}s. Requires header to have been parsed.
*
@ -582,7 +584,7 @@ public class DyldCacheHeader implements StructConverter {
* Gets the symbol file UUID in {@link String} form
*
* @return The symbol file UUID in {@link String} form, or null if a symbol file UUID is not
* defined
* defined or is all zeros
*/
public String getSymbolFileUUID() {
return NumericUtilities.convertBytesToString(symbolFileUUID);
@ -851,7 +853,7 @@ public class DyldCacheHeader implements StructConverter {
try {
reader.setPointerIndex(subCacheArrayOffset);
for (int i = 0; i < subCacheArrayCount; ++i) {
subcacheEntryList.add(new DyldSubcacheEntry(reader, cacheType));
subcacheEntryList.add(new DyldSubcacheEntry(reader, headerType));
monitor.checkCanceled();
monitor.incrementProgress(1);
}
@ -864,7 +866,7 @@ public class DyldCacheHeader implements StructConverter {
private void parseAcceleratorInfo(Program program, AddressSpace space, MessageLog log,
TaskMonitor monitor) throws CancelledException {
if (accelerateInfoAddr == 0 || cacheType >= 2) {
if (accelerateInfoAddr == 0 || headerType >= 9) {
return;
}
monitor.setMessage("Parsing DYLD accelerateor info...");
@ -1042,7 +1044,7 @@ public class DyldCacheHeader implements StructConverter {
monitor.setMessage("Marking up DYLD accelerator info...");
monitor.initialize(1);
try {
if (accelerateInfo != null && cacheType < 2) {
if (accelerateInfo != null && headerType < 9) {
Address addr = space.getAddress(accelerateInfoAddr);
DataUtilities.createData(program, addr, accelerateInfo.toDataType(), -1, false,
DataUtilities.ClearDataMode.CHECK_FOR_SPACE);
@ -1177,6 +1179,6 @@ public class DyldCacheHeader implements StructConverter {
* @return True if this is a subcache; otherwise, false if its a base cache
*/
public boolean isSubcache() {
return headerType >= 8 && subCacheArrayCount == 0;
return headerType >= 8 && subCacheArrayCount == 0 && symbolFileUUID == null;
}
}

18
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldSubcacheEntry.java
View File

@ -36,17 +36,17 @@ public class DyldSubcacheEntry implements StructConverter {
private long cacheVMOffset;
private byte[] cacheExtension;
private long cacheType;
private long headerType;
/**
* Create a new {@link DyldSubcacheEntry}.
*
* @param reader A {@link BinaryReader} positioned at the start of a DYLD subCache entry
* @param cacheType The cache type value
* @param headerType The header type value
* @throws IOException if there was an IO-related problem creating the DYLD subCache entry
*/
public DyldSubcacheEntry(BinaryReader reader, long cacheType) throws IOException {
this.cacheType = cacheType;
public DyldSubcacheEntry(BinaryReader reader, long headerType) throws IOException {
this.headerType = headerType;
uuid = reader.readNextByteArray(16);
cacheVMOffset = reader.readNextLong();
@ -82,7 +82,13 @@ public class DyldSubcacheEntry implements StructConverter {
if (cacheExtension == null) {
return null;
}
return new String(cacheExtension, StandardCharsets.US_ASCII);
int i;
for (i = 0; i < cacheExtension.length; i++) {
if (cacheExtension[i] == 0) {
break;
}
}
return new String(cacheExtension, 0, i, StandardCharsets.US_ASCII);
}
@Override
@ -105,6 +111,6 @@ public class DyldSubcacheEntry implements StructConverter {
* @return True if the subCache extension is known; otherwise, false
*/
private boolean supportsCacheExtension() {
return cacheType >= 2;
return headerType >= 9;
}
}

23
Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/DyldCacheUtils.java
View File

@ -129,7 +129,8 @@ public class DyldCacheUtils {
names.add(baseProvider.getName());
// Setup additional "split" DYLD subcaches (if applicable)
if (baseHeader.getSubcacheEntries().size() == 0) {
if (baseHeader.getSubcacheEntries().size() == 0 &&
baseHeader.getSymbolFileUUID() == null) {
return;
}
fsService = FileSystemService.getInstance();
@ -160,19 +161,21 @@ public class DyldCacheUtils {
}
else {
log.appendMsg(String.format("Missing subcache: %s%s",
extension != null ? (baseProvider.getName() + "." + extension + " - ") : "",
extension != null ? (baseProvider.getName() + extension + " - ") : "",
uuid));
}
}
String symbolUUID = baseHeader.getSymbolFileUUID();
FSRL symbolFSRL = uuidToFileMap.get(symbolUUID);
if (symbolFSRL != null) {
log.appendMsg(
"Including symbols subcache: " + symbolFSRL.getName() + " - " + symbolUUID);
}
else {
log.appendMsg(String.format("Missing symbols subcache: %s%s",
baseProvider.getName() + ".symbols - " + symbolUUID));
if (symbolUUID != null) {
FSRL symbolFSRL = uuidToFileMap.get(symbolUUID);
if (symbolFSRL != null) {
log.appendMsg(
"Including symbols subcache: " + symbolFSRL.getName() + " - " + symbolUUID);
}
else {
log.appendMsg(String.format("Missing symbols subcache: %s.symbols - %s",
baseProvider.getName(), symbolUUID));
}
}
}