Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

__EXTRA_OBJC_hidden entries are not fully analyzed #48

Open
PoomSmart opened this issue Dec 4, 2022 · 4 comments
Open

__EXTRA_OBJC_hidden entries are not fully analyzed #48

PoomSmart opened this issue Dec 4, 2022 · 4 comments

Comments

@PoomSmart
Copy link

Describe the bug

image

image

Shown above are the entries of setUserInteractionEnabled: selector and SBUIFlashlightController class inside FlashlightModule binary, respectively.

When classes are like that, the pseudocode generates this (focus on line 17):

image

To Reproduce

  1. iOS 15.5
  2. dyld_shared_cache_arm64 of iPod9,1 (https://www.theiphonewiki.com/wiki/Firmware/iPod_touch/15.x)
  3. Terminal command to reproduce.

Additional context
Add any other context about the problem here.

@arandomdev
Copy link
Owner

I checked the class structures and they looked perfectly okay, and in Ghidra it also had the same issue with off_1F856B8F8, except it properly had objc_msgSend instead of unk_1f856B210.

The only thing I can think of is that, it doesn't like it when a class reference pointer is not bound with bind information, which this binary doesn't have.

I also tried to force Ghidra to process the __objc_classrefs section normally by changing the section name to __objc_classlist, but the issue still persists. Due to this, I believe Ghidra and likely IDA, rely on export and bind info instead of ObjC runtime info for psudocode generation.

I'm very sorry for the inconvenience.

@PoomSmart
Copy link
Author

PoomSmart commented Dec 4, 2022

It's alright : ) take your time if thought to be possible

@arandomdev
Copy link
Owner

I was able to get DyldExtractorC to the point where it could generate bind info and test out my theory above.
image
I have also attached the extracted binary if you want to test it out in IDA.
FlashlightModule.zip

There's still a lot of ObjC stuff that needs to be implemented, but I first wanted to share this with you.

@PoomSmart
Copy link
Author

@arandomdev Much appreciated. Tested on IDA. It got better pseudocode.

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants