development/ghidra
development/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra synced 2024-09-19 10:11:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

GP-398: Code cleanup

Browse source
This commit is contained in:
Ryan Kurtz 2021-10-28 09:43:28 -04:00
parent 4fc4f69cbd
commit f6f2c31105
34 changed files with 163 additions and 205 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/commands/DyldChainedFixupHeader.java
View file

@ -24,9 +24,9 @@ import ghidra.program.model.data.*;
import ghidra.util.exception.DuplicateNameException;
/**
* Represents a dylib_reference structure.
* Represents a dyld_chained_fixups_header structure.
*
* @see <a href="https://opensource.apple.com/source/dyld/dyld-832.7.3/include/mach-o/fixup-chains.h.auto.html">mach-o/fixup-chains.h/a>
* @see <a href="https://opensource.apple.com/source/dyld/dyld-852.2/include/mach-o/fixup-chains.h.auto.html">mach-o/fixup-chains.h</a>
*/
public class DyldChainedFixupHeader implements StructConverter {

5
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/commands/DyldChainedFixupsCommand.java
View file

@ -29,6 +29,11 @@ import ghidra.program.model.util.CodeUnitInsertionException;
import ghidra.util.exception.DuplicateNameException;
import ghidra.util.task.TaskMonitor;
/**
* Represents a LC_DYLD_CHAINED_FIXUPS command.
*
* @see <a href="https://opensource.apple.com/source/xnu/xnu-7195.81.3/EXTERNAL_HEADERS/mach-o/loader.h.auto.html">mach-o/loader.h</a>
*/
public class DyldChainedFixupsCommand extends LinkEditDataCommand {
private DyldChainedFixupHeader chainHeader;

31
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/commands/DyldChainImport.java → Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/commands/DyldChainedImport.java
View file

@ -23,7 +23,12 @@ import ghidra.app.util.bin.format.macho.MachConstants;
import ghidra.program.model.data.*;
import ghidra.util.exception.DuplicateNameException;
public class DyldChainImport implements StructConverter {
/**
* Represents a dyld_chained_import structure.
*
* @see <a href="https://opensource.apple.com/source/dyld/dyld-852.2/include/mach-o/fixup-chains.h.auto.html">mach-o/fixup-chains.h</a>
*/
public class DyldChainedImport implements StructConverter {
private static final int DYLD_CHAINED_IMPORT = 1;
private static final int DYLD_CHAINED_IMPORT_ADDEND = 2;
private static final int DYLD_CHAINED_IMPORT_ADDEND64 = 3;
@ -35,25 +40,25 @@ public class DyldChainImport implements StructConverter {
private long addend;
private String symbolName;
static DyldChainImport createDyldChainImport(FactoryBundledWithBinaryReader reader,
static DyldChainedImport createDyldChainedImport(FactoryBundledWithBinaryReader reader,
DyldChainedFixupHeader cfh, int imports_format) throws IOException {
DyldChainImport dyldChainImport =
(DyldChainImport) reader.getFactory().create(DyldChainImport.class);
dyldChainImport.initDyldChainImport(reader, cfh, imports_format);
return dyldChainImport;
DyldChainedImport dyldChainedImport =
(DyldChainedImport) reader.getFactory().create(DyldChainedImport.class);
dyldChainedImport.initDyldChainedImport(reader, cfh, imports_format);
return dyldChainedImport;
}
/**
* DO NOT USE THIS CONSTRUCTOR, USE create*(GenericFactory ...) FACTORY METHODS INSTEAD.
*/
public DyldChainImport() {
public DyldChainedImport() {
}
private void initDyldChainImport(FactoryBundledWithBinaryReader reader,
DyldChainedFixupHeader cfh, int imports_format) throws IOException {
private void initDyldChainedImport(FactoryBundledWithBinaryReader reader,
DyldChainedFixupHeader cfh, int format) throws IOException {
this.imports_format = imports_format;
switch (imports_format) {
this.imports_format = format;
switch (format) {
case DYLD_CHAINED_IMPORT: {
int ival = reader.readNextInt();
lib_ordinal = ival & 0xff;
@ -78,13 +83,13 @@ public class DyldChainImport implements StructConverter {
break;
}
default:
throw new IOException("Bad Chained import format: " + imports_format);
throw new IOException("Bad Chained import format: " + format);
}
}
@Override
public DataType toDataType() throws DuplicateNameException, IOException {
StructureDataType dt = new StructureDataType("dyld_chain_import", 0);
StructureDataType dt = new StructureDataType("dyld_chained_import", 0);
try {
switch (imports_format) {

34
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/commands/DyldChainedImports.java
View file

@ -25,19 +25,16 @@ import ghidra.program.model.data.DataType;
import ghidra.util.exception.DuplicateNameException;
/**
* Represents a dylib_reference structure.
* Represents a dyld_chained_import array.
*
* @see <a href="https://opensource.apple.com/source/dyld/dyld-832.7.3/include/mach-o/fixup-chains.h.auto.html">mach-o/fixup-chains.h/a>
* @see <a href="https://opensource.apple.com/source/dyld/dyld-852.2/include/mach-o/fixup-chains.h.auto.html">mach-o/fixup-chains.h</a>
*/
public class DyldChainedImports implements StructConverter {
private static final int DYLD_CHAINED_IMPORT = 1;
private static final int DYLD_CHAINED_IMPORT_ADDEND = 2;
private static final int DYLD_CHAINED_IMPORT_ADDEND64 = 3;
private int imports_count;
private int imports_format;
private long imports_offset;
private DyldChainImport chainImports[];
private DyldChainedImport chainedImports[];
static DyldChainedImports createDyldChainedImports(FactoryBundledWithBinaryReader reader,
DyldChainedFixupHeader cfh) throws IOException {
@ -62,17 +59,18 @@ public class DyldChainedImports implements StructConverter {
this.imports_count = cfh.getImports_count();
this.imports_format = cfh.getImports_format();
ArrayList<DyldChainImport> starts = new ArrayList<>();
ArrayList<DyldChainedImport> starts = new ArrayList<>();
for (int i = 0; i < imports_count; i++) {
starts.add(DyldChainImport.createDyldChainImport(reader, cfh, imports_format));
starts.add(DyldChainedImport.createDyldChainedImport(reader, cfh, imports_format));
}
chainImports = starts.toArray(DyldChainImport[]::new);
chainedImports = starts.toArray(DyldChainedImport[]::new);
}
@Override
public DataType toDataType() throws DuplicateNameException, IOException {
DataType chainImportDt = chainImports[0].toDataType();
DataType dt = new ArrayDataType(chainImportDt, imports_count, chainImportDt.getLength());
DataType chainedImportDt = chainedImports[0].toDataType();
DataType dt =
new ArrayDataType(chainedImportDt, imports_count, chainedImportDt.getLength());
return dt;
}
@ -85,24 +83,24 @@ public class DyldChainedImports implements StructConverter {
return imports_offset;
}
public DyldChainImport[] getChainedImports() {
return chainImports;
public DyldChainedImport[] getChainedImports() {
return chainedImports;
}
public DyldChainImport getChainImport(int ordinal) {
public DyldChainedImport getChainedImport(int ordinal) {
if (ordinal < 0 || ordinal >= imports_count) {
return null;
}
return chainImports[ordinal];
return chainedImports[ordinal];
}
public void initSymbols(FactoryBundledWithBinaryReader reader,
DyldChainedFixupHeader dyldChainedFixupHeader) throws IOException {
long ptrIndex = reader.getPointerIndex();
for (DyldChainImport dyldChainImport : chainImports) {
reader.setPointerIndex(ptrIndex + dyldChainImport.getNameOffset());
dyldChainImport.initString(reader);
for (DyldChainedImport dyldChainedImport : chainedImports) {
reader.setPointerIndex(ptrIndex + dyldChainedImport.getNameOffset());
dyldChainedImport.initString(reader);
}
}
}

4
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/commands/DyldChainedStartsInImage.java
View file

@ -25,9 +25,9 @@ import ghidra.program.model.data.*;
import ghidra.util.exception.DuplicateNameException;
/**
* Represents a dylib_reference structure.
* Represents a dyld_chained_starts_in_image structure.
*
* @see <a href="https://opensource.apple.com/source/dyld/dyld-832.7.3/include/mach-o/fixup-chains.h.auto.html">mach-o/fixup-chains.h/a>
* @see <a href="https://opensource.apple.com/source/dyld/dyld-852.2/include/mach-o/fixup-chains.h.auto.html">mach-o/fixup-chains.h</a>
*/
public class DyldChainedStartsInImage implements StructConverter {

14
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/commands/DyldChainedStartsInSegment.java
View file

@ -24,9 +24,9 @@ import ghidra.program.model.data.*;
import ghidra.util.exception.DuplicateNameException;
/**
* Represents a dylib_reference structure.
* Represents a dyld_chained_starts_in_segment structure.
*
* @see <a href="https://opensource.apple.com/source/dyld/dyld-832.7.3/include/mach-o/fixup-chains.h.auto.html">mach-o/fixup-chains.h/a>
* @see <a href="https://opensource.apple.com/source/dyld/dyld-852.2/include/mach-o/fixup-chains.h.auto.html">mach-o/fixup-chains.h</a>
*/
public class DyldChainedStartsInSegment implements StructConverter {
@ -85,23 +85,23 @@ public class DyldChainedStartsInSegment implements StructConverter {
return size;
}
public short getPage_size() {
public short getPageSize() {
return page_size;
}
public short getPointer_format() {
public short getPointerFormat() {
return pointer_format;
}
public long getSegment_offset() {
public long getSegmentOffset() {
return segment_offset;
}
public int getMax_valid_pointer() {
public int getMaxValidPointer() {
return max_valid_pointer;
}
public short getPage_count() {
public short getPageCount() {
return page_count;
}

3
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/commands/DynamicLibraryModule.java
View file

@ -1,6 +1,5 @@
/* ###
* IP: GHIDRA
* REVIEWED: YES
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -70,7 +69,7 @@ public class DynamicLibraryModule implements StructConverter {
iinit_iterm = reader.readNextInt();
ninit_nterm = reader.readNextInt();
if (is32bit) {
objc_module_info_addr = reader.readNextInt() & 0xffffffffL;
objc_module_info_addr = reader.readNextUnsignedInt();
objc_module_info_size = reader.readNextInt();
}
else {

6
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/commands/FileSetEntryCommand.java
View file

@ -62,9 +62,9 @@ public class FileSetEntryCommand extends LoadCommand {
this.is32bit = is32bit;
if (is32bit) {
vmaddr = reader.readNextInt() & 0xffffffffL;
fileoff = reader.readNextInt() & 0xffffffffL;
unknown = reader.readNextInt() & 0xffffffffL;
vmaddr = reader.readNextUnsignedInt();
fileoff = reader.readNextUnsignedInt();
unknown = reader.readNextUnsignedInt();
}
else {
vmaddr = reader.readNextLong();

2
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/commands/NList.java
View file

@ -61,7 +61,7 @@ public class NList implements StructConverter {
n_sect = reader.readNextByte();
n_desc = reader.readNextShort();
if (is32bit) {
n_value = reader.readNextInt() & 0xffffffffL;
n_value = reader.readNextUnsignedInt();
}
else {
n_value = reader.readNextLong();

16
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/commands/RoutinesCommand.java
View file

@ -62,14 +62,14 @@ public class RoutinesCommand extends LoadCommand {
initLoadCommand(reader);
this.is32bit = is32bit;
if (is32bit) {
init_address = reader.readNextInt() & 0xffffffffL;
init_module = reader.readNextInt() & 0xffffffffL;
reserved1 = reader.readNextInt() & 0xffffffffL;
reserved2 = reader.readNextInt() & 0xffffffffL;
reserved3 = reader.readNextInt() & 0xffffffffL;
reserved4 = reader.readNextInt() & 0xffffffffL;
reserved5 = reader.readNextInt() & 0xffffffffL;
reserved6 = reader.readNextInt() & 0xffffffffL;
init_address = reader.readNextUnsignedInt();
init_module = reader.readNextUnsignedInt();
reserved1 = reader.readNextUnsignedInt();
reserved2 = reader.readNextUnsignedInt();
reserved3 = reader.readNextUnsignedInt();
reserved4 = reader.readNextUnsignedInt();
reserved5 = reader.readNextUnsignedInt();
reserved6 = reader.readNextUnsignedInt();
}
else {
init_address = reader.readNextLong();

8
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/commands/SegmentCommand.java
View file

@ -71,10 +71,10 @@ public class SegmentCommand extends LoadCommand {
segname = reader.readNextAsciiString(MachConstants.NAME_LENGTH);
if (is32bit) {
vmaddr = reader.readNextInt() & 0xffffffffL;
vmsize = reader.readNextInt() & 0xffffffffL;
fileoff = reader.readNextInt() & 0xffffffffL;
filesize = reader.readNextInt() & 0xffffffffL;
vmaddr = reader.readNextUnsignedInt();
vmsize = reader.readNextUnsignedInt();
fileoff = reader.readNextUnsignedInt();
filesize = reader.readNextUnsignedInt();
}
else {
vmaddr = reader.readNextLong();

4
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheAccelerateInfo.java
View file

@ -34,9 +34,9 @@ import ghidra.util.exception.*;
import ghidra.util.task.TaskMonitor;
/**
* Represents a dyld_cache_accelerate_info structure.
* Represents a dyld_cache_accelerator_info structure.
*
* @see <a href="https://opensource.apple.com/source/dyld/dyld-625.13/launch-cache/dyld_cache_format.h.auto.html">launch-cache/dyld_cache_format.h</a>
* @see <a href="https://opensource.apple.com/source/dyld/dyld-852.2/dyld3/shared-cache/dyld_cache_format.h.auto.html">dyld3/shared-cache/dyld_cache_format.h</a>
*/
@SuppressWarnings("unused")
public class DyldCacheAccelerateInfo implements StructConverter {

2
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheAcceleratorDof.java
View file

@ -26,7 +26,7 @@ import ghidra.util.exception.DuplicateNameException;
/**
* Represents a dyld_cache_accelerator_dof structure.
*
* @see <a href="https://opensource.apple.com/source/dyld/dyld-625.13/launch-cache/dyld_cache_format.h.auto.html">launch-cache/dyld_cache_format.h</a>
* @see <a href="https://opensource.apple.com/source/dyld/dyld-852.2/dyld3/shared-cache/dyld_cache_format.h.auto.html">dyld3/shared-cache/dyld_cache_format.h</a>
*/
@SuppressWarnings("unused")
public class DyldCacheAcceleratorDof implements StructConverter {

2
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheAcceleratorInitializer.java
View file

@ -26,7 +26,7 @@ import ghidra.util.exception.DuplicateNameException;
/**
* Represents a dyld_cache_accelerator_initializer structure.
*
* @see <a href="https://opensource.apple.com/source/dyld/dyld-625.13/launch-cache/dyld_cache_format.h.auto.html">launch-cache/dyld_cache_format.h</a>
* @see <a href="https://opensource.apple.com/source/dyld/dyld-852.2/dyld3/shared-cache/dyld_cache_format.h.auto.html">dyld3/shared-cache/dyld_cache_format.h</a>
*/
@SuppressWarnings("unused")
public class DyldCacheAcceleratorInitializer implements StructConverter {

20
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheConstants.java
View file

@ -1,20 +0,0 @@
/* ###
* IP: GHIDRA
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package ghidra.app.util.bin.format.macho.dyld;
public final class DyldCacheConstants {
}

89
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheHeader.java
View file

@ -21,7 +21,6 @@ import java.util.List;
import ghidra.app.util.bin.*;
import ghidra.app.util.bin.format.macho.MachConstants;
import ghidra.app.util.bin.format.macho.commands.NList;
import ghidra.app.util.importer.MessageLog;
import ghidra.program.model.address.*;
import ghidra.program.model.data.*;
@ -34,7 +33,7 @@ import ghidra.util.task.TaskMonitor;
/**
* Represents a dyld_cache_header structure.
*
* @see <a href="https://opensource.apple.com/source/dyld/dyld-832.7.3/dyld3/shared-cache/dyld_cache_format.h.auto.html</a>
* @see <a href="https://opensource.apple.com/source/dyld/dyld-852.2/dyld3/shared-cache/dyld_cache_format.h.auto.html">dyld3/shared-cache/dyld_cache_format.h</a>
*/
@SuppressWarnings("unused")
public class DyldCacheHeader implements StructConverter {
@ -59,7 +58,6 @@ public class DyldCacheHeader implements StructConverter {
private long accelerateInfoSize;
private long imagesTextOffset;
private long imagesTextCount;
private long patchInfoAddr;
private long patchInfoSize;
private long otherImageGroupAddrUnused; // unused
@ -70,12 +68,12 @@ public class DyldCacheHeader implements StructConverter {
private long progClosuresTrieSize;
private int platform;
private int dyld_info;
private int formatVersion; // Extracted from dyld_info
private boolean dylibsExpectedOnDisk; // Extracted from dyld_info
private boolean simulator; // Extracted from dyld_info
private boolean locallyBuiltCache; // Extracted from dyld_info
private boolean builtFromChainedFixups;// Extracted from dyld_info
private int padding; // Extracted from dyld_info
private int formatVersion; // Extracted from dyld_info
private boolean dylibsExpectedOnDisk; // Extracted from dyld_info
private boolean simulator; // Extracted from dyld_info
private boolean locallyBuiltCache; // Extracted from dyld_info
private boolean builtFromChainedFixups; // Extracted from dyld_info
private int padding; // Extracted from dyld_info
private long sharedRegionStart;
private long sharedRegionSize;
private long maxSlide;
@ -114,8 +112,8 @@ public class DyldCacheHeader implements StructConverter {
this.reader = reader;
long startIndex = reader.getPointerIndex();
// ------ HEADER 1 ---------
headerType = 1; // https://opensource.apple.com/source/dyld/dyld-95.3/launch-cache/dyld_cache_format.h.auto.html
// HEADER 1: https://opensource.apple.com/source/dyld/dyld-95.3/launch-cache/dyld_cache_format.h.auto.html
headerType = 1;
magic = reader.readNextByteArray(16);
mappingOffset = reader.readNextInt();
mappingCount = reader.readNextInt();
@ -123,9 +121,9 @@ public class DyldCacheHeader implements StructConverter {
imagesCount = reader.readNextInt();
dyldBaseAddress = reader.readNextLong();
// ------ HEADER 2 ---------
// HEADER 2: https://opensource.apple.com/source/dyld/dyld-195.5/launch-cache/dyld_cache_format.h.auto.html
if (reader.getPointerIndex() < mappingOffset) {
headerType = 2; // https://opensource.apple.com/source/dyld/dyld-195.5/launch-cache/dyld_cache_format.h.auto.html
headerType = 2;
codeSignatureOffset = reader.readNextLong();
codeSignatureSize = reader.readNextLong();
}
@ -134,28 +132,28 @@ public class DyldCacheHeader implements StructConverter {
slideInfoSize = reader.readNextLong();
}
// ------ HEADER 3 ---------
// HEADER 3: No header file for this version (without the following UUID), but there are images of this version
if (reader.getPointerIndex() < mappingOffset) {
headerType = 3; // No header file for this version (without the following UUID), but there are images of this version
headerType = 3;
localSymbolsOffset = reader.readNextLong();
localSymbolsSize = reader.readNextLong();
}
// ------ HEADER 4 ---------
// HEADER 4: https://opensource.apple.com/source/dyld/dyld-239.3/launch-cache/dyld_cache_format.h.auto.html
if (reader.getPointerIndex() < mappingOffset) {
headerType = 4; // https://opensource.apple.com/source/dyld/dyld-239.3/launch-cache/dyld_cache_format.h.auto.html
headerType = 4;
uuid = reader.readNextByteArray(16);
}
// ------ HEADER 5 ---------
// HEADER 5: https://opensource.apple.com/source/dyld/dyld-360.14/launch-cache/dyld_cache_format.h.auto.html
if (reader.getPointerIndex() < mappingOffset) {
headerType = 5; // https://opensource.apple.com/source/dyld/dyld-360.14/launch-cache/dyld_cache_format.h.auto.html
headerType = 5;
cacheType = reader.readNextLong();
}
// ------ HEADER 6 ---------
// HEADER 6: https://opensource.apple.com/source/dyld/dyld-421.1/launch-cache/dyld_cache_format.h.auto.html
if (reader.getPointerIndex() < mappingOffset) {
headerType = 6; // https://opensource.apple.com/source/dyld/dyld-421.1/launch-cache/dyld_cache_format.h.auto.html
headerType = 6;
branchPoolsOffset = reader.readNextInt();
branchPoolsCount = reader.readNextInt();
accelerateInfoAddr = reader.readNextLong();
@ -164,9 +162,9 @@ public class DyldCacheHeader implements StructConverter {
imagesTextCount = reader.readNextLong();
}
// ------ HEADER 7 ---------
// HEADER 7: https://opensource.apple.com/source/dyld/dyld-832.7.1/dyld3/shared-cache/dyld_cache_format.h.auto.html
if (reader.getPointerIndex() < mappingOffset) {
headerType = 7; // https://opensource.apple.com/source/dyld/dyld-832.7.3/dyld3/shared-cache/dyld_cache_format.h.auto.html
headerType = 7;
}
if (reader.getPointerIndex() < mappingOffset) {
patchInfoAddr = reader.readNextLong(); // (unslid) address of dyld_cache_patch_info
@ -455,40 +453,14 @@ public class DyldCacheHeader implements StructConverter {
}
/**
* Gets the NList symbol from the symbol table
* @param index ordinal entry of the symbol in symbol table
* @return The {@link NList}. Null if no symbols parsed
*/
public NList getSymbol(int ordinal) {
if (localSymbolsInfo == null) {
return null;
}
return localSymbolsInfo.getNList().get(ordinal);
}
/**
* Gets the {@link DyldCacheSlideInfoCommon}.
* Gets the {@link List} of {@link DyldCacheSlideInfoCommon}s.
*
* @return the {@link DyldCacheSlideInfoCommon}. Common, or particular version
* @return the {@link List} of {@link DyldCacheSlideInfoCommon}s.
*/
public List<DyldCacheSlideInfoCommon> getSlideInfos() {
return slideInfoList;
}
/**
* @return slideInfoOffset
*/
public long getSlideInfoOffset() {
return slideInfoOffset;
}
/**
* @return slideInfoSize
*/
public long getSlideInfoSize() {
return slideInfoSize;
}
/**
* Gets the {@link List} of branch pool address. Requires header to have been parsed.
*
@ -583,7 +555,7 @@ public class DyldCacheHeader implements StructConverter {
return struct;
}
protected void addHeaderField(StructureDataType struct, DataType dt, String fieldname,
private void addHeaderField(StructureDataType struct, DataType dt, String fieldname,
String comment) {
if (headerSize > struct.getLength()) {
struct.add(dt, fieldname, comment);
@ -627,10 +599,10 @@ public class DyldCacheHeader implements StructConverter {
}
}
private DyldCacheSlideInfoCommon parseSlideInfo(long slideInfoOffset, MessageLog log,
private DyldCacheSlideInfoCommon parseSlideInfo(long offset, MessageLog log,
TaskMonitor monitor) throws CancelledException {
DyldCacheSlideInfoCommon slideInfo =
DyldCacheSlideInfoCommon.parseSlideInfo(reader, slideInfoOffset, log, monitor);
DyldCacheSlideInfoCommon.parseSlideInfo(reader, offset, log, monitor);
return slideInfo;
}
@ -944,7 +916,9 @@ public class DyldCacheHeader implements StructConverter {
}
/**
* @return true if any slide info exists.
* Checks to see if any slide info exists
*
* @return True if any slide info exists; otherwise, false
*/
public boolean haSlideInfo() {
if (slideInfoSize != 0) {
@ -962,10 +936,9 @@ public class DyldCacheHeader implements StructConverter {
}
/**
* Get the original unslid load address
* This is found in the first mapping infos.
* Get the original unslid load address. This is found in the first mapping infos.
*
* @return unlslid load address
* @return the original unslid load address
*/
public long unslidLoadAddress() {
return mappingInfoList.get(0).getAddress();

2
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheImageInfo.java
View file

@ -26,7 +26,7 @@ import ghidra.util.exception.DuplicateNameException;
/**
* Represents a dyld_cache_image_info structure.
*
* @see <a href="https://opensource.apple.com/source/dyld/dyld-625.13/launch-cache/dyld_cache_format.h.auto.html">launch-cache/dyld_cache_format.h</a>
* @see <a href="https://opensource.apple.com/source/dyld/dyld-852.2/dyld3/shared-cache/dyld_cache_format.h.auto.html">dyld3/shared-cache/dyld_cache_format.h</a>
*/
@SuppressWarnings("unused")
public class DyldCacheImageInfo implements StructConverter {

2
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheImageInfoExtra.java
View file

@ -26,7 +26,7 @@ import ghidra.util.exception.DuplicateNameException;
/**
* Represents a dyld_cache_image_info_extra structure.
*
* @see <a href="https://opensource.apple.com/source/dyld/dyld-625.13/launch-cache/dyld_cache_format.h.auto.html">launch-cache/dyld_cache_format.h</a>
* @see <a href="https://opensource.apple.com/source/dyld/dyld-852.2/dyld3/shared-cache/dyld_cache_format.h.auto.html">dyld3/shared-cache/dyld_cache_format.h</a>
*/
@SuppressWarnings("unused")
public class DyldCacheImageInfoExtra implements StructConverter {

2
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheImageTextInfo.java
View file

@ -26,7 +26,7 @@ import ghidra.util.exception.DuplicateNameException;
/**
* Represents a dyld_cache_image_text_info structure.
*
* @see <a href="https://opensource.apple.com/source/dyld/dyld-625.13/launch-cache/dyld_cache_format.h.auto.html">launch-cache/dyld_cache_format.h</a>
* @see <a href="https://opensource.apple.com/source/dyld/dyld-852.2/dyld3/shared-cache/dyld_cache_format.h.auto.html">dyld3/shared-cache/dyld_cache_format.h</a>
*/
@SuppressWarnings("unused")
public class DyldCacheImageTextInfo implements StructConverter {

2
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheLocalSymbolsEntry.java
View file

@ -26,7 +26,7 @@ import ghidra.util.exception.DuplicateNameException;
/**
* Represents a dyld_cache_local_symbols_entry structure.
*
* @see <a href="https://opensource.apple.com/source/dyld/dyld-625.13/launch-cache/dyld_cache_format.h.auto.html">launch-cache/dyld_cache_format.h</a>
* @see <a href="https://opensource.apple.com/source/dyld/dyld-852.2/dyld3/shared-cache/dyld_cache_format.h.auto.html">dyld3/shared-cache/dyld_cache_format.h</a>
*/
@SuppressWarnings("unused")
public class DyldCacheLocalSymbolsEntry implements StructConverter {

2
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheLocalSymbolsInfo.java
View file

@ -40,7 +40,7 @@ import ghidra.util.task.TaskMonitor;
/**
* Represents a dyld_cache_local_symbols_info structure.
*
* @see <a href="https://opensource.apple.com/source/dyld/dyld-625.13/launch-cache/dyld_cache_format.h.auto.html">launch-cache/dyld_cache_format.h</a>
* @see <a href="https://opensource.apple.com/source/dyld/dyld-852.2/dyld3/shared-cache/dyld_cache_format.h.auto.html">dyld3/shared-cache/dyld_cache_format.h</a>
*/
@SuppressWarnings("unused")
public class DyldCacheLocalSymbolsInfo implements StructConverter {

4
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheMappingAndSlideInfo.java
View file

@ -27,7 +27,7 @@ import ghidra.util.exception.DuplicateNameException;
/**
* Represents a dyld_cache_mapping_and_slide_info structure.
*
* @see <a href="https://opensource.apple.com/source/dyld/dyld-832.7.3/dyld3/shared-cache/dyld_cache_format.h.auto.html">launch-cache/dyld_cache_format.h</a>
* @see <a href="https://opensource.apple.com/source/dyld/dyld-852.2/dyld3/shared-cache/dyld_cache_format.h.auto.html">dyld3/shared-cache/dyld_cache_format.h</a>
*/
@SuppressWarnings("unused")
public class DyldCacheMappingAndSlideInfo implements StructConverter {
@ -157,7 +157,7 @@ public class DyldCacheMappingAndSlideInfo implements StructConverter {
@Override
public DataType toDataType() throws DuplicateNameException, IOException {
StructureDataType struct = new StructureDataType("dyld_cache_mapping_info", 0);
StructureDataType struct = new StructureDataType("dyld_cache_mapping_and_slide_info", 0);
struct.add(QWORD, "address", "");
struct.add(QWORD, "size", "");
struct.add(QWORD, "fileOffset", "");

2
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheMappingInfo.java
View file

@ -27,7 +27,7 @@ import ghidra.util.exception.DuplicateNameException;
/**
* Represents a dyld_cache_mapping_info structure.
*
* @see <a href="https://opensource.apple.com/source/dyld/dyld-625.13/launch-cache/dyld_cache_format.h.auto.html">launch-cache/dyld_cache_format.h</a>
* @see <a href="https://opensource.apple.com/source/dyld/dyld-852.2/dyld3/shared-cache/dyld_cache_format.h.auto.html">dyld3/shared-cache/dyld_cache_format.h</a>
*/
@SuppressWarnings("unused")
public class DyldCacheMappingInfo implements StructConverter {

2
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheRangeEntry.java
View file

@ -26,7 +26,7 @@ import ghidra.util.exception.DuplicateNameException;
/**
* Represents a dyld_cache_range_entry structure.
*
* @see <a href="https://opensource.apple.com/source/dyld/dyld-625.13/launch-cache/dyld_cache_format.h.auto.html">launch-cache/dyld_cache_format.h</a>
* @see <a href="https://opensource.apple.com/source/dyld/dyld-852.2/dyld3/shared-cache/dyld_cache_format.h.auto.html">dyld3/shared-cache/dyld_cache_format.h</a>
*/
@SuppressWarnings("unused")
public class DyldCacheRangeEntry implements StructConverter {

2
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheSlideInfo1.java
View file

@ -34,7 +34,7 @@ import ghidra.util.task.TaskMonitor;
/**
* Represents a dyld_cache_slide_info structure.
*
* @see <a href="https://opensource.apple.com/source/dyld/dyld-625.13/launch-cache/dyld_cache_format.h.auto.html">launch-cache/dyld_cache_format.h</a>
* @see <a href="https://opensource.apple.com/source/dyld/dyld-852.2/dyld3/shared-cache/dyld_cache_format.h.auto.html">dyld3/shared-cache/dyld_cache_format.h</a>
*/
public class DyldCacheSlideInfo1 extends DyldCacheSlideInfoCommon {

14
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheSlideInfo2.java
View file

@ -34,7 +34,7 @@ import ghidra.util.task.TaskMonitor;
/**
* Represents a dyld_cache_slide_info2 structure.
*
* @see <a href="https://opensource.apple.com/source/dyld/dyld-625.13/launch-cache/dyld_cache_format.h.auto.html">launch-cache/dyld_cache_format.h</a>
* @see <a href="https://opensource.apple.com/source/dyld/dyld-852.2/dyld3/shared-cache/dyld_cache_format.h.auto.html">dyld3/shared-cache/dyld_cache_format.h</a>
*/
public class DyldCacheSlideInfo2 extends DyldCacheSlideInfoCommon {
@ -52,23 +52,23 @@ public class DyldCacheSlideInfo2 extends DyldCacheSlideInfoCommon {
private short page_extras_entries[];
public long getPageSize() {
return ((long) page_size) & 0xffffffff;
return Integer.toUnsignedLong(page_size);
}
public long getPageStartsOffset() {
return ((long) page_starts_offset) & 0xffffffff;
return Integer.toUnsignedLong(page_starts_offset);
}
public long getPageStartsCount() {
return ((long) page_starts_count) & 0xffffffff;
return Integer.toUnsignedLong(page_starts_count);
}
public long getPageExtrasOffset() {
return ((long) page_extras_offset) & 0xffffffff;
return Integer.toUnsignedLong(page_extras_offset);
}
public long getPageExtrasCount() {
return ((long) page_extras_count) & 0xffffffff;
return Integer.toUnsignedLong(page_extras_count);
}
public long getDeltaMask() {
@ -192,7 +192,7 @@ public class DyldCacheSlideInfo2 extends DyldCacheSlideInfoCommon {
/**
* Fixes up any chained pointers, starting at the given address.
*
* @param unchainedLocList list of locations that were unchained
* @param program the program
* @param page within data pages that has pointers to be unchained
* @param nextOff offset within the page that is the chain start
* @param deltaMask delta offset mask for each value

10
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheSlideInfo3.java
View file

@ -34,7 +34,7 @@ import ghidra.util.task.TaskMonitor;
/**
* Represents a dyld_cache_slide_info3 structure.
*
* @see <a href="https://opensource.apple.com/source/dyld/dyld-625.13/launch-cache/dyld_cache_format.h.auto.html">launch-cache/dyld_cache_format.h</a>
* @see <a href="https://opensource.apple.com/source/dyld/dyld-852.2/dyld3/shared-cache/dyld_cache_format.h.auto.html">dyld3/shared-cache/dyld_cache_format.h</a>
*/
public class DyldCacheSlideInfo3 extends DyldCacheSlideInfoCommon {
@ -147,7 +147,7 @@ public class DyldCacheSlideInfo3 extends DyldCacheSlideInfoCommon {
/**
* Fixes up any chained pointers, starting at the given address.
*
* @param unchainedLocList
* @param program the program
* @param page within data pages that has pointers to be unchained
* @param nextOff offset within the page that is the chain start
* @param auth_value_add value to be added to each chain pointer
@ -182,9 +182,9 @@ public class DyldCacheSlideInfo3 extends DyldCacheSlideInfoCommon {
if (isAuthenticated) {
long offsetFromSharedCacheBase = chainValue & 0xFFFFFFFFL;
long diversityData = (chainValue >> 32L) & 0xFFFFL;
long hasAddressDiversity = (chainValue >> 48L) & 0x1L;
long key = (chainValue >> 49L) & 0x3L;
//long diversityData = (chainValue >> 32L) & 0xFFFFL;
//long hasAddressDiversity = (chainValue >> 48L) & 0x1L;
//long key = (chainValue >> 49L) & 0x3L;
chainValue = offsetFromSharedCacheBase + auth_value_add;
}
else {

2
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheSlideInfo4.java
View file

@ -34,7 +34,7 @@ import ghidra.util.task.TaskMonitor;
/**
* Represents a dyld_cache_slide_info3 structure.
*
* @see <a href="https://opensource.apple.com/source/dyld/dyld-625.13/launch-cache/dyld_cache_format.h.auto.html">launch-cache/dyld_cache_format.h</a>
* @see <a href="https://opensource.apple.com/source/dyld/dyld-852.2/dyld3/shared-cache/dyld_cache_format.h.auto.html">dyld3/shared-cache/dyld_cache_format.h</a>
*/
public class DyldCacheSlideInfo4 extends DyldCacheSlideInfoCommon {

19
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheSlideInfoCommon.java
View file

@ -36,7 +36,7 @@ import ghidra.util.task.TaskMonitor;
* The intent is for the the full dyld_cache_slide_info structures to extend this and add their
* specific parts.
*
* @see <a href="https://opensource.apple.com/source/dyld/dyld-625.13/launch-cache/dyld_cache_format.h.auto.html">launch-cache/dyld_cache_format.h</a>
* @see <a href="https://opensource.apple.com/source/dyld/dyld-852.2/dyld3/shared-cache/dyld_cache_format.h.auto.html">dyld3/shared-cache/dyld_cache_format.h</a>
*/
public abstract class DyldCacheSlideInfoCommon implements StructConverter {
@ -44,8 +44,17 @@ public abstract class DyldCacheSlideInfoCommon implements StructConverter {
public static final int BYTES_PER_CHAIN_OFFSET = 4;
public static final int CHAIN_OFFSET_MASK = 0x3fff;
/**
* Parses the slide info
*
* @param reader A {@link BinaryReader} positioned at the start of a DYLD slide info
* @param slideInfoOffset The offset of the slide info to parse
* @param log The log
* @param monitor A cancelable task monitor
* @return The slide info object
*/
public static DyldCacheSlideInfoCommon parseSlideInfo(BinaryReader reader, long slideInfoOffset,
MessageLog log, TaskMonitor monitor) throws CancelledException {
MessageLog log, TaskMonitor monitor) {
if (slideInfoOffset == 0) {
return null;
}
@ -109,7 +118,7 @@ public abstract class DyldCacheSlideInfoCommon implements StructConverter {
/**
* Return the original slide info offset
*
* @return
* @return the original slide info offset
*/
public long getSlideInfoOffset() {
return slideInfoOffset;
@ -130,7 +139,9 @@ public abstract class DyldCacheSlideInfoCommon implements StructConverter {
/**
* Create pointers at each fixed chain location.
*
* @param unchainedLocList address list of fixed pointer locations
* @param program The program
* @param unchainedLocList Address list of fixed pointer locations
* @param monitor A cancelable task monitor
*
* @throws CancelledException if the user cancels
*/

3
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldChainedPtr.java
View file

@ -19,6 +19,9 @@ import ghidra.program.model.address.Address;
import ghidra.program.model.mem.Memory;
import ghidra.program.model.mem.MemoryAccessException;
/**
* @see <a href="https://opensource.apple.com/source/dyld/dyld-852.2/include/mach-o/fixup-chains.h.auto.html">mach-o/fixup-chains.h</a>
*/
public class DyldChainedPtr {
public enum DyldChainType {

2
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/threadcommand/ThreadStatePPC.java
View file

@ -140,7 +140,7 @@ public class ThreadStatePPC extends ThreadState {
private long read(FactoryBundledWithBinaryReader reader, boolean is32bit) throws IOException {
if (is32bit) {
return reader.readNextInt() & 0xffffffffL;
return reader.readNextUnsignedInt();
}
return reader.readNextLong();
}

2
Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/DyldCacheProgramBuilder.java
View file

@ -109,7 +109,6 @@ public class DyldCacheProgramBuilder extends MachoProgramBuilder {
markupHeaders();
markupBranchIslands();
createSymbols();
processDylibs();
}
@ -238,7 +237,6 @@ public class DyldCacheProgramBuilder extends MachoProgramBuilder {
log.appendMsg("Fixing page chains version: " + version);
info.fixPageChains(program, dyldCacheHeader, shouldAddRelocationEntries, log, monitor);
}
return;
}
/**

39
Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/MachoPrelinkProgramBuilder.java
View file

@ -274,20 +274,20 @@ public class MachoPrelinkProgramBuilder extends MachoProgramBuilder {
List<Address> fixedAddresses = new ArrayList<Address>();
long fixedAddressCount = 0;
if (chainStart.getPointer_format() == 0) {
if (chainStart.getPointerFormat() == 0) {
return fixedAddresses;
}
long dataPageStart = chainStart.getSegment_offset();
long dataPageStart = chainStart.getSegmentOffset();
dataPageStart = dataPageStart + program.getImageBase().getOffset();
long pageSize = chainStart.getPage_size();
long pageStartsCount = chainStart.getPage_count();
long pageSize = chainStart.getPageSize();
long pageStartsCount = chainStart.getPageCount();
long authValueAdd = 0;
short[] pageStarts = chainStart.getPage_starts();
short ptrFormatValue = chainStart.getPointer_format();
short ptrFormatValue = chainStart.getPointerFormat();
DyldChainType ptrFormat = DyldChainType.lookupChainPtr(ptrFormatValue);
monitor.setMessage("Fixing " + ptrFormat.getName() + " chained pointers...");
@ -387,19 +387,19 @@ public class MachoPrelinkProgramBuilder extends MachoProgramBuilder {
if (isAuthenticated && !isBound) {
long offsetFromSharedCacheBase =
DyldChainedPtr.getTarget(pointerFormat, chainValue);
long diversityData = DyldChainedPtr.getDiversity(pointerFormat, chainValue);
boolean hasAddressDiversity =
DyldChainedPtr.hasAddrDiversity(pointerFormat, chainValue);
long key = DyldChainedPtr.getKey(pointerFormat, chainValue);
//long diversityData = DyldChainedPtr.getDiversity(pointerFormat, chainValue);
//boolean hasAddressDiversity =
// DyldChainedPtr.hasAddrDiversity(pointerFormat, chainValue);
//long key = DyldChainedPtr.getKey(pointerFormat, chainValue);
newChainValue = imageBaseOffset + offsetFromSharedCacheBase + auth_value_add;
}
else if (!isAuthenticated && isBound) {
int chainOrdinal = (int) DyldChainedPtr.getOrdinal(pointerFormat, chainValue);
long addend = DyldChainedPtr.getAddend(pointerFormat, chainValue);
DyldChainedImports chainedImports = chainHeader.getChainedImports();
DyldChainImport chainImport = chainedImports.getChainImport(chainOrdinal);
int libOrdinal = chainImport.getLibOrdinal();
symName = chainImport.getName();
DyldChainedImport chainedImport = chainedImports.getChainedImport(chainOrdinal);
//int libOrdinal = chainedImport.getLibOrdinal();
symName = chainedImport.getName();
// lookup the symbol, and then add addend
List<Symbol> globalSymbols = program.getSymbolTable().getGlobalSymbols(symName);
if (globalSymbols.size() == 1) {
@ -409,16 +409,15 @@ public class MachoPrelinkProgramBuilder extends MachoProgramBuilder {
}
else if (isAuthenticated && isBound) {
int chainOrdinal = (int) DyldChainedPtr.getOrdinal(pointerFormat, chainValue);
long addend = DyldChainedPtr.getAddend(pointerFormat, chainValue);
long diversityData = DyldChainedPtr.getDiversity(pointerFormat, chainValue);
boolean hasAddressDiversity =
DyldChainedPtr.hasAddrDiversity(pointerFormat, chainValue);
long key = DyldChainedPtr.getKey(pointerFormat, chainValue);
//long addend = DyldChainedPtr.getAddend(pointerFormat, chainValue);
//long diversityData = DyldChainedPtr.getDiversity(pointerFormat, chainValue);
//boolean hasAddressDiversity =
// DyldChainedPtr.hasAddrDiversity(pointerFormat, chainValue);
//long key = DyldChainedPtr.getKey(pointerFormat, chainValue);
DyldChainedImports chainedImports = chainHeader.getChainedImports();
DyldChainImport chainImport = chainedImports.getChainImport(chainOrdinal);
symName = chainImport.getName();
DyldChainedImport chainedImport = chainedImports.getChainedImport(chainOrdinal);
symName = chainedImport.getName();
// lookup the symbol, and then add addend
List<Symbol> globalSymbols = program.getSymbolTable().getGlobalSymbols(symName);

13
Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/MachoProgramBuilder.java
View file

@ -432,19 +432,6 @@ public class MachoProgramBuilder {
}
}
/**
* Gets the NList symbol from the symbol table
* @param index ordinal entry of the symbol in symbol table
* @return The {@link NList}. Null if no symbols parsed
*/
public NList getSymbol(int ordinal) {
List<SymbolTableCommand> commands = machoHeader.getLoadCommands(SymbolTableCommand.class);
for (SymbolTableCommand symbolTableCommand : commands) {
return symbolTableCommand.getSymbolAt(ordinal);
}
return null;
}
/**
* The indirect symbols need to be applied across the IMPORT segment. The
* individual section do not really matter except the number of bytes