From 8e90b89bd42504476fc9e004ddf4e085c2bf5786 Mon Sep 17 00:00:00 2001 From: emteere <47253321+emteere@users.noreply.github.com> Date: Mon, 7 Oct 2019 09:35:53 -0400 Subject: [PATCH 01/14] Added pointer chain fixes for dyld cache. --- .../format/macho/dyld/DyldCacheHeader.java | 23 +++ .../macho/dyld/DyldCacheSlideInfo1.java | 20 +++ .../macho/dyld/DyldCacheSlideInfo2.java | 40 +++++ .../macho/dyld/DyldCacheSlideInfo3.java | 16 ++ .../app/util/opinion/DyldCacheLoader.java | 26 ++- .../util/opinion/DyldCacheProgramBuilder.java | 160 +++++++++++++++++- 6 files changed, 276 insertions(+), 9 deletions(-) diff --git a/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheHeader.java b/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheHeader.java index b8dee59278..a8f9463940 100644 --- a/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheHeader.java +++ b/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheHeader.java @@ -274,6 +274,29 @@ public class DyldCacheHeader implements StructConverter { public DyldCacheLocalSymbolsInfo getLocalSymbolsInfo() { return localSymbolsInfo; } + + /** + * Gets the {@link DyldCacheSlideInfoCommon}. + * + * @return the {@link DyldCacheSlideInfoCommon}. Common, or particular version + */ + public DyldCacheSlideInfoCommon getSlideInfo() { + return slideInfo; + } + + /** + * @return slideInfoOffset + */ + public long getSlideInfoOffset() { + return slideInfoOffset; + } + + /** + * @return slideInfoSize + */ + public long getSlideInfoSize() { + return slideInfoSize; + } /** * Gets the {@link List} of branch pool address. Requires header to have been parsed. diff --git a/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheSlideInfo1.java b/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheSlideInfo1.java index a515267df1..f1dc9d5037 100644 --- a/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheSlideInfo1.java +++ b/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheSlideInfo1.java @@ -36,6 +36,26 @@ public class DyldCacheSlideInfo1 extends DyldCacheSlideInfoCommon { private int entries_count; private int entries_size; + public int getTocOffset() { + return toc_offset; + } + + public int getTocCount() { + return toc_count; + } + + public int getEntriesOffset() { + return entries_offset; + } + + public int getEntriesCount() { + return entries_count; + } + + public int getEntriesSize() { + return entries_size; + } + /** * Create a new {@link DyldCacheSlideInfo1}. * diff --git a/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheSlideInfo2.java b/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheSlideInfo2.java index 8afea2c870..5dafe3706f 100644 --- a/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheSlideInfo2.java +++ b/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheSlideInfo2.java @@ -37,7 +37,45 @@ public class DyldCacheSlideInfo2 extends DyldCacheSlideInfoCommon { private int page_extras_count; private long delta_mask; private long value_add; + private short page_starts_entries[]; + private short page_extras_entries[]; + public int getPageSize() { + return page_size; + } + + public int getPageStartsOffset() { + return page_starts_offset; + } + + public int getPageStartsCount() { + return page_starts_count; + } + + public int getPageExtrasOffset() { + return page_extras_offset; + } + + public int getPageExtrasCount() { + return page_extras_count; + } + + public long getDeltaMask() { + return delta_mask; + } + + public long getValueAdd() { + return value_add; + } + + public short[] getPageStartsEntries() { + return page_starts_entries; + } + + public short[] getPageExtrasEntries() { + return page_extras_entries; + } + /** * Create a new {@link DyldCacheSlideInfo2}. * @@ -53,6 +91,8 @@ public class DyldCacheSlideInfo2 extends DyldCacheSlideInfoCommon { page_extras_count = reader.readNextInt(); delta_mask = reader.readNextLong(); value_add = reader.readNextLong(); + page_starts_entries = reader.readNextShortArray(page_starts_count); + page_extras_entries = reader.readNextShortArray(page_extras_count); } @Override diff --git a/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheSlideInfo3.java b/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheSlideInfo3.java index 2d68804a31..cb80f8c828 100644 --- a/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheSlideInfo3.java +++ b/Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/dyld/DyldCacheSlideInfo3.java @@ -35,6 +35,22 @@ public class DyldCacheSlideInfo3 extends DyldCacheSlideInfoCommon { private long auth_value_add; private short page_starts[]; + public int getPageSize() { + return page_size; + } + + public int getPageStartsCount() { + return page_starts_count; + } + + public long getAuthValueAdd() { + return auth_value_add; + } + + public short[] getPageStarts() { + return page_starts; + } + /** * Create a new {@link DyldCacheSlideInfo3}. * diff --git a/Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/DyldCacheLoader.java b/Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/DyldCacheLoader.java index a57a44bc5e..dab53329cb 100644 --- a/Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/DyldCacheLoader.java +++ b/Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/DyldCacheLoader.java @@ -47,8 +47,14 @@ public class DyldCacheLoader extends AbstractLibrarySupportLoader { static final String CREATE_DYLIB_SECTIONS_OPTION_NAME = "Create DYLIB section memory blocks"; /** Default value for loader option to create memory blocks for DYLIB sections */ - static final boolean CREATE_DYLIB_SECTIONS_OPTION_DEFAULT = true; + static final boolean CREATE_DYLIB_SECTIONS_OPTION_DEFAULT = false; + /** Loader option to add relocation entries for each fixed chain pointer */ + static final String ADD_RELOCATION_ENTRIES_OPTION_NAME = "Add relocation entries for fixed chain pointers"; + + /** Default value for loader option add relocation entries */ + static final boolean ADD_RELOCATION_ENTRIES_OPTION_DEFAULT = false; + @Override public Collection findSupportedLoadSpecs(ByteProvider provider) throws IOException { List loadSpecs = new ArrayList<>(); @@ -84,7 +90,8 @@ public class DyldCacheLoader extends AbstractLibrarySupportLoader { try { DyldCacheProgramBuilder.buildProgram(program, provider, MemoryBlockUtils.createFileBytes(program, provider, monitor), - shouldProcessSymbols(options), shouldCreateDylibSections(options), log, monitor); + shouldProcessSymbols(options), shouldCreateDylibSections(options), + addRelocationEntries(options), log, monitor); } catch (CancelledException e) { return; @@ -105,6 +112,9 @@ public class DyldCacheLoader extends AbstractLibrarySupportLoader { list.add( new Option(CREATE_DYLIB_SECTIONS_OPTION_NAME, CREATE_DYLIB_SECTIONS_OPTION_DEFAULT, Boolean.class, Loader.COMMAND_LINE_ARG_PREFIX + "-createDylibSections")); + list.add( + new Option(ADD_RELOCATION_ENTRIES_OPTION_NAME, ADD_RELOCATION_ENTRIES_OPTION_DEFAULT, + Boolean.class, Loader.COMMAND_LINE_ARG_PREFIX + "-addRelocationEntries")); } return list; } @@ -133,6 +143,18 @@ public class DyldCacheLoader extends AbstractLibrarySupportLoader { return CREATE_DYLIB_SECTIONS_OPTION_DEFAULT; } + private boolean addRelocationEntries(List