Vector35 / Vector35/binaryninja-api
_objc_msgSend rewrite parser cannot handle multiple functions sharing a selector name
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Lets say there are two class. Employee class and Student class. They are not related at all but they both have function called print.
current _objc_msgSend resolver doesn't account for that and sets everyone function to just one function.
You can see below its calling a function from Student when Employee is not even related to it
I think it should only set the address when you know for sure which object it is. maybe do sink -> init source analysis to know which class it is. and only change the call when it is likely correct.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the _objc_msgSend resolver and its rewrite parser, then reproduce the Employee/Student case described in the issue. Trace how selector names are mapped to functions when unrelated classes share a selector. Done means calls are rewritten only when the receiver's class can be identified with sufficient confidence, with the ambiguous case left unchanged.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- objective-c
- Domain
- devtools, reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100