Vector35 / Vector35/binaryninja-api

Inlining of `objc_msgSend` calls can cause unrelated comments to appear in the decompilation

Aperta
#6,006 2 commenti 1 reazione 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Component: Core Effort: Low Impact: Low UI: Linear
Lingua principale
C++
Stelle
1.3k
Fork
298
Merge medio
5g 5h
PR unite (30g)
19

Descrizione

Version and Platform (required):

  • Binary Ninja Version: 4.1.5902 (f2165c5d) and 4.2.6228-dev (312c3c99)
  • OS: macOS
  • OS Version: 15.0
  • CPU Architecture: M1

Bug Description:
Functions that inline objc_msgSend calls with the instructions from the objc_msgSend function will display comments, in the caller function's decompilation, that exist anywhere in the address range from the objc_msgSend call site to the objc_msgSend function that is inlined. This is often a very large address range. See the screenshots below for a visual example.

Steps To Reproduce:

  1. Add a comment somewhere between a function that calls objc_msgSend and the objc_msgSend function.
  2. Go back to the calling function and observe that the comment appears in the disassembly above the objc_msgSend call.

Expected Behavior:
Comments outside the address range of the caller's function block, or the inlined objc_msgSend function should not appear in the decompilation for the caller's function block. This can create situations where there are many lines of comments filling up lots of functions making those functions pretty hard to navigate/read.

Screenshots/Video Recording:
The following is a screenshot of a function that inlines an objc_msgSend call, which is the final expression thats a jump. Due to the location of that jump call being at a substantially higher address than code in the rest of the function, the comment at 0x1823f1922 is added to the function decompilation even though it has nothing to do with it.
SCR-20241018-qw6

Here is the comment at its intended location:
SCR-20241018-qx0

And here is the objc_msgSend stub thats being inlined:
SCR-20241018-qyr

Screenshots were taken from Binary Ninja 4.2.6201-dev (301b815d).

Binary:
Any library from the DYLD Shared Cache can be used. The issue occurs in cases where the conditions are met. In the screenshots above, an extracted copy of the library /System/Library/Frameworks/Foundation.framework/Foundation from the DSC from an IPSW for an iPhone 16 Pro Max (iPhone17,2) with iOS 18.0 (22A3354).

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Direzione di ricerca

Reproduce the issue with a DYLD Shared Cache library and an inlined objc_msgSend stub, following the listed steps. Inspect how comments are selected between the call site and inlined function, then verify that comments outside the caller's function block or the inlined objc_msgSend function no longer appear in the caller's decompilation.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
objective-c
Ambito
reverse-engineering
Tipo di issue
Bug
Difficoltà
4/5
Tempo stimato
3-5 giorni
Stato di attività
Ferma
Chiarezza
Abbastanza chiara
Idoneità per principianti
35/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.