Vector35 / Vector35/binaryninja-api
Inlining of `objc_msgSend` calls can cause unrelated comments to appear in the decompilation
Nessuno ha ancora preso questa issue.
- Lingua principale
- C++
- Stelle
- 1.3k
- Fork
- 298
- Merge medio
- 5g 5h
- PR unite (30g)
- 19
Descrizione
Version and Platform (required):
- Binary Ninja Version: 4.1.5902 (f2165c5d) and 4.2.6228-dev (312c3c99)
- OS: macOS
- OS Version: 15.0
- CPU Architecture: M1
Bug Description:
Functions that inline objc_msgSend calls with the instructions from the objc_msgSend function will display comments, in the caller function's decompilation, that exist anywhere in the address range from the objc_msgSend call site to the objc_msgSend function that is inlined. This is often a very large address range. See the screenshots below for a visual example.
Steps To Reproduce:
- Add a comment somewhere between a function that calls
objc_msgSendand theobjc_msgSendfunction. - Go back to the calling function and observe that the comment appears in the disassembly above the
objc_msgSendcall.
Expected Behavior:
Comments outside the address range of the caller's function block, or the inlined objc_msgSend function should not appear in the decompilation for the caller's function block. This can create situations where there are many lines of comments filling up lots of functions making those functions pretty hard to navigate/read.
Screenshots/Video Recording:
The following is a screenshot of a function that inlines an objc_msgSend call, which is the final expression thats a jump. Due to the location of that jump call being at a substantially higher address than code in the rest of the function, the comment at 0x1823f1922 is added to the function decompilation even though it has nothing to do with it.
Here is the comment at its intended location:
And here is the objc_msgSend stub thats being inlined:
Screenshots were taken from Binary Ninja 4.2.6201-dev (301b815d).
Binary:
Any library from the DYLD Shared Cache can be used. The issue occurs in cases where the conditions are met. In the screenshots above, an extracted copy of the library /System/Library/Frameworks/Foundation.framework/Foundation from the DSC from an IPSW for an iPhone 16 Pro Max (iPhone17,2) with iOS 18.0 (22A3354).
Guida per i contributori
Nessuna guida per i contributori indicizzata per questo repository
Come iniziare
- Leggi tutta la issue e poi la guida ai contributi del progetto.
- Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
- Fai un fork del repository e lavora su un branch.
- Apri una pull request che faccia riferimento al numero della issue.
Direzione di ricerca
Reproduce the issue with a DYLD Shared Cache library and an inlined objc_msgSend stub, following the listed steps. Inspect how comments are selected between the call site and inlined function, then verify that comments outside the caller's function block or the inlined objc_msgSend function no longer appear in the caller's decompilation.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Valutazione
- Stack tecnologico
- objective-c
- Ambito
- reverse-engineering
- Tipo di issue
- Bug
- Difficoltà
- 4/5
- Tempo stimato
- 3-5 giorni
- Stato di attività
- Ferma
- Chiarezza
- Abbastanza chiara
- Idoneità per principianti
- 35/100