dyld-shared-cache-big-sur icon indicating copy to clipboard operation
dyld-shared-cache-big-sur copied to clipboard

pointers in `__DATA.__const` also need fixing up

Open zcutlip opened this issue 5 years ago • 5 comments

Great work with the objective-C patches. Thanks!

I'm finding a similar issue with pointers in __DATA.__const. You can mask off the high 24 bits and then you're left with the offset from the start of the shared cache where that string is located. Of course what you need is to rewrite that as the offset from the start of the dylib, just as you did with the selrefs. This doesn't seem as straightforward to fix as the __objc_selfrefs though since you can't just walk down all of __DATA.__const fixing anything that looks like maybe it's a pointer. I'd submit a patch but I'm not sure of the best approach here.

zcutlip avatar Jul 07 '20 23:07 zcutlip

I've got this working more generically including rebasing all pointers and symbols. Obj-c selectors get rebased in the process. Resulting dylibs now disassemble nicely in Hopper, IDA, etc.

It's a pretty big patch, but I'll clean it up and submit a PR if interested.

zcutlip avatar Jul 21 '20 17:07 zcutlip

@zcutlip Sounds fantastic. I’m interested. Looking forward to it!

antons avatar Jul 22 '20 04:07 antons

@zcutlip Any news on this? I’m now doing more work with the decompiled libraries and bumping into the limitations of my original patch. It’d be fantastic to have access to your patch and avoid wasting time independently doing this.

antons avatar Aug 02 '20 18:08 antons

I'm really sorry; haven't had time to clean it up and my c++ is terrible. How would you feel about me just attaching a patch to this issue? It applies against vanilla dyld-733.8, since the obj-c specific fixups should no longer necessary.

Maybe you'd be able to massage it into something more reasonable that what I hacked together?

zcutlip avatar Aug 02 '20 18:08 zcutlip

@zcutlip Feel free to either attach a patch, or submit a pull request. I’d be happy with it any state. Anything that works is better than nothing at all!

I’m not a C++ expert either, but I’ll see what I can do.

antons avatar Aug 03 '20 05:08 antons