Built-in bntl definitions for Objective-C types override analysis

Open
#8,567 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
45/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
objective-c
Domain
reverse-engineering

Research direction

Start by opening the dyld shared cache and loading AppKit, then inspect a function on NSWindow that accesses ivars. Compare the built-in NSWindow definition with the runtime-derived type and verify that the recovered ivar layout remains named NSWindow rather than NSWindow_1 and is used in decompilation.

Written by the indexing model from the issue text.

Description

Component: Objective-C Workflow Component: Type Libraries File Format: SharedCache Impact: Medium Language: Objective-C

Version and Platform (required):

  • Binary Ninja Version: 6.1.10695-dev (13194322)
  • Edition: Commercial
  • OS: macOS
  • OS Version: 27.2 (26B5086k)
  • CPU Architecture: Apple silicon

Bug Description:
When analyzing system frameworks, Binary Ninja correctly parses Objective-C runtime metadata to generate detailed type layout for objects (e.g. it can identify ivars). However this usually does not get applied, because before analysis runs, some type library definitions are loaded first. These type libraries provide degenerate definitions of these classes (e.g. NSWindow is defined as just objc_object *) and this shifts the nicely-annotated versions into names like NSWindow_1 and this makes a bunch of the decompilation not be able to use it.

Steps To Reproduce:
Please provide all steps required to reproduce the behavior:

  1. Open the dyld shared cache and load AppKit.
  2. Load a function on NSWindow that accesses its ivars.

Expected Behavior:
I expect to see clear ivar accesses, because Binary Ninja is able to recover all of these. I also expect that these are defined on a type named NSWindow, not NSWindow_1.

Screenshots/Video Recording:
Image

Binary:
Ask me if you really need the shared cache I guess

Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Vector35/binaryninja-api

All issues in Vector35/binaryninja-api

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.