Initial support for analyzing categories.

Author: fabianfreyer

CMakeLists.txt

@@ -26,6 +26,7 @@ add_subdirectory(Vendor/BinaryNinjaAPI)
 # Core library -----------------------------------------------------------------
 
 set(CORE_SOURCE
+  Include/ObjectiveNinjaCore/Analyzers/CategoryAnalyzer.h
   Include/ObjectiveNinjaCore/Analyzers/CFStringAnalyzer.h
   Include/ObjectiveNinjaCore/Analyzers/ClassAnalyzer.h
   Include/ObjectiveNinjaCore/Analyzers/SelectorAnalyzer.h
@@ -36,6 +37,7 @@ set(CORE_SOURCE
   Include/ObjectiveNinjaCore/AnalysisProvider.h
   Include/ObjectiveNinjaCore/Analyzer.h
   Include/ObjectiveNinjaCore/TypeParser.h
+  Core/Analyzers/CategoryAnalyzer.cpp
   Core/Analyzers/CFStringAnalyzer.cpp
   Core/Analyzers/ClassAnalyzer.cpp
   Core/Analyzers/SelectorAnalyzer.cpp

Core/AnalysisProvider.cpp

@@ -9,6 +9,7 @@
 
 #include <ObjectiveNinjaCore/Analyzers/CFStringAnalyzer.h>
 #include <ObjectiveNinjaCore/Analyzers/ClassAnalyzer.h>
+#include <ObjectiveNinjaCore/Analyzers/CategoryAnalyzer.h>
 #include <ObjectiveNinjaCore/Analyzers/SelectorAnalyzer.h>
 
 namespace ObjectiveNinja {
@@ -20,6 +21,7 @@ SharedAnalysisInfo AnalysisProvider::infoForFile(SharedAbstractFile file)
     std::vector<std::unique_ptr<ObjectiveNinja::Analyzer>> analyzers;
     analyzers.emplace_back(new SelectorAnalyzer(info, file));
     analyzers.emplace_back(new ClassAnalyzer(info, file));
+    analyzers.emplace_back(new CategoryAnalyzer(info, file));
     analyzers.emplace_back(new CFStringAnalyzer(info, file));
 
     for (const auto& analyzer : analyzers)

Include/ObjectiveNinjaCore/AnalysisInfo.h

@@ -92,6 +92,21 @@ struct ClassInfo {
     uint64_t methodListAddress {};
 };
 
+/**
+ * A description of an Objective-C category.
+ */
+struct CategoryInfo {
+    uint64_t address {};
+    std::string name {};
+    MethodListInfo instanceMethods {};
+    MethodListInfo classMethods {};
+
+    uint64_t listPointer {};
+    uint64_t nameAddress {};
+    uint64_t instanceMethodListAddress {};
+    uint64_t classMethodListAddress {};
+};
+
 /**
  * Analysis info storage.
  *
@@ -106,6 +121,7 @@ struct AnalysisInfo {
     std::unordered_map<uint64_t, SharedSelectorRefInfo> selectorRefsByKey {};
 
     std::vector<ClassInfo> classes {};
+    std::vector<CategoryInfo> categories {};
     std::unordered_map<uint64_t, uint64_t> methodImpls;
 
     std::string dump() const;
@@ -123,4 +139,8 @@ NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE(MethodListInfo, address, flags, methods)
 
 NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE(ClassInfo, listPointer, address, dataAddress,
     nameAddress, name, methodListAddress, methodList)
+
+NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE(CategoryInfo, listPointer, address, nameAddress,
+    name, instanceMethodListAddress, instanceMethods, classMethodListAddress,
+    classMethods)
 }

Plugin/CustomTypes.cpp

@@ -73,6 +73,15 @@ struct objc_class_t {
     void* vtable;
     const fptr_t data;
 };
+
+struct objc_category_t {
+    const char* name;
+    void* class;
+    const tptr_t instance_methods;
+    const tptr_t class_methods;
+    const tptr_t protocols;
+    const tptr_t instance_properties;
+}
 )";
 
 namespace CustomTypes {

Plugin/CustomTypes.h

@@ -28,6 +28,7 @@ const std::string Method = "objc_method_t";
 const std::string MethodListEntry = "objc_method_entry_t";
 const std::string Class = "objc_class_t";
 const std::string ClassRO = "objc_class_ro_t";
+const std::string Category = "objc_category_t";
 
 /**
  * Define all Objective-C-related types for a view.

Plugin/InfoHandler.cpp

@@ -123,6 +123,7 @@ void InfoHandler::applyInfoToView(SharedAnalysisInfo info, BinaryViewRef bv)
     BinaryReader reader(bv);
 
     auto taggedPointerType = namedType(bv, CustomTypes::TaggedPointer);
+    auto categoryType = namedType(bv, CustomTypes::Category);
     auto cfStringType = namedType(bv, CustomTypes::CFString);
     auto classType = namedType(bv, CustomTypes::Class);
     auto classDataType = namedType(bv, CustomTypes::ClassRO);
@@ -195,4 +196,60 @@ void InfoHandler::applyInfoToView(SharedAnalysisInfo info, BinaryViewRef bv)
         defineVariable(bv, ci.methodListAddress, methodListType);
         defineSymbol(bv, ci.methodListAddress, ci.name, "ml_");
     }
+
+    // Create data variables and symbols for the analyzed protocols.
+    for (const auto& ci : info->categories) {
+        defineVariable(bv, ci.listPointer, taggedPointerType);
+        defineVariable(bv, ci.address, categoryType);
+
+        defineSymbol(bv, ci.listPointer, ci.name, "catp_");
+        defineSymbol(bv, ci.address, ci.name, "cat_");
+
+        defineReference(bv, ci.listPointer, ci.address);
+
+        if (ci.instanceMethods.address && !ci.instanceMethods.methods.empty()) {
+            auto methodType = ci.instanceMethods.hasRelativeOffsets()
+                ? bv->GetTypeByName(CustomTypes::MethodListEntry)
+                : bv->GetTypeByName(CustomTypes::Method);
+
+            // Create data variables for each method in the method list.
+            for (const auto& mi : ci.instanceMethods.methods) {
+                defineVariable(bv, mi.address, methodType);
+                defineSymbol(bv, mi.address, sanitizeSelector(mi.selector), "mt_");
+                defineVariable(bv, mi.typeAddress, stringType(mi.type.size()));
+
+                defineReference(bv, ci.instanceMethods.address, mi.address);
+                defineReference(bv, mi.address, mi.nameAddress);
+                defineReference(bv, mi.address, mi.typeAddress);
+                defineReference(bv, mi.address, mi.implAddress);
+            }
+
+            // Create a data variable and symbol for the method list header.
+            defineVariable(bv, ci.instanceMethodListAddress, methodListType);
+            defineSymbol(bv, ci.instanceMethodListAddress, ci.name, "mli_");
+        }
+
+
+        if (ci.classMethods.address && !ci.classMethods.methods.empty()) {
+            auto methodType = ci.classMethods.hasRelativeOffsets()
+                ? bv->GetTypeByName(CustomTypes::MethodListEntry)
+                : bv->GetTypeByName(CustomTypes::Method);
+
+            // Create data variables for each method in the method list.
+            for (const auto& mi : ci.classMethods.methods) {
+                defineVariable(bv, mi.address, methodType);
+                defineSymbol(bv, mi.address, sanitizeSelector(mi.selector), "mt_");
+                defineVariable(bv, mi.typeAddress, stringType(mi.type.size()));
+
+                defineReference(bv, ci.classMethods.address, mi.address);
+                defineReference(bv, mi.address, mi.nameAddress);
+                defineReference(bv, mi.address, mi.typeAddress);
+                defineReference(bv, mi.address, mi.implAddress);
+            }
+
+            // Create a data variable and symbol for the method list header.
+            defineVariable(bv, ci.classMethodListAddress, methodListType);
+            defineSymbol(bv, ci.classMethodListAddress, ci.name, "mlc_");
+        }
+    }
 }