/wi was falling through the switch case and it was not accepting the
input correctly. Fix this by breaking at the end of the '/w' case so
that the search can begin.
rz_buf_read_at() with a negative addr on a ref (slice) buffer broke all
subsequent calls to rz_buf_read_at(). This is fixed by making sure to
always reset to the initial seek.
This bug was detected through xnu kernelcaches, where we may also skip
any obviously invalid read.
IDREF in plists is an undocumented extension of plist used e.g. in
kernelcaches. This makes it possible to parse certain kext plists.
Backported, original patch b04bc4164cb2875723f3aae870647287e9a331cc
Co-authored-by: Siguza <siguza@siguza.net>
arm64e kernelcaches may have no BIND_OPCODE_THREADED but
__TEXT$__thread_starts instead, which should then be used, meaning
MACH0_(has_chained_fixups)() has to return false such that this info
will be processed.
For chained imports, we do not parse undefined symbols, so the upper
bound can be reduced there.
For non-chained imports, we can check for a definitely invalid value
using nsyms from LC_SYMTAB.
For bind chained fixups (pointing to imports parsed in the previous
commit) we reuse the patching code for classic relocs as the logic is
more generic here than for local chained fixups.
The LC_DYLD_CHAINED_FIXUPS load command references a new kind of imports
table that is used for binding chained fixups. A similar table may be
reconstructed from the legacy BIND_OPCODE_THREADED info. We now display
these new imports in `ii` instead of the classic undefined symbols and
use them to assign names to relocs.
Objective-C superclass resolution for chained fixups is also changed to
first check for relocs and then for a non-zero address read from memory
instead of ignoring relocs entirely when there is a non-zero value in
memory (this did not work for chained fixups as those already have
non-zero values before patching).
Chained fixups are essentially a new kind of relocs, so it makes sense
to also represent them as RzBinRelocs. Currently the results are
sometimes less meaningful than the reloc info that was parsed before
from indirectsyms in such cases, as chained imports are not parsed yet
and thus the target symbols of bind relocs are not yet known, hence the
temporarily BROKEN tests.
Some identical code from both mach-o 32 and 64 has been moved to
mach0_common.c to avoid duplicate compilation.
rz_mach0_platform_to_string() now recognizes all known platforms and the
information is shown as the subsys in the i command.
The "os" value was previously unreliably and ios sometimes showed as
"ios" and sometimes as "darwin" depending on the binary. Now the os is
"darwin" for all platforms. ios-* syscall files have thus been removed
as only darwin-* ones will be used.
* Remove old string detection methods.
* Allow changing encoding based on `bin.str.enc`
* Cleanup for optimization regarding RzAnalysisData and its kind
* Allow changing endianness.
* Extract major and minor from python version string instead of converting it to double
The patch fixes 3.10 version extraction (3.10 == 3.1)
* update latest python magic version to 3491 in get_code_object
* opcodes for python3.10
* PYC: do not search for strings in code
* PYC python 3.10 tests
* Fixed typo in "pyc 3.9 sections" test
* pyc: refactored string search
* pyc: removed parse_version_major_minor
use "magic_int_within" to check python version
