Skip to content

Built-in bntl definitions for Objective-C types override analysis #8567

Description

@saagarjha

Version and Platform (required):

  • Binary Ninja Version: 6.1.10695-dev (13194322)
  • Edition: Commercial
  • OS: macOS
  • OS Version: 27.2 (26B5086k)
  • CPU Architecture: Apple silicon

Bug Description:
When analyzing system frameworks, Binary Ninja correctly parses Objective-C runtime metadata to generate detailed type layout for objects (e.g. it can identify ivars). However this usually does not get applied, because before analysis runs, some type library definitions are loaded first. These type libraries provide degenerate definitions of these classes (e.g. NSWindow is defined as just objc_object *) and this shifts the nicely-annotated versions into names like NSWindow_1 and this makes a bunch of the decompilation not be able to use it.

Steps To Reproduce:
Please provide all steps required to reproduce the behavior:

  1. Open the dyld shared cache and load AppKit.
  2. Load a function on NSWindow that accesses its ivars.

Expected Behavior:
I expect to see clear ivar accesses, because Binary Ninja is able to recover all of these. I also expect that these are defined on a type named NSWindow, not NSWindow_1.

Screenshots/Video Recording:
Image

Binary:
Ask me if you really need the shared cache I guess

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions