|
1 | 1 | # Objective-C |
2 | 2 |
|
3 | | -Binary Ninja ships with [an additional plugin](https://github.com/Vector35/workflow_objc) for assisting with Objective-C analysis. |
| 3 | +Binary Ninja ships with built-in functionality for assisting with Objective-C analysis. |
4 | 4 | A brief summary of the features offered is as follows: |
5 | 5 |
|
6 | | -- **Function Call Cleanup.** When using the Objective-C workflow, calls to |
7 | | - `objc_msgSend` can be replaced with direct calls to the relevant function's |
8 | | - implementation. |
9 | | - |
10 | 6 | - **Name and Type Recovery.** Using runtime information embedded in the |
11 | | - binary, Binary Ninja can automatically apply names and type information to |
| 7 | + binary, Binary Ninja automatically applies names and type information to |
12 | 8 | Objective-C functions. |
13 | 9 |
|
14 | 10 | - **Structure Markup.** Data variables are automatically created for Objective-C |
15 | 11 | structures such as classes and method lists to enable easy navigation. |
16 | 12 |
|
17 | | -- **Data Renderers.** Formatting of Objective-C types such as tagged and/or |
18 | | - (image-)relative pointers is improved via custom data renderers. |
| 13 | +- **String Literal Handling.** Data variables are automatically created for all |
| 14 | + `CFString` or `NSString` instances present in the binary. |
19 | 15 |
|
20 | | -- **CFString Handling.** Data variables are automatically created for all |
21 | | - `CFString` instances present in the binary. |
| 16 | +- **Automatic Call Type Adjustments.** Binary Ninja automatically infers the number of arguments and their names |
| 17 | + for individual calls to `objc_msgSend` and `objc_msgSendSuper2`. Argument names are derived from the selector |
| 18 | + components, and argument types are inferred in limited cases. |
22 | 19 |
|
23 | | -## Usage |
| 20 | +- **Pseudo Objective-C Language.** Decompiled code can be displayed using a _Pseudo Objective-C_ |
| 21 | + language syntax. This renders `objc_msgSend` and other Objective-C runtime calls using the |
| 22 | + `[receiver message:argument other:argument2]` syntax found in Objective-C source code. |
| 23 | + Additionally, literals such as `CFString` or `NSString` are displayed inline as `@"string"`. |
24 | 24 |
|
25 | | -If you have an Objective-C binary opening in Binary Ninja should automatically process |
26 | | -the information. This is handled by the view, e.g. MACH-O & Shared Cache. |
| 25 | +- **Direct Call Rewriting.** Calls to `objc_msgSend` can be rewritten to be direct calls to |
| 26 | + the first known method implementation for that selector. |
| 27 | + |
| 28 | + This is disabled by default as it will give potentially confusing results for any selector |
| 29 | + that has more than one implementation or for common selector names. That said, some users may |
| 30 | + still find it to be useful. It can be enabled via `analysis.objectiveC.resolveDynamicDispatch` |
| 31 | + setting. |
| 32 | + |
| 33 | +## Usage |
27 | 34 |
|
28 | | -### Workflow |
| 35 | +Objective-C metadata will be automatically processed when you open a Mach-O or DYLD shared cache binary in Binary Ninja. |
29 | 36 |
|
30 | | -To utilize function call cleanup, the Objective-C workflow must be chosen when loading a binary for analysis. |
| 37 | +The Pseudo Objective-C Language representation is available via the language pop-up menu at the top of Linear and Graph views: |
31 | 38 |
|
32 | | - |
| 39 | + |
33 | 40 |
|
34 | | -This will automatically apply structure analysis as the binary is analyzed and |
35 | | -also translate `objc_msgSend` calls to direct method calls, where possible. |
|
0 commit comments