Skip to content

Commit dcf1126

Browse files
committed
[MachO] Tweak handling of LC_FUNCTION_STARTS
`LC_FUNCTION_STARTS` includes both functions and jump tables. We want to avoid calling `AddFunctionForAnalysis` on jump tables since it can result in a function being created at the jump table's location with a bogus body. We already skip adding functions for entries in `LC_FUNCTION_STARTS` if the lifting of their first few bytes end up including `LLIL_UNDEF`. However, arm64 intentionally lifts `udf` instructions (i.e., opcodes in the Permanently Undefined range) to `LLIL_TRAP` in order to preserve the immediate portion of the instruction. To address this, `MachoView::IsValidFunctionStart` now returns false if the first lifted instruction is `LLIL_TRAP` in addition to when the lifting contains `LLIL_UNDEF`.
1 parent 75c7715 commit dcf1126

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

view/macho/machoview.cpp

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -959,6 +959,8 @@ bool MachoView::IsValidFunctionStart(uint64_t addr)
959959
const auto& instr = ilFunc->GetInstruction(i);
960960
if (instr.operation == LLIL_UNDEF)
961961
return false;
962+
if (i == 0 && instr.operation == LLIL_TRAP)
963+
return false;
962964
}
963965

964966
return true;
@@ -993,12 +995,12 @@ void MachoView::ParseFunctionStarts(Platform* platform, uint64_t textBase, funct
993995
uint64_t target = curfunc;
994996
if (!IsValidFunctionStart(target))
995997
{
996-
m_logger->LogWarn("Possible error processing LC_FUNCTION_STARTS! Not adding function at: 0x%" PRIx64 "\n", target);
998+
m_logger->LogInfoF("Address {:#x} referenced from LC_FUNCTION_STARTS does not appear to be a function", target);
997999
continue;
9981000
}
9991001
Ref<Platform> targetPlatform = platform->GetAssociatedPlatformByAddress(target);
10001002
AddFunctionForAnalysis(targetPlatform, target);
1001-
m_logger->LogDebug("Adding function start: %#" PRIx64 "\n", curfunc);
1003+
m_logger->LogDebugF("Adding function start: {:#x}", curfunc);
10021004
}
10031005
}
10041006
catch (ReadException&)

0 commit comments

Comments
 (0)