Mirrors_Framework/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-05-27 22:25:37 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch

Browse Source 
'origin/GP-1406_ryanmkurtz_macho-encryption' (Closes #1935)
This commit is contained in:
Ryan Kurtz
2021-11-05 14:00:22 -04:00
parent 77e434cf85 446614b435
commit 766ff7f72e
3 changed files with 27 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/commands/EncryptedInformationCommand.java
+11 -4
View File
@@ -37,13 +37,15 @@ public class EncryptedInformationCommand extends LoadCommand {
private int cryptoff; private int cryptoff;
private int cryptsize; private int cryptsize;
private int cryptid; private int cryptid;
private boolean is32bit;
static EncryptedInformationCommand createEncryptedInformationCommand( static EncryptedInformationCommand createEncryptedInformationCommand(
FactoryBundledWithBinaryReader reader) throws IOException { FactoryBundledWithBinaryReader reader, boolean is32bit) throws IOException {
EncryptedInformationCommand command = EncryptedInformationCommand command =
(EncryptedInformationCommand) reader.getFactory().create( (EncryptedInformationCommand) reader.getFactory().create(
EncryptedInformationCommand.class); EncryptedInformationCommand.class);
command.initEncryptedInformationCommand(reader); command.initEncryptedInformationCommand(reader, is32bit);
return command; return command;
} }
@@ -53,9 +55,11 @@ public class EncryptedInformationCommand extends LoadCommand {
public EncryptedInformationCommand() { public EncryptedInformationCommand() {
} }
private void initEncryptedInformationCommand(FactoryBundledWithBinaryReader reader) private void initEncryptedInformationCommand(FactoryBundledWithBinaryReader reader,
throws IOException { boolean is32bit) throws IOException {
initLoadCommand(reader); initLoadCommand(reader);
this.is32bit = is32bit;
cryptoff = reader.readNextInt(); cryptoff = reader.readNextInt();
cryptsize = reader.readNextInt(); cryptsize = reader.readNextInt();
cryptid = reader.readNextInt(); cryptid = reader.readNextInt();
@@ -102,6 +106,9 @@ public class EncryptedInformationCommand extends LoadCommand {
struct.add(DWORD, "cryptoff", null); struct.add(DWORD, "cryptoff", null);
struct.add(DWORD, "cryptsize", null); struct.add(DWORD, "cryptsize", null);
struct.add(DWORD, "cryptid", null); struct.add(DWORD, "cryptid", null);
if (!is32bit) {
struct.add(DWORD, "pad", null);
}
struct.setCategoryPath(new CategoryPath(MachConstants.DATA_TYPE_CATEGORY)); struct.setCategoryPath(new CategoryPath(MachConstants.DATA_TYPE_CATEGORY));
return struct; return struct;
} }
Ghidra/Features/Base/src/main/java/ghidra/app/util/bin/format/macho/commands/LoadCommandTypes.java
+4 -2
View File
@@ -124,8 +124,10 @@ public final class LoadCommandTypes {
case LC_REEXPORT_DYLIB: { case LC_REEXPORT_DYLIB: {
return DynamicLibraryCommand.createDynamicLibraryCommand(reader); return DynamicLibraryCommand.createDynamicLibraryCommand(reader);
} }
case LC_ENCRYPTION_INFO: { case LC_ENCRYPTION_INFO:
return EncryptedInformationCommand.createEncryptedInformationCommand(reader); case LC_ENCRYPTION_INFO_64: {
return EncryptedInformationCommand.createEncryptedInformationCommand(reader,
header.is32bit());
} }
case LC_DYLD_INFO: case LC_DYLD_INFO:
case LC_DYLD_INFO_ONLY: { case LC_DYLD_INFO_ONLY: {
Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/MachoProgramBuilder.java
+12
View File
@@ -112,6 +112,7 @@ public class MachoProgramBuilder {
monitor.setCancelEnabled(true); monitor.setCancelEnabled(true);
setImageBase(); setImageBase();
processEncryption();
processEntryPoint(); processEntryPoint();
processMemoryBlocks(machoHeader, provider.getName(), true, true); processMemoryBlocks(machoHeader, provider.getName(), true, true);
processUnsupportedLoadCommands(); processUnsupportedLoadCommands();
@@ -155,6 +156,17 @@ public class MachoProgramBuilder {
program.setImageBase(space.getAddress(0), true); program.setImageBase(space.getAddress(0), true);
} }
} }
private void processEncryption() throws Exception {
monitor.setMessage("Processing encryption...");
for (EncryptedInformationCommand cmd : machoHeader
.getLoadCommands(EncryptedInformationCommand.class)) {
if (cmd.getCryptID() != 0) {
log.appendMsg(String.format("ENCRYPTION DETECTED: (file offset 0x%x, size 0x%x)",
cmd.getCryptOffset(), cmd.getCryptSize()));
}
}
}
private void processEntryPoint() throws Exception { private void processEntryPoint() throws Exception {
monitor.setMessage("Processing entry point..."); monitor.setMessage("Processing entry point...");