Repository navigation
emulation: extend Darwin directory and system observations - #589
Merged
Merged
Conversation
gmh5225
changed the title
gmh5225
changed the title
gmh5225
changed the title
gmh5225
changed the title
gmh5225
changed the title
gmh5225
changed the title
gmh5225
changed the title
gmh5225
changed the title
gmh5225
changed the title
IDA keeps the linkage name an instruction uses and comments it with the demangled name (`call _ZN8QDomNodeC1Ev ; QDomNode::QDomNode()`). It also writes a C++ function's signature above its header and lists PLT entries demangled. Our listing showed only the mangled names, and the Functions window showed PLT entries such as __ZN10QByteArrayC1EPKcx as they are. neverd_demangle exposes the demangler function identities already use, now one helper (demangledName). It reads Itanium, Microsoft, Rust and D names, also with the extra leading underscore of a PLT entry or Mach-O symbol. The worker: - comments every transfer or first reference to a mangled name; - writes the demangled name above a mangled function's header; - gives functions it names itself, such as PLT entries, their demangled name as display_name; - matches the Functions filter against either spelling. Names are cached per spelling.
…-pin build: update Capstone optional backend test fix
IDA's file banner lists the input's MD5, SHA-256 and CRC32. The dashboard hashed only MD5 and SHA-256; it now also computes zlib's CRC-32 in the same pass over the file and reports it as "crc32" in lowercase hex.
Only Mach-O binds and PE IATs were import storage, so nothing knew that an ELF GOT slot holds an import. The LLVM-C emitter refused functions that load a call target from such a slot (sub_C000 of a PIE that calls __libc_start_main through its GOT), and HighC had no evidence to name the import a call through the slot reaches. The ELF loader now records the slot of every GLOB_DAT or JUMP_SLOT relocation against an undefined symbol as LoaderBind import storage, the evidence the Mach-O loader gives its binds. A REL slot's implicit addend is not part of the bound address. Which relocation types bind a slot, and which are GNU IRELATIVE, now come from one table per architecture (ELFDynamicRelocations.def); the import slot query shares it instead of keeping its own switch. BinaryImage::LoadsAtLinkAddress says an image runs at its link-time addresses, for consumers that may read absolute addresses as such. The ELF loader sets it for ET_EXEC images.
Demangled C++ names, ELF GOT imports and a CRC-32 file hash
Track committed RAM writes through physical aliases and recheck stopped service writes before resuming. Decode actual instruction extents, retain mixed-generation watches, and observe generated operands across page boundaries. Keep direct execution stores and REP progress precise across temporary fetch and write protections. Prefer newly generated TLS callbacks over revisited loader initializers, and require the new behavior in native KVM and WHP coverage.
…10-07 Preserve captured HighC loads across memory assignments
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Freestanding Mach-O programs can use a closed guest filesystem with coherent directory objects and explicit Darwin system observations across macOS, iOS and iOS Simulator. This adds declared directory moves/exchanges, credentials and resource observations, hostname and descriptor limits, process group/session/taint queries, the complete session login buffer and current-process nice. Missing observations fail explicitly; the model never imports host files, identity or privileges.
Directory operations retain subtrees, held descriptors, working directories, orphaned files and mapping leases. Fixed observations grant no setter authority. Typed and JSON inputs share lossless validation and one guest kernel model.
getlogin(49)copies the selected prefix of exactly 255 declared bytes, including embedded NUL and tail bytes.getpriority(100)preserves native argument narrowing, error order and signed 64-bit success, including successful -1 with carry clear. Unknown peers, aggregate/thread observations and setters remain unsupported.The GKI catalogue conflict with dev
ee3806a25dca6a592fa640c69d75f56932889f04is resolved by retaining all eight existing PIDFD flag, iovec-import and non-leader-error tuples and adopting the incoming sixth xattr import-order field. Android 17's name-before-target order is retained in the shared Linux owner and checked through raw syscalls and Bionic. The incoming clean Capstone gitlink is retained deliberately. Existing CTest standalone inclusion/serial-name repairs are preserved.The login fixture verifier checks the same 265 bytes in three disjoint ascending spans. Initialization, payload/guard bytes, syscall arguments, success/error cases, modes and guest limits are unchanged. This reduces fixture work; it makes no production emulator performance claim.
Validation of source tree
a4da020f65d5abd8cbf5594ce9af6135a5d8b636(commit470c3bbb367b60469b3709ea04d42bc6e4d4cdea), using Release/AppleClang17/LLVM23, four build workers, strictly sequential native phases andNEVERD_THREADS=1:Frozen records distinguish changed build outputs from byte-identical reused artifacts and retain each artifact's compilation epoch. An initial test-inventory selection error was rejected before guest execution; corrected CMake ownership preserves every selected method. Independent source and target-mapping reviews are retained locally. Later disjoint upstream changes are outside this fixed-source execution epoch.
This is a bounded guest model. Links/hardlinks, permissions/ACLs, evolving directory snapshots, coherent shared mapping/EOF, advancing clocks, threads/signals/Mach IPC, dyld/TLS and ObjC/Swift frameworks remain unfinished. GUI/worker/driver and full-repository coverage were not accepted in this local profile. Physical iOS, suspended Intel HVF, native Linux KVM/Windows WHP and remote CI remain separate coverage.