forked from gdbinit/MachOView
-
Notifications
You must be signed in to change notification settings - Fork 0
/
AppController.mm
362 lines (319 loc) · 11.1 KB
/
AppController.mm
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
/*
* AppController.mm
* MachOView
*
* Created by psaghelyi on 15/06/2010.
*
*/
#import "Common.h"
#import "AppController.h"
#import "DataController.h"
#import "Document.h"
#import "PreferenceController.h"
#import "Attach.h"
#import <mach-o/fat.h>
#import <mach-o/loader.h>
// counters for statistics
int64_t nrow_total; // number of rows (loaded and empty)
int64_t nrow_loaded; // number of loaded rows
//============================================================================
@implementation MVAppController
//----------------------------------------------------------------------------
- (BOOL)applicationShouldOpenUntitledFile:(NSApplication *)sender
{
return NO;
}
//----------------------------------------------------------------------------
- (BOOL)applicationShouldTerminateAfterLastWindowClosed:(NSApplication *)sender
{
return NO;
}
//----------------------------------------------------------------------------
- (IBAction)newDocument:(id)sender
{
NSLog(@"Not yet possible");
}
//----------------------------------------------------------------------------
- (BOOL)isOnlyRunningMachOView
{
NSProcessInfo * procInfo = [NSProcessInfo processInfo];
NSBundle * mainBundle = [NSBundle mainBundle];
NSString * versionString = [mainBundle objectForInfoDictionaryKey:@"CFBundleShortVersionString"];
NSUInteger numberOfInstance = 0;
NSWorkspace * workspace = [NSWorkspace sharedWorkspace];
for (NSRunningApplication * runningApplication in [workspace runningApplications])
{
// check if process name matches
NSString * fileName = [[runningApplication executableURL] lastPathComponent];
if ([fileName isEqualToString: [procInfo processName]] == NO)
{
continue;
}
// check if version string matches
NSBundle * bundle = [NSBundle bundleWithURL:[runningApplication bundleURL]];
if ([versionString isEqualToString:[bundle objectForInfoDictionaryKey:@"CFBundleShortVersionString"]] == YES && ++numberOfInstance > 1)
{
return NO;
}
}
return YES;
}
//----------------------------------------------------------------------------
/*
* menu item action to attach to a process and read its mach-o header
*/
- (IBAction)attach:(id)sender
{
NSAlert *alert = [[NSAlert alloc] init];
alert.messageText = @"Insert PID to attach to:";
[alert addButtonWithTitle:@"Attach"];
[alert addButtonWithTitle:@"Cancel"];
NSTextField *input = [[NSTextField alloc] initWithFrame:NSMakeRect(0, 0, 200, 24)];
[input setStringValue:@""];
[alert setAccessoryView:input];
NSInteger button = [alert runModal];
if (button == NSAlertFirstButtonReturn)
{
[input validateEditing];
pid_t targetPid = [input intValue];
NSLog(@"Trying to attach to process %d", targetPid);
mach_vm_address_t mainAddress = 0;
if (find_main_binary(targetPid, &mainAddress))
{
NSLog(@"Failed to find main binary address!");
NSAlert *attachfail = [[NSAlert alloc] init];
attachfail.messageText = @"Failed to attach to process";
[attachfail addButtonWithTitle:@"Ok"];
[attachfail runModal];
return;
}
uint64_t aslr_slide = 0;
uint64_t imagesize = 0;
if ( (imagesize = get_image_size(mainAddress, targetPid, &aslr_slide)) == 0 )
{
NSLog(@"[ERROR] Got image file size equal to 0!");
return;
}
/* allocate the buffer to contain the memory dump */
uint8_t *readbuffer = (uint8_t*)malloc(imagesize);
if (readbuffer == NULL)
{
NSLog(@"Can't allocate mem for dumping target!");
return;
}
/* and finally read the sections and dump their contents to the buffer */
if (dump_binary(mainAddress, targetPid, readbuffer, aslr_slide))
{
NSLog(@"Main binary memory dump failed!");
free(readbuffer);
return;
}
/* dump buffer contents to temporary file to use the NSDocument model */
const char *tmp = [[MVDocument temporaryDirectory] UTF8String];
char *dumpFilePath = (char*)malloc(strlen(tmp)+1);
if (dumpFilePath == NULL)
{
NSLog(@"Can't allocate mem for temp filename path!");
free(readbuffer);
return;
}
strcpy(dumpFilePath, tmp);
int outputFile = 0;
if ( (outputFile = mkstemp(dumpFilePath)) == -1 )
{
NSLog(@"mkstemp failed!");
free(dumpFilePath);
free(readbuffer);
return;
}
if (write(outputFile, readbuffer, imagesize) == -1)
{
NSLog(@"[ERROR] Write error at %s occurred!\n", dumpFilePath);
free(dumpFilePath);
free(readbuffer);
return;
}
NSLog(@"\n[OK] Full binary dumped to %s!\n\n", dumpFilePath);
close(outputFile);
[self application:NSApp openFile:[NSString stringWithCString:dumpFilePath encoding:NSUTF8StringEncoding]];
/* remove temporary dump file, not required anymore */
NSFileManager * fileManager = [NSFileManager defaultManager];
[fileManager removeItemAtPath:[NSString stringWithCString:dumpFilePath encoding:NSUTF8StringEncoding] error:NULL];
free(dumpFilePath);
free(readbuffer);
}
else if (button == NSAlertSecondButtonReturn)
{
/* nothing to do here */
}
else
{
NSAssert1(NO, @"Invalid input dialog button %ld", button);
}
}
//----------------------------------------------------------------------------
- (IBAction)openDocument:(id)sender
{
NSOpenPanel *openPanel = [NSOpenPanel openPanel];
[openPanel setTreatsFilePackagesAsDirectories:YES];
[openPanel setAllowsMultipleSelection:YES];
[openPanel setCanChooseDirectories:NO];
[openPanel setCanChooseFiles:YES];
[openPanel setDelegate:self]; // for filtering files in open panel with shouldShowFilename
[openPanel beginSheetModalForWindow:NSApp.modalWindow
completionHandler:^(NSInteger result)
{
if (result != NSModalResponseOK)
{
return;
}
[openPanel orderOut:self]; // close panel before we might present an error
for (NSURL * url in [openPanel URLs])
{
[self application:NSApp openFile:[url path]];
}
}];
}
//----------------------------------------------------------------------------
- (BOOL)panel:(id)sender shouldEnableURL:(NSURL *)url
{
// can enter directories
NSNumber * isDirectory = nil;
[url getResourceValue:&isDirectory forKey:NSURLIsDirectoryKey error:NULL];
if ([isDirectory boolValue] == YES)
{
return YES;
}
// skip symbolic links, etc.
NSNumber * isRegularFile = nil;
[url getResourceValue:&isRegularFile forKey:NSURLIsRegularFileKey error:NULL];
if ([isRegularFile boolValue] == NO)
{
return NO;
}
// check for magic values at front
NSFileHandle * fileHandle = [NSFileHandle fileHandleForReadingFromURL:url error:NULL];
NSData * magicData = [fileHandle readDataOfLength:8];
[fileHandle closeFile];
if ([magicData length] < sizeof(uint32_t))
{
return NO;
}
uint32_t magic = *(uint32_t*)[magicData bytes];
if (magic == MH_MAGIC || magic == MH_MAGIC_64 ||
magic == FAT_CIGAM || magic == FAT_MAGIC)
{
return YES;
}
if ([magicData length] < sizeof(uint64_t))
{
return NO;
}
if (*(uint64_t*)[magicData bytes] == *(uint64_t*)"!<arch>\n")
{
return YES;
}
return NO;
}
//----------------------------------------------------------------------------
- (void)applicationWillFinishLaunching:(NSNotification *)aNotification
{
BOOL isFirstMachOView = [self isOnlyRunningMachOView];
// disable the state resume feature, it's not very useful with MachOView
if([[NSUserDefaults standardUserDefaults] objectForKey: @"ApplePersistenceIgnoreState"] == nil)
[[NSUserDefaults standardUserDefaults] setBool: YES forKey:@"ApplePersistenceIgnoreState"];
// load user's defaults for preferences
// if([[NSUserDefaults standardUserDefaults] objectForKey: @"UseLLVMDisassembler"] != nil)
// qflag = [[NSUserDefaults standardUserDefaults] boolForKey:@"UseLLVMDisassembler"];
NSFileManager * fileManager = [NSFileManager defaultManager];
NSString * tempDir = [MVDocument temporaryDirectory];
__autoreleasing NSError * error;
// remove previously forgotten temporary files
if (isFirstMachOView && [fileManager fileExistsAtPath:tempDir isDirectory:NULL] == YES)
{
if ([fileManager removeItemAtPath:tempDir error:&error] == NO)
{
[NSApp presentError:error];
}
}
// create placeholder for temporary files
if ([fileManager fileExistsAtPath:tempDir isDirectory:NULL] == NO)
{
if ([fileManager createDirectoryAtPath:tempDir
withIntermediateDirectories:NO
attributes:nil
error:&error] == NO)
{
[NSApp presentError:error];
}
}
}
//----------------------------------------------------------------------------
- (void)applicationDidFinishLaunching:(NSNotification *)aNotification
{
#ifdef MV_STATISTICS
nrow_total = nrow_loaded = 0;
[NSThread detachNewThreadSelector:@selector(printStat) toTarget:self withObject:nil];
#endif
/* default is to not open a file dialogue */
if ([[NSUserDefaults standardUserDefaults] objectForKey:@"OpenAtLaunch"] != nil)
{
if ([[NSUserDefaults standardUserDefaults] boolForKey:@"OpenAtLaunch"] == YES)
{
// if there is no document yet, then pop up an open file dialogue
if ([[[NSDocumentController sharedDocumentController] documents] count] == 0)
{
[self openDocument:nil];
}
}
}
}
//----------------------------------------------------------------------------
- (void)applicationWillTerminate:(NSNotification *)aNotification
{
BOOL isLastMachOView = [self isOnlyRunningMachOView];
if (isLastMachOView == YES)
{
// remove temporary files
NSFileManager * fileManager = [NSFileManager defaultManager];
NSString * tempDir = [MVDocument temporaryDirectory];
[fileManager removeItemAtPath:tempDir error:NULL];
}
}
//----------------------------------------------------------------------------
- (BOOL)application:(NSApplication *)theApplication openFile:(NSString *)filename
{
NSLog (@"open file: %@", filename);
NSDocumentController * documentController = [NSDocumentController sharedDocumentController];
[documentController openDocumentWithContentsOfURL:[NSURL fileURLWithPath:filename]
display:YES
completionHandler:^(NSDocument * _Nullable document, BOOL alreadyOpen, NSError * _Nullable error) {
// If we can't open the document, present error to the user
if (!document) {
[NSApp presentError:error];
}
if (alreadyOpen) {
NSLog(@"document was already open!");
}
}];
return YES;
}
//----------------------------------------------------------------------------
-(void) printStat
{
for (;;)
{
NSLog(@"stat: %lld/%lld rows in memory\n",nrow_loaded,nrow_total);
[NSThread sleepForTimeInterval:1];
}
}
//----------------------------------------------------------------------------
- (IBAction)showPreferencePanel:(id)sender
{
if (!preferenceController)
{
preferenceController = [[MVPreferenceController alloc] init];
}
[preferenceController showWindow:self];
}
@end