Skip to content

Symbolification improvements#2

Open
yoavst wants to merge 2 commits into
gilboz:masterfrom
yoavst:feature/use_suffix_for_same_name
Open

Symbolification improvements#2
yoavst wants to merge 2 commits into
gilboz:masterfrom
yoavst:feature/use_suffix_for_same_name

Conversation

@yoavst

@yoavst yoavst commented Jul 25, 2025

Copy link
Copy Markdown
Collaborator

Fix vtable function name conflict using a numeric suffix

I think it is better than the current implementation. No ideal, but as long as there is no support for it in IDA its the best I can think of.

Fix PAC Symbolicate algorithm.

The signature on the func C::f is:

  • if f was added in C, then hash(C::f)
  • Otherwise it was added in some B parent of C, so the hash is hash(B::f).
    Therefore, the algorithm should be simply:
  • If vmethod_xx was added, search for the signature only in the same class
  • If it is an override, take the name from parent.

As a TODO, we need to generate names for pure virtual methods (which use the parent symbol to call, but the symbol is not available on binary). Also, we could use iOS 16.5 symbols as well to enrich. Finally, we need to support OSMetaClassBase methods that we ignore and say they are of OSObject.

Another TODO is figure why it still doesn't work for some methods, like __ZNK15IORegistryEntry11setPropertyEPKcS1_ (method indexed 26 of IORegistryEntry). It is the same name as 16.4 so I wonder what could be the reason.

@yoavst yoavst requested a review from gilboz July 25, 2025 10:40
@yoavst yoavst changed the title Fix vtable function name conflict using a numeric suffix Symbolification improvements Jul 25, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant