 |
IDA C++ SDK 9.2
|
|
IDA C++ SDK 9.2
|
Apple Dyld Shared Cache (DSC) API. More...
Go to the source code of this file.
Classes | |
| class | dscu_req_t |
| class | dscu_create_layout_req_t |
| class | dscu_svc_req_t |
| struct | mapping_coords_t |
| An "intermediate" partioning of file(s) participating in the DSC. More... | |
| struct | region_info_t |
| Address ranges that can be loaded into the database. More... | |
| struct | address_info_t |
| Resolution of a single address into the cache layout: the region it lives in, the mapping that backs it, and the offset within that mapping's on-disk file. More... | |
| struct | dscu_load_request_t |
| A load request, offering the ability to be populated from previously-retrieved region_info_t, and that will be treated atomically. More... | |
| struct | symbol_match_t |
| A symbol match produced by dscu_svc_t::find_symbol() / query_symbols(). More... | |
| struct | string_match_t |
| A string-literal match produced by dscu_svc_t::find_string(). More... | |
| struct | dependency_match_entry_t |
| Report on one "load command" entry found in an external file. More... | |
| struct | dependency_match_result_t |
| The result of a dscu_svc_t::match_dependencies operation. More... | |
| struct | dscu_svc_t |
| IDA's DSC API interface. More... | |
Typedefs | |
| typedef qvector< mapping_coords_t > | mapping_coords_vec_t |
| typedef qvector< region_info_t > | region_info_vec_t |
| typedef std::set< int > | dyldlib_set_t |
| typedef qvector< symbol_match_t > | symbol_match_vec_t |
| typedef qvector< string_match_t > | string_match_vec_t |
| typedef qvector< dependency_match_entry_t > | dependency_match_entry_vec_t |
Enumerations | |
| enum | region_type_t : uint32 { rt_invalid = (uint32)-1 , rt_image_entity = 0 , rt_island = 1 , rt_header = 2 , rt_mapping = 3 , rt_unknown = 4 , rt_got = 5 , rt_cache_data = 6 } |
| Available region types. See the region_info_t documentation for more info. More... | |
Functions | |
| dscu_svc_t * | get_dscu_svc () |
| Retrieve the "shared cache services". | |
| CASSERT (sizeof(mapping_coords_t)==sizeof(int)) | |
| DECLARE_TYPE_AS_MOVABLE (mapping_coords_t) | |
| CASSERT (sizeof(region_info_t)==64) | |
| DECLARE_TYPE_AS_MOVABLE (region_info_t) | |
| DECLARE_TYPE_AS_MOVABLE (address_info_t) | |
| DECLARE_TYPE_AS_MOVABLE (symbol_match_t) | |
| DECLARE_TYPE_AS_MOVABLE (string_match_t) | |
| DECLARE_TYPE_AS_MOVABLE (dependency_match_entry_t) | |
Apple Dyld Shared Cache (DSC) API.
A DSC:
is essentially, a large collection of dylib files (AKA images), packed together in an Apple-custom format those are used to limit the amount of overhead at program launch-time, by having a lot of the relocations/resolutions heavylifting already addressed in addition to images, the DSC-producing tooling creates specific regions whose purpose is to "link" the various images together. Those regions are known as "branch mappings" (older caches used "branch islands".) occasionally, you will also find some GOT's (and possibly "unknown regions") in the address space of a DSC DSC's can grow very large in size, and will then be split into multiple files (e.g., iPhone 16 DSC's have north of 80 files)
All-in-all a DSC is an unusual beast, in the sense that hardly makes sense to load it all in an IDA database: you would end up with a a set of mostly-unrelated libraries.
Instead, an iterative approach is preferable: load whatever part of the DSC you need, when you need it.
This API provides exactly that.
images: the dylib files, packed in the DSC unknown regions: portions of the address space that ARE covered by the DSC's mappings, but are not referred to by any of the known entities. The address space is not missing – it's our understanding of the content that has a gap. branch islands/branch mappings: stubs, that help stitch together calls between images files: the file(s) that compose the DSC. When a DSC is composed of multiple files, the one that is used as the entrypoint, is called the "toplevel" file.
file mappings: (to not be confused with branch mappings!) internal, high-level representation of "portions" of a file. Typically files have somewhere between 1...5 mappings region_info_t: a "range": either a section of an image, or a branch mapping, GOT, unknown region... Typically, an image will have dozens of regions. See below for more info
Keeping the above concepts in mind, navigating the API should be pretty straightforward: it's kept simple on-purpose.
A couple notes:
Use get_dscu_svc() to retrieve the API interface, Initially, the DSC loader will only load the DSC header, Additional images/regions can be loaded through the API, as needed.
| typedef qvector<mapping_coords_t> mapping_coords_vec_t |
| typedef qvector<region_info_t> region_info_vec_t |
| typedef std::set<int> dyldlib_set_t |
| typedef qvector<symbol_match_t> symbol_match_vec_t |
| typedef qvector<string_match_t> string_match_vec_t |
| enum region_type_t : uint32 |
Available region types. See the region_info_t documentation for more info.
|
inline |
Retrieve the "shared cache services".
The returned instance is shared, and must not be deleted. Furthermore, the following situations will cause this function to return a nullptr:
| CASSERT | ( | sizeof(mapping_coords_t) | = =sizeof(int) | ) |
| DECLARE_TYPE_AS_MOVABLE | ( | mapping_coords_t | ) |
| CASSERT | ( | sizeof(region_info_t) | = =64 | ) |
| DECLARE_TYPE_AS_MOVABLE | ( | region_info_t | ) |
| DECLARE_TYPE_AS_MOVABLE | ( | address_info_t | ) |
| DECLARE_TYPE_AS_MOVABLE | ( | symbol_match_t | ) |
| DECLARE_TYPE_AS_MOVABLE | ( | string_match_t | ) |
| DECLARE_TYPE_AS_MOVABLE | ( | dependency_match_entry_t | ) |