IDA C++ SDK 9.2
Loading...
Searching...
No Matches
dscu_svc_t Struct Referenceabstract

IDA's DSC API interface. More...

#include <dscu.h>

Public Member Functions

virtual ~dscu_svc_t ()
virtual std::shared_ptr< shared_cache_toplevel_file_t > get_toplevel () const =0
 Return the parsed toplevel shared cache file.
virtual bool get_input_file_path (qstring *out) const =0
 Retrieve the path to the dyld_shared_cache file on disk.
virtual adiff_t get_dyld_slide () const =0
 Return the cumulative ASLR slide applied to the cache.
virtual void update_dyld_slide (adiff_t delta)=0
 Apply an additional slide delta and reload the cache.
Files (toplevel + subcaches)
virtual void get_files_names (qstrvec_t *out) const =0
 Retrieve the names of all cache files (toplevel + subcaches).
virtual bool get_file_name (qstring *out, size_t file_index) const =0
 Get the on-disk file name for the given file index.
virtual size_t get_file_index (const char *file_name) const =0
 Look up a file index by name.
virtual bool get_file_mappings (mapping_coords_vec_t *out, const char *file_name) const =0
 Return all mapping coordinates for the given cache file.
Mappings
virtual bool get_mapping_range (range_t *out, mapping_coords_t mapping) const =0
 Return the address range covered by a mapping.
virtual address_info_t locate_address (ea_t ea) const =0
 Resolve ea into the cache layout: the region it lives in, the mapping that backs it, and the offset within that mapping's on-disk file.
Regions
virtual bool get_region (region_info_t *ri, size_t region_index, bool full=true) const =0
 Retrieve region info by index.
virtual bool get_region_by_ea (region_info_t *ri, ea_t ea, size_t *out_region_index=nullptr, bool full=true) const =0
 Find the region containing ea, optionally returning its index.
virtual void get_regions (region_info_vec_t *vout, const sizevec_t *region_indexes=nullptr, bool full=true) const =0
 Retrieve a batch of regions.
Images

Methods accepting image_index return early (false, #BADADDR, make_invalid(), ...) when the index is < 0, so callers that pass the result of get_image_index() don't need to check it themselves.

Each virtual has a convenience inline overload taking a image_name that does the lookup automatically.

virtual int get_images_count () const =0
 Return the number of images in the cache.
virtual void get_images_names (qstrvec_t *out) const =0
 Retrieve the full paths of all images in the cache.
virtual int get_image_index (const char *image_name) const =0
 Look up an image index by full path.
virtual bool get_image_name (qstring *out, int image_index) const =0
 Retrieve the full path of an image.
bool get_image_filename (qstring *out, int image_index) const
 Like get_image_name(), but returns only the filename component (everything after the last '/').
virtual mapping_coords_t get_image_mapping (int image_index) const =0
 Return the mapping coordinates for an image.
mapping_coords_t get_image_mapping (const char *image_name) const
virtual bool is_image_loaded (int image_index) const =0
 Check whether an image has been loaded into the database.
bool is_image_loaded (const char *image_name) const
virtual bool get_image_file_name (qstring *out, int image_index) const =0
 Return the on-disk cache file name that contains the image.
bool get_image_file_name (qstring *out, const char *image_name) const
virtual bool get_image_regions (region_info_vec_t *out, int image_index, bool full=true) const =0
 Retrieve all regions belonging to an image.
bool get_image_regions (region_info_vec_t *out, const char *image_name, bool full=true) const
virtual bool get_image_regions_indexes (sizevec_t *out, int image_index) const =0
 Retrieve the region indexes (into the global region list) for an image.
bool get_image_regions_indexes (sizevec_t *out, const char *image_name) const
virtual bool get_image_dependencies (intvec_t *out, int image_index, int depth=1) const =0
 Collect transitive dependencies of an image.
bool get_image_dependencies (intvec_t *out, const char *image_name, int depth=1) const
virtual ea_t get_image_address (int image_index) const =0
 Return the start address of the image's Mach-O header in the cache.
virtual uint64 get_image_total_size (int image_index) const =0
 Return the total size of all regions that compose this image.
uint64 get_image_total_size (const char *image_name) const
virtual size_t get_image_file_index (int image_index) const =0
 Return the file index of the cache file that contains the image.
size_t get_image_file_index (const char *image_name) const
virtual bool get_images_dependencies (intvec_t *out, const intvec_t &images_indexes, int depth=1) const =0
 Like get_image_dependencies(), but for multiple images at once.
Islands
virtual bool is_island_loaded (int island_index) const =0
 Check whether a branch island has been loaded into the database.
Loading
virtual bool load_image (int image_index, uint32 flags=DLRF_DEFAULT)=0
 Load a Mach-O image from the shared cache into the database.
virtual bool load_island (int island_index, uint32 flags=DLRF_DEFAULT)=0
 Load a branch island from the shared cache into the database.
virtual bool load_branch_mapping (ea_t ea, uint32 flags=DLRF_DEFAULT)=0
 Load a branch mapping (__stubs) region into the database.
virtual bool is_mapping_loaded (ea_t mapping_addr) const =0
 Check whether a branch mapping has been loaded.
virtual bool load_got (ea_t ea, uint32 flags=DLRF_DEFAULT)=0
 Load a GOT region into the database.
virtual bool is_got_loaded (ea_t got_addr) const =0
 Check whether a GOT region has been loaded.
virtual bool load_unknown_region (ea_t ea, uint32 flags=DLRF_DEFAULT)=0
 Load an unknown region (a covered-but-unidentified range of a mapping) into the database.
virtual bool is_unknown_region_loaded (ea_t ea) const =0
 Check whether an unknown region has been loaded.
virtual bool load_cache_data (ea_t ea, uint32 flags=DLRF_DEFAULT)=0
 Load a cache-wide data region (e.g.
virtual bool is_cache_data_loaded (ea_t cache_data_addr) const =0
 Check whether a cache-wide data region has been loaded.
virtual bool load_regions (const dscu_load_request_t &regions)=0
 Load all regions described by the request (images, islands, mappings, GOTs, unknown_regions, cache_data) in a single batch.
virtual int get_load_regions_requests_count () const =0
 Return the number of times load_regions() has been invoked successfully.

Misc

enum  depmatch_code_t {
  dmc_ok = 0 , dmc_bad_file , dmc_cpu_mismatch , dmc_platform_mismatch ,
  dmc_failed
}
virtual region_type_t get_region_type (size_t region_index) const =0
 Return the type of the region at region_index.
virtual bool query_symbols (symbol_match_vec_t *out, const range_t &range) const =0
 Find symbols from the cache's local symbol table that fall within range.
virtual std::string_view query_symbol (ea_t ea) const =0
 Look up a single address in the local symbol table.
virtual std::string_view query_exported_symbol (ea_t ea) const =0
 Look up an address in the per-image export tables.
virtual bool find_symbol (symbol_match_vec_t *out, const char *needle, uint32 flags=0, size_t max_count=size_t(-1)) const =0
 Find all symbols whose name contains needle, searching the cache's local symbol table and each image's export table.
virtual bool find_string (string_match_vec_t *out, const char *needle, uint32 flags=0, size_t max_count=size_t(-1)) const =0
 Find all occurrences of needle in the cache's byte content.
virtual bool has_local_symbols () const =0
 Whether this cache has a .symbols sidecar file.
virtual depmatch_code_t match_dependencies (dependency_match_result_t *out, const char *path, uint32 flags=0) const =0
 Parse the Mach-O file's load commands, and match the image dependencies to this DSC.
virtual void dump_layout (uint32 flags=DLF_ALL) const =0
 Dump the full cache layout to the output window.

Detailed Description

IDA's DSC API interface.

Use get_dscu_svc() to retrieve an implementation.

Constructor & Destructor Documentation

◆ ~dscu_svc_t()

virtual dscu_svc_t::~dscu_svc_t ( )
inlinevirtual

Member Function Documentation

◆ get_toplevel()

virtual std::shared_ptr< shared_cache_toplevel_file_t > dscu_svc_t::get_toplevel ( ) const
pure virtual

Return the parsed toplevel shared cache file.

◆ get_input_file_path()

virtual bool dscu_svc_t::get_input_file_path ( qstring * out) const
pure virtual

Retrieve the path to the dyld_shared_cache file on disk.

Parameters
[out]outreceives the path
Returns
true on success

◆ get_dyld_slide()

virtual adiff_t dscu_svc_t::get_dyld_slide ( ) const
pure virtual

Return the cumulative ASLR slide applied to the cache.

◆ update_dyld_slide()

virtual void dscu_svc_t::update_dyld_slide ( adiff_t delta)
pure virtual

Apply an additional slide delta and reload the cache.

Parameters
deltaslide increment (added to the current slide)

◆ get_files_names()

virtual void dscu_svc_t::get_files_names ( qstrvec_t * out) const
pure virtual

Retrieve the names of all cache files (toplevel + subcaches).

Parameters
[out]outreceives the file names

◆ get_file_name()

virtual bool dscu_svc_t::get_file_name ( qstring * out,
size_t file_index ) const
pure virtual

Get the on-disk file name for the given file index.

Parameters
[out]outreceives the file name
file_indexindex into the files list
Returns
true on success

◆ get_file_index()

virtual size_t dscu_svc_t::get_file_index ( const char * file_name) const
pure virtual

Look up a file index by name.

Parameters
file_nameon-disk file name
Returns
the file index, or size_t(-1) on failure

◆ get_file_mappings()

virtual bool dscu_svc_t::get_file_mappings ( mapping_coords_vec_t * out,
const char * file_name ) const
pure virtual

Return all mapping coordinates for the given cache file.

Parameters
[out]outreceives the mapping coordinates
file_nameon-disk file name
Returns
true on success

◆ get_mapping_range()

virtual bool dscu_svc_t::get_mapping_range ( range_t * out,
mapping_coords_t mapping ) const
pure virtual

Return the address range covered by a mapping.

Parameters
[out]outreceives the range
mappingmapping coordinates (file_index, mapping_index)
Returns
true on success

◆ locate_address()

virtual address_info_t dscu_svc_t::locate_address ( ea_t ea) const
pure virtual

Resolve ea into the cache layout: the region it lives in, the mapping that backs it, and the offset within that mapping's on-disk file.

Parameters
eaeffective address to look up
Returns
the resolved info; address_info_t::valid() is false when ea isn't backed by any mapping.

◆ get_region()

virtual bool dscu_svc_t::get_region ( region_info_t * ri,
size_t region_index,
bool full = true ) const
pure virtual

Retrieve region info by index.

Parameters
[out]rireceives the region info
region_indexindex into the global region list
fullwhen false, only lightweight fields (start, size, type, image_index) are filled
Returns
true on success

◆ get_region_by_ea()

virtual bool dscu_svc_t::get_region_by_ea ( region_info_t * ri,
ea_t ea,
size_t * out_region_index = nullptr,
bool full = true ) const
pure virtual

Find the region containing ea, optionally returning its index.

Parameters
[out]rireceives the region info
eaeffective address to look up
[out]out_region_indexif not nullptr, receives the region index
fullsee get_region()
Returns
true on success

◆ get_regions()

virtual void dscu_svc_t::get_regions ( region_info_vec_t * vout,
const sizevec_t * region_indexes = nullptr,
bool full = true ) const
pure virtual

Retrieve a batch of regions.

Parameters
[out]voutreceives the region infos
region_indexesif nullptr, all regions are returned; otherwise only the specified ones
fullsee get_region()

◆ get_images_count()

virtual int dscu_svc_t::get_images_count ( ) const
pure virtual

Return the number of images in the cache.

◆ get_images_names()

virtual void dscu_svc_t::get_images_names ( qstrvec_t * out) const
pure virtual

Retrieve the full paths of all images in the cache.

Parameters
[out]outreceives the image names

◆ get_image_index()

virtual int dscu_svc_t::get_image_index ( const char * image_name) const
pure virtual

Look up an image index by full path.

Parameters
image_namefull image path (e.g., "/usr/lib/libSystem.B.dylib")
Returns
the image index, or -1 on failure

◆ get_image_name()

virtual bool dscu_svc_t::get_image_name ( qstring * out,
int image_index ) const
pure virtual

Retrieve the full path of an image.

Parameters
[out]outreceives the image path
image_indeximage index
Returns
true on success

◆ get_image_filename()

bool dscu_svc_t::get_image_filename ( qstring * out,
int image_index ) const
inline

Like get_image_name(), but returns only the filename component (everything after the last '/').

Parameters
[out]outreceives the filename
image_indeximage index
Returns
true on success

◆ get_image_mapping() [1/2]

virtual mapping_coords_t dscu_svc_t::get_image_mapping ( int image_index) const
pure virtual

Return the mapping coordinates for an image.

Parameters
image_indeximage index
Returns
the mapping coordinates, or make_invalid() if not found

◆ get_image_mapping() [2/2]

mapping_coords_t dscu_svc_t::get_image_mapping ( const char * image_name) const
inline

◆ is_image_loaded() [1/2]

virtual bool dscu_svc_t::is_image_loaded ( int image_index) const
pure virtual

Check whether an image has been loaded into the database.

Parameters
image_indeximage index

◆ is_image_loaded() [2/2]

bool dscu_svc_t::is_image_loaded ( const char * image_name) const
inline

◆ get_image_file_name() [1/2]

virtual bool dscu_svc_t::get_image_file_name ( qstring * out,
int image_index ) const
pure virtual

Return the on-disk cache file name that contains the image.

Parameters
[out]outreceives the file name
image_indeximage index
Returns
true on success

◆ get_image_file_name() [2/2]

bool dscu_svc_t::get_image_file_name ( qstring * out,
const char * image_name ) const
inline

◆ get_image_regions() [1/2]

virtual bool dscu_svc_t::get_image_regions ( region_info_vec_t * out,
int image_index,
bool full = true ) const
pure virtual

Retrieve all regions belonging to an image.

Parameters
[out]outreceives the region infos
image_indeximage index
fullsee get_region()
Returns
true on success

◆ get_image_regions() [2/2]

bool dscu_svc_t::get_image_regions ( region_info_vec_t * out,
const char * image_name,
bool full = true ) const
inline

◆ get_image_regions_indexes() [1/2]

virtual bool dscu_svc_t::get_image_regions_indexes ( sizevec_t * out,
int image_index ) const
pure virtual

Retrieve the region indexes (into the global region list) for an image.

Parameters
[out]outreceives the region indexes
image_indeximage index
Returns
true on success

◆ get_image_regions_indexes() [2/2]

bool dscu_svc_t::get_image_regions_indexes ( sizevec_t * out,
const char * image_name ) const
inline

◆ get_image_dependencies() [1/2]

virtual bool dscu_svc_t::get_image_dependencies ( intvec_t * out,
int image_index,
int depth = 1 ) const
pure virtual

Collect transitive dependencies of an image.

The image itself is included in the output.

Parameters
[out]outreceives the dependent image indexes
image_indeximage index
depthrecursion depth: 1 = direct only, -1 = unlimited
Returns
true on success

◆ get_image_dependencies() [2/2]

bool dscu_svc_t::get_image_dependencies ( intvec_t * out,
const char * image_name,
int depth = 1 ) const
inline

◆ get_image_address()

virtual ea_t dscu_svc_t::get_image_address ( int image_index) const
pure virtual

Return the start address of the image's Mach-O header in the cache.

Parameters
image_indeximage index
Returns
the address, or #BADADDR on failure

◆ get_image_total_size() [1/2]

virtual uint64 dscu_svc_t::get_image_total_size ( int image_index) const
pure virtual

Return the total size of all regions that compose this image.

Parameters
image_indeximage index
Returns
the total size in bytes, or 0 on failure

◆ get_image_total_size() [2/2]

uint64 dscu_svc_t::get_image_total_size ( const char * image_name) const
inline

◆ get_image_file_index() [1/2]

virtual size_t dscu_svc_t::get_image_file_index ( int image_index) const
pure virtual

Return the file index of the cache file that contains the image.

Parameters
image_indeximage index
Returns
the file index, or size_t(-1) on failure

◆ get_image_file_index() [2/2]

size_t dscu_svc_t::get_image_file_index ( const char * image_name) const
inline

◆ get_images_dependencies()

virtual bool dscu_svc_t::get_images_dependencies ( intvec_t * out,
const intvec_t & images_indexes,
int depth = 1 ) const
pure virtual

Like get_image_dependencies(), but for multiple images at once.

Parameters
[out]outreceives the union of all dependencies
images_indexesimage indexes to query
depthrecursion depth: 1 = direct only, -1 = unlimited
Returns
true on success

◆ is_island_loaded()

virtual bool dscu_svc_t::is_island_loaded ( int island_index) const
pure virtual

Check whether a branch island has been loaded into the database.

Parameters
island_indexisland index

◆ load_image()

virtual bool dscu_svc_t::load_image ( int image_index,
uint32 flags = DLRF_DEFAULT )
pure virtual

Load a Mach-O image from the shared cache into the database.

Creates segments, applies fixups, imports symbols, and triggers auto-analysis on the loaded ranges.

Parameters
image_indeximage index (silently ignored if < 0)
flagsa combination of DLRF_ flags
Returns
success

◆ load_island()

virtual bool dscu_svc_t::load_island ( int island_index,
uint32 flags = DLRF_DEFAULT )
pure virtual

Load a branch island from the shared cache into the database.

Parameters
island_indexisland index (silently ignored if < 0)
flagsa combination of DLRF_ flags
Returns
success

◆ load_branch_mapping()

virtual bool dscu_svc_t::load_branch_mapping ( ea_t ea,
uint32 flags = DLRF_DEFAULT )
pure virtual

Load a branch mapping (__stubs) region into the database.

Parameters
eastart address of the mapping region
flagsa combination of DLRF_ flags
Returns
success

◆ is_mapping_loaded()

virtual bool dscu_svc_t::is_mapping_loaded ( ea_t mapping_addr) const
pure virtual

Check whether a branch mapping has been loaded.

Parameters
mapping_addrstart address of the mapping region

◆ load_got()

virtual bool dscu_svc_t::load_got ( ea_t ea,
uint32 flags = DLRF_DEFAULT )
pure virtual

Load a GOT region into the database.

Reads bytes from the cache file, creates a segment, untags pointers, and symbolicates entries from the export tables.

Parameters
eastart address of the GOT region
flagsa combination of DLRF_ flags
Returns
success

◆ is_got_loaded()

virtual bool dscu_svc_t::is_got_loaded ( ea_t got_addr) const
pure virtual

Check whether a GOT region has been loaded.

Parameters
got_addrstart address of the GOT region

◆ load_unknown_region()

virtual bool dscu_svc_t::load_unknown_region ( ea_t ea,
uint32 flags = DLRF_DEFAULT )
pure virtual

Load an unknown region (a covered-but-unidentified range of a mapping) into the database.

Reads bytes from the cache file, creates a segment, and untags pointers if the region is non-executable.

Parameters
eastart address of the unknown region
flagsa combination of DLRF_ flags
Returns
success

◆ is_unknown_region_loaded()

virtual bool dscu_svc_t::is_unknown_region_loaded ( ea_t ea) const
pure virtual

Check whether an unknown region has been loaded.

Parameters
eastart address of the unknown region

◆ load_cache_data()

virtual bool dscu_svc_t::load_cache_data ( ea_t ea,
uint32 flags = DLRF_DEFAULT )
pure virtual

Load a cache-wide data region (e.g.

a .dyldlinkedit subcache mapping) into the database. Reads bytes from the cache file and creates a segment covering the whole region.

Parameters
eastart address of the cache_data region
flagsa combination of DLRF_ flags
Returns
success

◆ is_cache_data_loaded()

virtual bool dscu_svc_t::is_cache_data_loaded ( ea_t cache_data_addr) const
pure virtual

Check whether a cache-wide data region has been loaded.

Parameters
cache_data_addrstart address of the region

◆ load_regions()

virtual bool dscu_svc_t::load_regions ( const dscu_load_request_t & regions)
pure virtual

Load all regions described by the request (images, islands, mappings, GOTs, unknown_regions, cache_data) in a single batch.

Parameters
regionsthe load request
Returns
true on success

◆ get_load_regions_requests_count()

virtual int dscu_svc_t::get_load_regions_requests_count ( ) const
pure virtual

Return the number of times load_regions() has been invoked successfully.


The documentation for this struct was generated from the following file:
  • /Users/geoffrey/ida-sdk/src/include/dscu.h