If classRoVA = BADADDR or classRoVA = 0:ĬlassMethodsVA = doc.readUInt64LE(classRoVA + objc2ClassBaseMethOffs) If((objcSelRefs != None or objcMsgRefs != None) and (objcData != None and objcConst != None)) = False:ĭoc.log('could not find necessary Objective-C sections. ')įor va in range(objcData,objcData,objc2ClassSize):ĬlassRoVA = doc.readUInt64LE(va + objc2ClassInfoOffs) #print ' +++' + sectName, (hex(sect.getStartingAddress()),hex(sect.getStartingAddress()+sect.getLength())) ObjcConst = (sect.getStartingAddress(),sect.getStartingAddress()+sect.getLength()) ObjcMsgRefs = (sect.getStartingAddress(),sect.getStartingAddress()+sect.getLength()) ObjcSelRefs = (sect.getStartingAddress(),sect.getStartingAddress()+sect.getLength()) ObjcData = (sect.getStartingAddress(),sect.getStartingAddress()+sect.getLength()) If objcSelRefs and x >= objcSelRefs and x =objcMsgRefs and x = objcConst and x 1:Įachxrefs = seg.getReferencesOfAddress(addr) Print 'xreffrom: ' + hex(x) ,'xrefto: ' + hex(namePtr) NamePtr = doc.readUInt64LE(classMethodsVA) #get name field in struct _objc_method, it's selector #author: Kai getRefPtr(doc,classMethodsVA,objcSelRefs, objcMsgRefs, objcConst): The following is the python script objc2_xrefs_helper_hopper.py. Loading the demo application’s executable file into Hopper Disassembler We load the executable mach-o file of the demo application into Hopper Disassembler, as shown below.įigure 2. The demo application can be downloaded from here. To verify the functionality of objc2_xrefs_helper_hopper.py, I wrote a simple Cocoa application. The relationship between these related data structures of class in Objective-C I have included a figure showing the relationship between these related data structures, as shown below.įigure 1. It’s important that we figure out the data structures of Class in low level in Objective-C, as well as the relationship between these data structures. Before rewriting the python script for Hopper, therefore, we need to walk through the codes in IDAPython script objc2_xrefs_helper.py and understand all the details. Unfortunately, this message sending mechanism causes problems when trying to follow cross-references for selectors in Hopper Disassembler. As mentioned in that article, the function call is implemented by the message sending mechanism in Objective-C. Some background regarding Objective-C can be found from here.

I named this Hopper python script objc2_xrefs_helper_hopper.py. I rewrote the IDAPython script named objc2_xrefs_helper.py and developed a python script for the Hopper Disassembler.

Hopper disassembler v4 license file