Dyld Shared Cache - Method Symbol Resolution

[frankmarco2000]

Version and Platform (required):

• Binary Ninja Version: 4.2.6455 (02c8da1e)
• OS: macOS Sonoma
• OS Version: 14.6.1
• CPU Architecture: Apple M2 Max

Bug Description:
IPSW:
iPhone 8+
iOS 14.4.2
Version: 18D70
Link:
https://updates.cdn-apple.com/2021WinterFCS/fullrestores/071-22616/63E5DC4B-1767-4697-9CD3-97DD4A0E033A/iPhone_5.5_P3_14.4.2_18D70_Restore.ipsw

Steps To Reproduce:
Please provide all steps required to reproduce the behavior:

1. Go to...
2. Click on...
3. Scroll down to...
4. See error

Expected Behavior:
Please provide a clear and concise description of what you expected to happen.
I expect the symbols to be fully resolved as the attached screenshot from IDA Pro shows:

Opened dyld cache file and selected the MessageProtection framework.
When the analysis was complete, I started browsing the symbols. When looking at the class NGMFullDeviceIdentity, in the symbol viewer, the method names are corrupted.

Screenshots/Video [Recording:]()
Screen shot showing corrupted method names is attached.

Binary:
Due to the size of the file it is not reasonable to attach to ticket. Download link is provided above.
Additional Information:
Please add any other context about the problem here.

[WeiN76LQh]

Might be related to #6172

[bdash]

I think the v3 slide info has the same bug I noticed in the v5 slide info and mentioned in #6172 (comment). The page_start[i] value needs to be divided by 8 before being used as an offset into the page.

[bdash]

The v2 slide info handling also appears to be incomplete. It doesn't deal with rebase locations being split across multiple linked lists (DYLD_CACHE_SLIDE_PAGE_ATTR_EXTRA). I'm not sure which slide info format is used by iOS 14.4.2.

[WeiN76LQh]

It seems the issue here is that reader->ReadCString in DSCObjCProcessor::ReadMethodList returns garbage if it attempts to read an unmapped address. The garbage data is probably uninitialised memory from reading MMappedFileAccessor.m_mmap.

I'm testing this on the same iOS version but different device. For me the DSC address its reading the method name from is not actually mapped yet because I didn't ask it to load the image containing the address. However VM::MappingAtAddress is actually returning a mapping for the address.

[bdash]

#6192 will fix selectors either loading as garbage or being entirely missing from the symbol list with shared caches for recent macOS versions and some older iOS versions (~14 or so).