Skip to content

Instantly share code, notes, and snippets.

@doronz88
Last active July 7, 2023 04:06
Show Gist options
  • Save doronz88/b62d5ba6798b537df35fcd81ab86c13f to your computer and use it in GitHub Desktop.
Save doronz88/b62d5ba6798b537df35fcd81ab86c13f to your computer and use it in GitHub Desktop.
fix references inside IDA to `objc_msgSend` for ios16
import idc
import idautils
import ida_xref
# iterate over all objc_msgSend code references
objc_msgSend = idc.get_name_ea_simple('_objc_msgSend')
for xref in idautils.XrefsTo(objc_msgSend):
if xref.type & ida_xref.XREF_DATA:
continue
# extract the selector name from the first opcode
func_start_ea = idc.get_func_attr(xref.frm, idc.FUNCATTR_START)
refs = list(idautils.DataRefsFrom(func_start_ea))
if not refs:
continue
p_selector_ea = refs[0]
selector_ea = list(idautils.DataRefsFrom(p_selector_ea))[0]
string_type = idc.get_str_type(selector_ea)
selector_str = idc.get_strlit_contents(selector_ea, strtype=string_type).decode()
# name the function and set its type
name = f'objc_msgSend_{selector_str.replace(":", "_")}'
args = ['id object', 'SEL selector']
if ':' in selector_str:
for arg in selector_str.split(':'):
if arg:
args.append(f'id {arg}')
type_ = f'int {name}({", ".join(args)})'
print(f'0x{func_start_ea:x} {name} {type_}')
idc.set_name(func_start_ea, name, idc.SN_CHECK)
idc.SetType(func_start_ea, type_)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment