Skip to content

mlamb/Disassembletron

Repository files navigation

Notes on disassembler:

Openfilefordatatype() or whatever the nsdocument method name is -  
should check against the "file" shell command to see what type of file  
then use a registered "file parser" plugin

Open the app bundle, read all resources 
(icon,images,bundles,frameworksetc) open the default binary, parse  
sections, put code into blocks, pass blocks to visualizer, visualizer  
displays blocks

Apply hex patches.  Roll-back patches.

Allow editing of symbols, save as standard debug symbol formats.

Visualizers: call graph, outline (collapsible) view with arrow/links,  
hex view, ????

instructions, parameters, comments, addresses, etc. should all have their own colors in the view (user settable in preferences)

Parsers: mach-o binary, pe binary, elf binary

CPU emulators: x86, x86_64, ppc, ARM

Intel vs AT&T syntax

Need Plugin UI to disable plugins on startup, should be persistent  
file (provide a separate app to manage if main app crashes?)

Plugins should have info.plist entries for the prefs interface

Investigate Apple's documentation of nsbundle contexthelpforkey as it  
has info on help files

Investigate Apple's documentation of how to add scripting support (http://developer.apple.com/mac/library/documentation/Cocoa/Conceptual/ScriptableCocoaApplications/SApps_intro/SAppsIntro.html#//apple_ref/doc/uid/TP40001982-BCICHGIE)

(Feature List)
Show/Edit bundle information (Info.plist) - Provide "Open in property list editor" option if installed
Show/Edit Application Icon
	Export/Import Icons (Application, and DocType)
Show/Edit DocTypes
	Show/Edit DocType Icon, extension, MIME-Type, UTI, etc
	Show/Edit role (editor,viewer,etc) for preferred app
Show/Edit NIB list
Show/Edit Resources (Plugins, Resources, etc)
Show "Finder Get Info" pane
Reveal in finder
"Show contents" in finder
Show/Edit Dependencies (Frameworks, Libraries, etc)
	Show library timestamp, currentvers, compatvers
	Show @rpath, @executable_path, system paths
Show (outline view) Mach-o file format (See MachOView for details):
	FAT binary
		Show each platform image
			Header
				Basic info (CPU Type, CPU Sub-Type, Filetype, Flags)
			Load Commands
			Sections
			Dylib
			Symbol Table
			Dynamic Symbol Table
			String Table
			Threads
				Entrypoint
			ObjectiveC info
				Modules
					name
						Version
						Size
						Classes
						Categories
						
Objective-C:
	Show All OBJC classes
		Show Class Methods
		Show Instance Methods
		Show IVars
	Decompile/Disassemble methods
		"Disassemble from address" - "Disassemble by symbol/name/arbitrary string search?"
		"Find function start" (Check on what OCDisasm is doing for this?)
		Checkbox(?) to hide/show preamble/calling convention
		Show Address, mnemonic (att/intel syntax), "Notes" (attempt to convert to OBJC calls, but at least resolve symbols)
			Address should be searchable, have disclosure triangle to collapse "basic blocks"
			mnemonic: if jmp/branch/call/etc, create link to target, on "hover-over" show arrow (up/down) to dest address, on "hover-over" check-box for if this branch should be taken or not (hide code that will be skipped - collapse code with disclosure triangle)
		Show register status (as much as can be calculated in static analysis) - reg, value, typeof(value) in a separate window/pane
		Return calls should have pop-up for cross-references (to be able to jump back to the caller from the callee)

	Goto Offset
	Add breakpoint for line (see Machonist for example)
	Load/Save "patch"?
	Show xreferences for all symbols, anonymous functions too!
	Show CStrings (VMAddress, stringdata)
	Export disassembly as HTML
	Search anything/everything
	Forward/Back buttons to keep track of where user has been in disassembly
	Show HexView of any section (include HexCalc in new window/pane?)
	Show Call Graph of any method
        Mark any line as "code" or "data" (in case the automated disassembly got it wrong)
        Right-clicking on a asm instructions parameters allows you to change the way it's displayed (types: hex, binary, oct, decimal, string, address, etc) - i.e. a data-formatter control


Create a search interface that allows you to dynamically create nsfetchrequest/nspredicate templates (see apple documentation) - IB has object already?

Todo:
1. Build task for API documentation (doxygen,headerdoc?)
2. Build task for code coverage (gcov)
3. Build task for help files (Apple help)
4. Build task for scripting dictionary (sdef)
5. XCode templates for 3rd party plugin devs
6. Build task for DMG creation.
7. Finish design/implementation of plugin registration interface
8. Start design/implementation of Macho-O parser
9 Design core data models
10. Figure out coredata model "merging"
11. Figure out bindings

Research how to provide "user scripts" and text-macros (like XCode) inside app (NSAppleScript)

UI design idea: have outline view in the left (navigation) pane (a la iTunes/XCode 4) with each of the Mach-O segments as a disclosure triangle.  The main pane shows details of each segment (LC_Commands, __Text segment, asm).  When selectedat top level (root) object, show an "info.plist" view.  

About

A project to learn x86/x86_64 disassembly

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published