What could be the signature of this method?

Question

I am trying to define a private quiz frame apis. I have a list of heaps of private private APIs, but they do not have their signature.

I would like to put one of them on the discussion table so that we can have an idea of ​​how to redesign in order to find the right signature.

void CGContextDrawImages (????);

I got it from the next build

_CGContextDrawImages: +0 0008986a 55 pushl %ebp [phone]b 89e5 movl %esp,%ebp [phone]d 57 pushl %edi [phone]e 56 pushl %esi [phone]f 53 pushl %ebx [phone]ecbc010000 subl $0x000001bc,%esp [phone] e800000000 calll 0x0008987b [phone]b 5b popl %ebx [phone]c 8b4508 movl 0x08(%ebp),%eax [phone]f 85c0 testl %eax,%eax [phone]c je 0x0008988f [phone]b4508 movl 0x08(%ebp),%eax [phone] 81780854585443 cmpl $0x43545854,0x08(%eax) [phone]d 7424 je 0x000898b3 [phone]f 8b5508 movl 0x08(%ebp),%edx [phone] 89542408 movl %edx,0x08(%esp) [phone]d836ce16f00 leal 0x006fe16c(%ebx),%eax [phone]c 89442404 movl %eax,0x04(%esp) [phone]a0 8d8341ae6f00 leal 0x006fae41(%ebx),%eax [phone]a6 890424 movl %eax,(%esp) [phone]a9 e8816f0f00 calll _CGPostError [phone]ae e9c4120000 jmp 0x0008ab77 [phone]b3 8b4510 movl 0x10(%ebp),%eax [phone]b6 85c0 testl %eax,%eax [phone]b8 0f84b9120000 je 0x0008ab77 [phone]be 8b450c movl 0x0c(%ebp),%eax [phone]c1 85c0 testl %eax,%eax [phone]c3 0f84ae120000 je 0x0008ab77 [phone]c9 8b7d18 movl 0x18(%ebp),%edi [phone]cc 85ff testl %edi,%edi [phone]ce 0f84a3120000 je 0x0008ab77 [phone]d4 31f6 xorl %esi,%esi [phone]d6 31ff xorl %edi,%edi [phone]d8 8b4d10 movl 0x10(%ebp),%ecx [phone]db 8b04b1 movl (%ecx,%esi,4),%eax [phone]de 85c0 testl %eax,%eax [phone]e0 740d je 0x000898ef [phone]e2 47 incl %edi [phone]e3 890424 movl %eax,(%esp) [phone]e6 e82f61fbff calll 0x0003fa1a [phone]eb 85c0 testl %eax,%eax [phone]ed 7506 jne 0x000898f5 [phone]ef 46 incl %esi [phone]f0 397518 cmpl %esi,0x18(%ebp) [phone]f3 75e3 jne 0x000898d8 [phone]f5 85ff testl %edi,%edi [phone]f7 0f847a120000 je 0x0008ab77 [phone]fd 397518 cmpl %esi,0x18(%ebp) [phone] ja 0x00089945 [phone]b4518 movl 0x18(%ebp),%eax [phone] 89442418 movl %eax,0x18(%esp) [phone]b5514 movl 0x14(%ebp),%edx [phone]c 89542414 movl %edx,0x14(%esp) [phone]b4d10 movl 0x10(%ebp),%ecx [phone]c2410 movl %ecx,0x10(%esp) [phone]b450c movl 0x0c(%ebp),%eax [phone]a 8944240c movl %eax,0x0c(%esp) [phone]e 8b5508 movl 0x08(%ebp),%edx [phone]b4234 movl 0x34(%edx),%eax [phone] 89442408 movl %eax,0x08(%esp) [phone]b423c movl 0x3c(%edx),%eax [phone]b 89442404 movl %eax,0x04(%esp) [phone]f 8b4218 movl 0x18(%edx),%eax [phone] 890424 movl %eax,(%esp) [phone] e8c264ffff calll 0x0007fdfc [phone]a 3dee030000 cmpl $0x000003ee,%eax [phone]f 0f85b6110000 jne 0x0008aafb [phone]b7514 movl 0x14(%ebp),%esi [phone]f6 testl %esi,%esi [phone]a 0f84c4110000 je 0x0008ab14 [phone]b5508 movl 0x08(%ebp),%edx [phone]b4234 movl 0x34(%edx),%eax [phone] 890424 movl %eax,(%esp) [phone] e883d7f9ff calll 0x000270e1 [phone]e 85c0 testl %eax,%eax [phone]f9585bbfeffff setne 0xfffffebb(%ebp) [phone]b83f1677600 movl 0x007667f1(%ebx),%eax [phone]d f30f104004 movss 0x04(%eax),%xmm0 [phone] f30f118504ffffff movss %xmm0,0xffffff04(%ebp) [phone]a f30f1008 movss (%eax),%xmm1 [phone]e f30f118d00ffffff movss %xmm1,0xffffff00(%ebp) [phone] f30f104008 movss 0x08(%eax),%xmm0 [phone]b f30f1185f8feffff movss %xmm0,0xfffffef8(%ebp) [phone] f30f10480c movss 0x0c(%eax),%xmm1 [phone] f30f118dfcfeffff movss %xmm1,0xfffffefc(%ebp) [phone]a0 eb1a jmp 0x000899bc [phone]a2 f30f108dfcfeffff movss 0xfffffefc(%ebp),%xmm1 [phone]aa 0f2ec8 ucomiss %xmm0,%xmm1 [phone]ad 7a06 jp 0x000899b5 [phone]af 0f84c2110000 je 0x0008ab77 [phone]b5 c685bbfeffff00 movb $0x00,0xfffffebb(%ebp) [phone]bc 8b4510 movl 0x10(%ebp),%eax [phone]bf 898524ffffff movl %eax,0xffffff24(%ebp) [phone]c5 8b7d0c movl 0x0c(%ebp),%edi [phone]c8 8b5514 movl 0x14(%ebp),%edx [phone]cb 899528ffffff movl %edx,0xffffff28(%ebp) [phone]d1 c7852cffffff00000000 movl $0x00000000,0xffffff2c(%ebp) [phone]db 8d4dc4 leal 0xc4(%ebp),%ecx [phone]de 898d94feffff movl %ecx,0xfffffe94(%ebp) [phone]e4 8b8524ffffff movl 0xffffff24(%ebp),%eax [phone]ea 8b08 movl (%eax),%ecx [phone]ec 85c9 testl %ecx,%ecx [phone]ee 0f84e1100000 je 0x0008aad5 [phone]f4 0f57c0 xorps %xmm0,%xmm0 [phone]f7 0f2e4708 ucomiss 0x08(%edi),%xmm0 [phone]fb 7a06 jp 0x00089a03 [phone]fd 0f84d2100000 je 0x0008aad5 [phone]a03 0f2e470c ucomiss 0x0c(%edi),%xmm0 [phone]a07 7a06 jp 0x00089a0f [phone]a09 0f84c6100000 je 0x0008aad5 [phone]a0f 8b5514 movl 0x14(%ebp),%edx [phone]a12 85d2 testl %edx,%edx [phone]a14 754e jne 0x00089a64 [phone]a16 f30f108504ffffff movss 0xffffff04(%ebp),%xmm0 [phone]a1e f30f1145d8 movss %xmm0,0xd8(%ebp) [phone]a23 f30f108d00ffffff movss 0xffffff00(%ebp),%xmm1 [phone]a2b f30f114dd4 movss %xmm1,0xd4(%ebp) [phone]a30 f30f1085f8feffff movss 0xfffffef8(%ebp),%xmm0 [phone]a38 f30f1145dc movss %xmm0,0xdc(%ebp) [phone]a3d f30f108dfcfeffff movss 0xfffffefc(%ebp),%xmm1 [phone]a45 f30f114de0 movss %xmm1,0xe0(%ebp) [phone]a4a 8b45d4 movl 0xd4(%ebp),%eax [phone]a4d 8945b4 movl %eax,0xb4(%ebp) [phone]a50 8b45d8 movl 0xd8(%ebp),%eax [phone]a53 8945b8 movl %eax,0xb8(%ebp) [phone]a56 8b45dc movl 0xdc(%ebp),%eax [phone]a59 8945bc movl %eax,0xbc(%ebp) [phone]a5c 8b45e0 movl 0xe0(%ebp),%eax [phone]a5f 8945c0 movl %eax,0xc0(%ebp) [phone]a62 eb49 jmp 0x00089aad [phone]a64 8b8528ffffff movl 0xffffff28(%ebp),%eax [phone]a6a 0f2e4008 ucomiss 0x08(%eax),%xmm0 [phone]a6e 7a06 jp 0x00089a76 [phone]a70 0f845f100000 je 0x0008aad5 [phone]a76 0f2e400c ucomiss 0x0c(%eax),%xmm0 [phone]a7a 7a06 jp 0x00089a82 [phone]a7c 0f8453100000 je 0x0008aad5 [phone]a82 8d55b4 leal 0xb4(%ebp),%edx [phone]a85 89c1 movl %eax,%ecx [phone]a87 8b00 movl (%eax),%eax [phone]a89 89442404 movl %eax,0x04(%esp) [phone]a8d 8b4104 movl 0x04(%ecx),%eax [phone]a90 89442408 movl %eax,0x08(%esp) [phone]a94 8b4108 movl 0x08(%ecx),%eax [phone]a97 8944240c movl %eax,0x0c(%esp) [phone]a9b 8b410c movl 0x0c(%ecx),%eax [phone]a9e 89442410 movl %eax,0x10(%esp) [phone]aa2 891424 movl %edx,(%esp) [phone]aa5 e8f751fbff calll 0x0003eca1 [phone]aaa 83ec04 subl $0x04,%esp [phone]aad f30f1045c0 movss 0xc0(%ebp),%xmm0 [phone]ab2 f30f118518ffffff movss %xmm0,0xffffff18(%ebp) [phone]aba f30f104dbc movss 0xbc(%ebp),%xmm1 [phone]abf f30f118d14ffffff movss %xmm1,0xffffff14(%ebp) [phone]ac7 8b07 movl (%edi),%eax [phone]ac9 89442404 movl %eax,0x04(%esp) [phone]acd 8b4704 movl 0x04(%edi),%eax [phone]ad0 89442408 movl %eax,0x08(%esp) [phone]ad4 8b4708 movl 0x08(%edi),%eax [phone]ad7 8944240c movl %eax,0x0c(%esp) [phone]adb 8b470c movl 0x0c(%edi),%eax [phone]ade 89442410 movl %eax,0x10(%esp) [phone]ae2 8b8594feffff movl 0xfffffe94(%ebp),%eax [phone]ae8 890424 movl %eax,(%esp) [phone]aeb e8b151fbff calll 0x0003eca1 [phone]af0 83ec04 subl $0x04,%esp [phone]af3 f30f1045c4 movss 0xc4(%ebp),%xmm0 [phone]af8 f30f118508ffffff movss %xmm0,0xffffff08(%ebp) [phone]b00 8b75c8 movl 0xc8(%ebp),%esi [phone]b03 f30f104dd0 movss 0xd0(%ebp),%xmm1 [phone]b08 f30f118d10ffffff movss %xmm1,0xffffff10(%ebp) [phone]b10 f30f1045cc movss 0xcc(%ebp),%xmm0 [phone]b15 f30f11850cffffff movss %xmm0,0xffffff0c(%ebp) [phone]b1d f30f108518ffffff movss 0xffffff18(%ebp),%xmm0 [phone]b25 f30f1145c0 movss %xmm0,0xc0(%ebp) [phone]b2a f30f108d14ffffff movss 0xffffff14(%ebp),%xmm1 [phone]b32 f30f114dbc movss %xmm1,0xbc(%ebp) [phone]b37 8b45b4 movl 0xb4(%ebp),%eax [phone]b3a 89442410 movl %eax,0x10(%esp) [phone]b3e 8b45b8 movl 0xb8(%ebp),%eax [phone]b41 89442414 movl %eax,0x14(%esp) [phone]b45 8b45bc movl 0xbc(%ebp),%eax [phone]b48 89442418 movl %eax,0x18(%esp) [phone]b4c 8b45c0 movl 0xc0(%ebp),%eax [phone]b4f 8944241c movl %eax,0x1c(%esp) [phone]b53 8b45c4 movl 0xc4(%ebp),%eax [phone]b56 890424 movl %eax,(%esp) [phone]b59 8b45c8 movl 0xc8(%ebp),%eax [phone]b5c 89442404 movl %eax,0x04(%esp) [phone]b60 8b45cc movl 0xcc(%ebp),%eax [phone]b63 89442408 movl %eax,0x08(%esp) [phone]b67 8b45d0 movl 0xd0(%ebp),%eax [phone]b6a 8944240c movl %eax,0x0c(%esp) [phone]b6e e823faf7ff calll 0x00009596 [phone]b73 84c0 testb %al,%al [phone]b75 7437 je 0x00089bae [phone]b77 8b9524ffffff movl 0xffffff24(%ebp),%edx [phone]b7d 8b02 movl (%edx),%eax [phone]b7f f30f108508ffffff movss 0xffffff08(%ebp),%xmm0 [phone]b87 f30f1145c4 movss %xmm0,0xc4(%ebp) [phone]b8c 8975c8 movl %esi,0xc8(%ebp) [phone]b8f f30f108d10ffffff movss 0xffffff10(%ebp),%xmm1 [phone]b97 f30f114dd0 movss %xmm1,0xd0(%ebp) [phone]b9c f30f10850cffffff movss 0xffffff0c(%ebp),%xmm0 [phone]ba4 f30f1145cc movss %xmm0,0xcc(%ebp) [phone]ba9 e9fc0e0000 jmp 0x0008aaaa [phone]bae f30f108508ffffff movss 0xffffff08(%ebp),%xmm0 [phone]bb6 f30f1145c4 movss %xmm0,0xc4(%ebp) [phone]bbb 8975c8 movl %esi,0xc8(%ebp) [phone]bbe f30f108d10ffffff movss 0xffffff10(%ebp),%xmm1 [phone]bc6 f30f114dd0 movss %xmm1,0xd0(%ebp) [phone]bcb f30f10850cffffff movss 0xffffff0c(%ebp),%xmm0 [phone]bd3 f30f1145cc movss %xmm0,0xcc(%ebp) [phone]bd8 f30f108d18ffffff movss 0xffffff18(%ebp),%xmm1 [phone]be0 f30f114dc0 movss %xmm1,0xc0(%ebp) [phone]be5 f30f108514ffffff movss 0xffffff14(%ebp),%xmm0 [phone]bed f30f1145bc movss %xmm0,0xbc(%ebp) [phone]bf2 8b45b4 movl 0xb4(%ebp),%eax [phone]bf5 89442410 movl %eax,0x10(%esp) [phone]bf9 8b45b8 movl 0xb8(%ebp),%eax [phone]bfc 89442414 movl %eax,0x14(%esp) [phone]c00 8b45bc movl 0xbc(%ebp),%eax [phone]c03 89442418 movl %eax,0x18(%esp) [phone]c07 8b45c0 movl 0xc0(%ebp),%eax [phone]c0a 8944241c movl %eax,0x1c(%esp) [phone]c0e 8b45c4 movl 0xc4(%ebp),%eax [phone]c11 890424 movl %eax,(%esp) [phone]c14 8b45c8 movl 0xc8(%ebp),%eax [phone]c17 89442404 movl %eax,0x04(%esp) [phone]c1b 8b45cc movl 0xcc(%ebp),%eax [phone]c1e 89442408 movl %eax,0x08(%esp) [phone]c22 8b45d0 movl 0xd0(%ebp),%eax [phone]c25 8944240c movl %eax,0x0c(%esp) [phone]c29 e81acaf9ff calll 0x00026648 [phone]c2e 84c0 testb %al,%al [phone]c30 0f846d010000 je 0x00089da3 [phone]c36 80bdbbfeffff00 cmpb $0x00,0xfffffebb(%ebp) [phone]c3d 0f8583000000 jne 0x00089cc6 [phone]c43 8b4508 movl 0x08(%ebp),%eax [phone]c46 890424 movl %eax,(%esp) [phone]c49 e81aaff9ff calll 0x00024b68 [phone]c4e f30f108518ffffff movss 0xffffff18(%ebp),%xmm0 [phone]c56 f30f1145c0 movss %xmm0,0xc0(%ebp) [phone]c5b f30f108d14ffffff movss 0xffffff14(%ebp),%xmm1 [phone]c63 f30f114dbc movss %xmm1,0xbc(%ebp) [phone]c68 8b45b4 movl 0xb4(%ebp),%eax [phone]c6b 89442404 movl %eax,0x04(%esp) [phone]c6f 8b45b8 movl 0xb8(%ebp),%eax [phone]c72 89442408 movl %eax,0x08(%esp) [phone]c76 8b45bc movl 0xbc(%ebp),%eax [phone]c79 8944240c movl %eax,0x0c(%esp) [phone]c7d 8b45c0 movl 0xc0(%ebp),%eax [phone]c80 89442410 movl %eax,0x10(%esp) [phone]c84 8b4508 movl 0x08(%ebp),%eax [phone]c87 890424 movl %eax,(%esp) [phone]c8a e8a75efaff calll 0x0002fb36 [phone]c8f 8b9524ffffff movl 0xffffff24(%ebp),%edx [phone]c95 8b02 movl (%edx),%eax [phone]c97 f30f108508ffffff movss 0xffffff08(%ebp),%xmm0 [phone]c9f f30f1145c4 movss %xmm0,0xc4(%ebp) [phone]ca4 8975c8 movl %esi,0xc8(%ebp) [phone]ca7 f30f108d10ffffff movss 0xffffff10(%ebp),%xmm1 

08a486 8b4590 movl 0x90 (% ebp),% eax ...

I do not expect an exact answer, but a way to decode the signature. Any idea / direction will also be useful to continue research.

Thank you for your time. I really appreciate it.

Answer 1

Often you can work from what you know to what you do not. This is most likely used to implement the open CoreGraphics API; if you can find a function with known parameters that call it, you can pretty easily determine the parameters of this function.

You can determine how many arguments a function has by looking at the arguments that it pops from the stack. For instance:

  [phone]c 8b4508 movl 0x08(%ebp),%eax [phone]f 85c0 testl %eax,%eax [phone]c je 0x0008988f 

You can say from this that the first argument is most likely a 32-bit value. It is tested for zero. Since this is a CGContext function, the first argument is almost certainly CGContextRef ctx , so these three commands correspond:

 if (NULL == ctx) goto L0; 

where I have the gloss 0x008988f with L0 in the assembly.

  [phone]b4508 movl 0x08(%ebp),%eax [phone] 81780854585443 cmpl $0x43545854,0x08(%eax) [phone]d 7424 je 0x000898b3 if (0x43545854 == ((int *)ctx)[2]) goto L1; 

And here we see a comparison of a member of the structure with some known value, which is special. It can be a magic number to check the validity of the context. The code at the destination address can show why it is being processed in a special way.

  [phone]f 8b5508 movl 0x08(%ebp),%edx [phone] 89542408 movl %edx,0x08(%esp) void *f0 = *ctx; 

This delimits the context pointer. If the Obj-C object is behind the curtains, it will be an isa pointer that references the Obj-C class. If not, then the context is likely to be some other structure, and the code has just captured some data from the very beginning of the structure. Setting a breakpoint here and trying to print-object provided address should answer which one is true. (I am betting on an obj-C object object.)

  [phone]d836ce16f00 leal 0x006fe16c(%ebx),%eax [phone]c 89442404 movl %eax,0x04(%esp) [phone]a0 8d8341ae6f00 leal 0x006fae41(%ebx),%eax 

Too bad you stayed there. It looks like it is being configured to call a function: push the arguments onto the stack, then call. You can see how it captures some of the moved addresses based on a known address from the beginning of the function (a function found with this great call/pop trick that it did during the prolog).

I recommend you take a copy of otx - grab and build a version of SVN, as it can handle x86_64. This does some work in advance to help you figure out disassembly, as well as properly format disassembly into base blocks.

Also select class-dump . This examines the Obj-C segments of the binary files into which you run it, and downloads the Obj-C header files for all classes, categories, and protocols found in binary format.

Running both of them in the binary you are interested in can give you a big foot.

If you're ready for spring for this, IDA Pro is considered the best reverse engineering tool. I have never used it, but I see where it would be extremely useful.

Other resources:

• Intel ISA documents describe IA-32 and IA-64 architectures and their instructions.
• An Introduction to Mac OS X ABI Function Call Guide describes how arguments are passed to functions.
• Rich Wareham "OS X Reverse Engineering Quick Start Guide" looks useful for beginners.
• The "Reverse Engineering OS X" blog contains a lot of interesting content, but I don’t know how useful it will be for you.

One more thing: Apple is usually fairly regular in its function names. A function like CGContextDrawImages has two likely signatures depending on how the images are transmitted:

 /* CGImageRefs contained in a Core Foundation array. */ void CGContextDrawImages(CGContextRef ctx, CFArrayRef images); /* CGImageRefs passed in a C array. */ void CGContextDrawImages(CGContextRef ctx, CGImageRef images[], size_t count); 

There may also be a “where to draw this” CGRect argument or an array of arguments. But at least you're not quite in the dark about what a function prototype should be.

Answer 2

This is not an easy task and may require tools other than gdb. I read a couple of interesting RE lessons, and although they are not OSX specific, they still contain interesting information and examples of decoding function parameters:

Reversing (Undocumented) Windows API Functions

Matt Cracking Guide

Secrets of reverse engineering : Appendix C - Decryption of program data

Reverse engineering and calling functions by address