### Cold Path Error Handler for Store Setup Source: https://clearbluejar.github.io/ghidriff/diffs/Samples/Mac/contacts-sample A cold-path function handling persistent store setup failures with error logging. ```Objective-C void __CNContactMetadataPersistentStoreManager_setupIfNeeded__cold_1 (undefined8 param_1,undefined8 param_2,undefined8 param_3) { undefined8 extraout_x1; long lVar1; lVar1 = *(long *)__got::___stack_chk_guard; _objc_msgSend_description(); __auth_stubs::_objc_retainAutoreleasedReturnValue(); _OUTLINED_FUNCTION_0(); _OUTLINED_FUNCTION_1(&mach_header_194bd8000,extraout_x1,param_3,"Failed to setup store: %@"); __auth_stubs::_objc_release(); if (*(long *)__got::___stack_chk_guard == lVar1) { return; } __auth_stubs::___stack_chk_fail(); return; } ``` -------------------------------- ### Set GHIDRA_INSTALL_DIR and install ghidriff on Windows Source: https://clearbluejar.github.io/ghidriff/docs/README/Quick%20Start%20Environment%20Setup Use PowerShell to set the GHIDRA_INSTALL_DIR environment variable and then install ghidriff using pip. Ensure the path to Ghidra is correct. ```powershell PS C:\Users\user> [System.Environment]::SetEnvironmentVariable('GHIDRA_INSTALL_DIR','C:\ghidra_10.2.3_PUBLIC_20230208\ghidra_10.2.3_PUBLIC') PS C:\Users\user> pip install ghidriff ``` -------------------------------- ### Set GHIDRA_INSTALL_DIR and install ghidriff on Linux/Mac Source: https://clearbluejar.github.io/ghidriff/docs/README/Quick%20Start%20Environment%20Setup Use the terminal to export the GHIDRA_INSTALL_DIR environment variable and then install ghidriff using pip. Replace '/path/to/ghidra/' with your actual Ghidra installation path. ```bash export GHIDRA_INSTALL_DIR="/path/to/ghidra/" pip install ghidriff ``` -------------------------------- ### Ghidriff Command Line Execution Source: https://clearbluejar.github.io/ghidriff/diffs/Samples/CVEs/afd.sys.x64.10.0.22621.1028-afd.sys.x64.10.0.22621.1415afd.sys.x64.10.0.22621.1028-afd.sys.x64.10.0.22621.1415.ghidriff Example command to run the Ghidriff engine for binary comparison. ```bash ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --max-ram-percent 60.0 --max-section-funcs 200 afd.sys.x64.10.0.22621.608 afd.sys.x64.10.0.22621.1105 ``` -------------------------------- ### Decompiled setupIfNeeded implementation Source: https://clearbluejar.github.io/ghidriff/diffs/Samples/Mac/contacts-sample This function checks for existing persistent stores and initializes the store directory or loads stores as needed. ```C void __CNContactMetadataPersistentStoreManager_setupIfNeeded_(undefined8 param_1) { int iVar1; undefined8 uVar2; undefined8 uVar3; long lVar4; ulong uVar5; undefined8 extraout_x1; undefined8 extraout_x1_00; undefined *local_68; undefined8 local_60; code *local_58; undefined *puStack_50; undefined auStack_48 [8]; undefined auStack_40 [8]; undefined8 local_38; _objc_msgSend_persistentStoreCoordinator(); uVar2 = __auth_stubs::_objc_retainAutoreleasedReturnValue(); _objc_msgSend_persistentStores(); uVar3 = __auth_stubs::_objc_retainAutoreleasedReturnValue(); lVar4 = _objc_msgSend_count(); __auth_stubs::_objc_release(uVar3); __auth_stubs::_objc_release(uVar2); if (lVar4 == 0) { local_38 = 0; uVar5 = _objc_msgSend_createStoreDirectoryIfNeeded_(param_1,extraout_x1,&local_38); uVar2 = __auth_stubs::_objc_retain(local_38); if ((uVar5 & 1) == 0) { __auth_stubs::_objc_opt_class(param_1); _objc_msgSend_os_log(); uVar3 = __auth_stubs::_objc_retainAutoreleasedReturnValue(); iVar1 = __auth_stubs::_os_log_type_enabled(uVar3,0x10); if (iVar1 != 0) { __CNContactMetadataPersistentStoreManager_setupIfNeeded__cold_1(uVar2,uVar3); } __auth_stubs::_objc_release(uVar3); } else { __auth_stubs::_objc_initWeak(auStack_40,param_1); _objc_msgSend_container(param_1); uVar3 = __auth_stubs::_objc_retainAutoreleasedReturnValue(); local_68 = __got::__NSConcreteStackBlock; local_60 = 0xc2000000; local_58 = ___56__CNContactMetadataPersistentStoreManager_setupIfNeeded__block_invoke; puStack_50 = & ___block_descriptor_40_e8_32w_e50_v24__0__NSPersistentStoreDescription_8__NSError_16l ; __auth_stubs::_objc_copyWeak(auStack_48,auStack_40); _objc_msgSend_loadPersistentStoresWithCompletionHandler_(uVar3,extraout_x1_00,&local_68); __auth_stubs::_objc_release(uVar3); __auth_stubs::_objc_destroyWeak(auStack_48); __auth_stubs::_objc_destroyWeak(auStack_40); } __auth_stubs::_objc_release(uVar2); } return; } ``` -------------------------------- ### Decompiled setupIfNeeded Method Source: https://clearbluejar.github.io/ghidriff/diffs/Samples/Mac/contacts-sample This function checks for existing persistent stores and initializes a new SQLite store if none are found. It handles directory creation and configuration options for automatic migration and mapping. ```c --- -[CNContactMetadataPersistentStoreManager_setupIfNeeded:] +++ -[CNContactMetadataPersistentStoreManager_setupIfNeeded:] @@ -1,106 +0,0 @@ - -ulong __CNContactMetadataPersistentStoreManager_setupIfNeeded__ - (undefined8 param_1,undefined8 param_2,undefined8 *param_3) - -{ - uint uVar1; - int iVar2; - undefined8 uVar3; - undefined8 uVar4; - long lVar5; - undefined8 uVar6; - undefined8 uVar7; - undefined8 uVar8; - undefined8 extraout_x1; - undefined8 extraout_x1_00; - ulong uVar9; - undefined auVar10 [16]; - undefined8 local_98; - undefined8 local_90; - undefined8 local_88; - undefined8 uStack_80; - undefined *local_78; - undefined *puStack_70; - long local_68; - - local_68 = *(long *)__got::___stack_chk_guard; - _objc_msgSend_persistentStoreCoordinator(); - uVar3 = __auth_stubs::_objc_retainAutoreleasedReturnValue(); - _objc_msgSend_persistentStores(); - uVar4 = __auth_stubs::_objc_retainAutoreleasedReturnValue(); - lVar5 = _objc_msgSend_count(); - __auth_stubs::_objc_release(uVar4); - __auth_stubs::_objc_release(uVar3); - if (lVar5 == 0) { - local_90 = 0; - uVar1 = _objc_msgSend_createStoreDirectoryIfNeeded_(param_1,extraout_x1,&local_90); - auVar10 = __auth_stubs::_objc_retain(local_90); - uVar4 = auVar10._8_8_; - uVar3 = auVar10._0_8_; - if ((param_3 != (undefined8 *)0x0) && ((uVar1 & 1) == 0)) { - auVar10 = __auth_stubs::_objc_retainAutorelease(uVar3); - uVar4 = auVar10._8_8_; - *param_3 = auVar10._0_8_; - } - if (uVar1 == 0) { - uVar9 = 0; - } - else { - _objc_msgSend_stringByAppendingString_ - (&cfstringStruct_1d93e3678,uVar4,&cfstringStruct_1d93e36b8); - uVar4 = __auth_stubs::_objc_retainAutoreleasedReturnValue(); - _objc_msgSend_storeLocation(param_1); - auVar10 = __auth_stubs::_objc_retainAutoreleasedReturnValue(); - _objc_msgSend_URLByAppendingPathComponent_(auVar10._0_8_,auVar10._8_8_,uVar4); - uVar6 = __auth_stubs::_objc_retainAutoreleasedReturnValue(); - __auth_stubs::_objc_release(auVar10._0_8_); - local_88 = *(undefined8 *)__got::_NSMigratePersistentStoresAutomaticallyOption; - uStack_80 = *(undefined8 *)__got::_NSInferMappingModelAutomaticallyOption; - local_78 = __got::___kCFBooleanTrue; - puStack_70 = __got::___kCFBooleanTrue; - _objc_msgSend_dictionaryWithObjects_forKeys_count_ - (DAT_1d7e28060,extraout_x1_00,&local_78,&local_88,2); - uVar7 = __auth_stubs::_objc_retainAutoreleasedReturnValue(); - _objc_msgSend_persistentStoreCoordinator(param_1); - auVar10 = __auth_stubs::_objc_retainAutoreleasedReturnValue(); - local_98 = uVar3; - _objc_msgSend_addPersistentStoreWithType_configuration_URL_options_error_ - (auVar10._0_8_,auVar10._8_8_,*(undefined8 *)__got::_NSSQLiteStoreType,0,uVar6,uVar7, - &local_98); - lVar5 = __auth_stubs::_objc_retainAutoreleasedReturnValue(); - uVar8 = __auth_stubs::_objc_retain(local_98); - __auth_stubs::_objc_release(uVar3); - __auth_stubs::_objc_release(auVar10._0_8_); - if (lVar5 == 0) { - __auth_stubs::_objc_opt_class(param_1); - _objc_msgSend_os_log(); - uVar3 = __auth_stubs::_objc_retainAutoreleasedReturnValue(); - iVar2 = __auth_stubs::_os_log_type_enabled(uVar3,0x10); - if (iVar2 != 0) { - __CNContactMetadataPersistentStoreManager_setupIfNeeded___cold_1(uVar8,uVar3); - } - __auth_stubs::_objc_release(uVar3); - if (param_3 != (undefined8 *)0x0) { - uVar3 = __auth_stubs::_objc_retainAutorelease(uVar8); ``` -------------------------------- ### CNWallpaper Initialization Methods Source: https://clearbluejar.github.io/ghidriff/diffs/Samples/Mac/contacts-sample Comparison of the CNWallpaper initialization methods showing the addition of the contentIsSensitive parameter in the updated version. ```APIDOC ## Function: -[CNWallpaper_initWithPosterArchiveData:fontDescription:fontColorDescription:backgroundColorDescription:extensionBundleID:vertical:visualFingerprintData:] ### Description Initializes a CNWallpaper object with the provided poster archive data and styling parameters. ### Parameters - **paramcount** (integer) - 9 - **address** (hex) - 194c6ec20 --- ## Function: -[CNWallpaper_initWithPosterArchiveData:fontDescription:fontColorDescription:backgroundColorDescription:extensionBundleID:vertical:visualFingerprintData:contentIsSensitive:] ### Description Initializes a CNWallpaper object with the provided poster archive data, styling parameters, and a sensitivity flag. ### Parameters - **paramcount** (integer) - 10 - **address** (hex) - 194cd4274 ``` -------------------------------- ### Diff for CNWallpaper Initialization Method Source: https://clearbluejar.github.io/ghidriff/diffs/Samples/Mac/contacts-sample This diff shows changes to the -[CNWallpaper_initWithPosterArchiveData:fontDescription:fontColorDescription:backgroundColorDescription:extensionBundleID:vertical:visualFingerprintData:] method, including an added parameter and modifications to internal object handling and memory management. ```diff --- -[CNWallpaper_initWithPosterArchiveData:fontDescription:fontColorDescription:backgroundColorDescription:extensionBundleID:vertical:visualFingerprintData:] +++ -[CNWallpaper_initWithPosterArchiveData:fontDescription:fontColorDescription:backgroundColorDescription:extensionBundleID:vertical:visualFingerprintData:contentIsSensitive:] @@ -1,67 +1,68 @@ undefined8 -__CNWallpaper_initWithPosterArchiveData_fontDescription_fontColorDescription_backgroundColorDescription_extensionBundleID_vertical_visualFingerprintData__ +__CNWallpaper_initWithPosterArchiveData_fontDescription_fontColorDescription_backgroundColorDescription_extensionBundleID_vertical_visualFingerprintData_contentIsSensitive__ (undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4, undefined8 param_5,undefined8 param_6,undefined8 param_7,undefined8 param_8, undefined8 param_9) + (undefined8 param_9,undefined param_10) { int iVar1; undefined8 uVar2; undefined8 uVar3; undefined8 uVar4; undefined8 uVar5; undefined8 uVar6; undefined8 uVar7; long lVar8; undefined8 uVar9; undefined8 uVar10; undefined auVar11 [16]; undefined8 local_70; undefined8 uStack_68; uVar2 = __auth_stubs::_objc_retain(param_3); uVar3 = __auth_stubs::_objc_retain(param_4); uVar4 = __auth_stubs::_objc_retain(param_5); uVar5 = __auth_stubs::_objc_retain(param_6); uVar6 = __auth_stubs::_objc_retain(param_7); uVar7 = __auth_stubs::_objc_retain(param_9); uStack_68 = DAT_0; local_70 = param_1; lVar8 = __auth_stubs::_objc_msgSendSuper2(&local_70,0x1d021ccc3); + lVar8 = __auth_stubs::_objc_msgSendSuper2(&local_70,0x1cf0daf33); if (lVar8 != 0) { iVar1 = (**(code **)(*(long *)__got::_CNIsDataEmpty + 0x10)) (*(long *)__got::_CNIsDataEmpty,uVar2); if (iVar1 == 0) { - __auth_stubs::_objc_storeStrong(lVar8 + 0x10,param_3); + __auth_stubs::_objc_storeStrong(lVar8 + 0x18,param_3); auVar11 = __auth_stubs::_objc_alloc(DAT_1); uVar9 = _objc_msgSend_initWithFontDescription_fontColorDescription_backgroundColorDescription_extensionBundleID_vertical_visualFingerprintData_ (auVar11._0_8_,auVar11._8_8_,uVar3,uVar4,uVar5,uVar6,param_8,uVar7); - uVar10 = *(undefined8 *)(lVar8 + 0x20); - *(undefined8 *)(lVar8 + 0x20) = uVar9; + uVar10 = *(undefined8 *)(lVar8 + 0x28); + *(undefined8 *)(lVar8 + 0x28) = uVar9; __auth_stubs::_objc_release(uVar10); + *(undefined *)(lVar8 + 8) = param_10; uVar9 = __auth_stubs::_objc_retain(lVar8); goto LAB_2; } __auth_stubs::_objc_opt_class(lVar8); _objc_msgSend_log(); uVar9 = __auth_stubs::_objc_retainAutoreleasedReturnValue(); iVar1 = __auth_stubs::_os_log_type_enabled(uVar9,0x10); if (iVar1 != 0) { - __CNWallpaper_initWithPosterArchiveData_fontDescription_fontColorDescription_backgroundColorDescription_extensionBundleID_vertical_visualFingerprintData___cold_1 + __CNWallpaper_initWithPosterArchiveData_fontDescription_fontColorDescription_backgroundColorDescription_extensionBundleID_vertical_visualFingerprintData_contentIsSensitive___cold_1 (uVar9); } __auth_stubs::_objc_release(uVar9); } uVar9 = 0; LAB_2: __auth_stubs::_objc_release(uVar7); __auth_stubs::_objc_release(uVar6); __auth_stubs::_objc_release(uVar5); __auth_stubs::_objc_release(uVar4); __auth_stubs::_objc_release(uVar3); __auth_stubs::_objc_release(uVar2); __auth_stubs::_objc_release(lVar8); return uVar9; } ``` -------------------------------- ### Get Optional Class Source: https://clearbluejar.github.io/ghidriff/diffs/Samples/Mac/contacts-sample Use `__auth_stubs::_objc_opt_class` to retrieve an Objective-C class. This function returns nil if the class is not found. ```objectivec auVar8 = __auth_stubs::_objc_opt_class(DAT_6); ``` ```objectivec auVar7 = __auth_stubs::_objc_opt_class(DAT_12); ``` ```objectivec auVar7 = __auth_stubs::_objc_opt_class(DAT_6); ``` ```objectivec auVar7 = __auth_stubs::_objc_opt_class(DAT_22); ``` ```objectivec auVar7 = __auth_stubs::_objc_opt_class(DAT_6); ``` ```objectivec auVar7 = __auth_stubs::_objc_opt_class(DAT_23); ``` ```objectivec auVar7 = __auth_stubs::_objc_opt_class(DAT_4); ``` ```objectivec auVar7 = __auth_stubs::_objc_opt_class(DAT_6); ``` ```objectivec uVar8 = __auth_stubs::_objc_opt_class(DAT_8); ``` ```objectivec __auth_stubs::_objc_opt_class(DAT_3); ``` ```objectivec auVar7 = __auth_stubs::_objc_opt_class(DAT_3); ``` ```objectivec auVar7 = __auth_stubs::_objc_opt_class(DAT_6); ``` -------------------------------- ### Objective-C Message Dispatch and Class Retrieval Source: https://clearbluejar.github.io/ghidriff/diffs/Samples/Mac/contacts-sample Examples of decompiled code showing the use of _objc_msgSend_setClasses_forSelector_argumentIndex_ofReply_ and related Objective-C runtime stubs. ```Assembly + uVar5 = auVar7._0_8_; + uVar8 = 0; _objc_msgSend_setWithObjects_(uVar1,auVar7._8_8_,uVar4); auVar7 = __auth_stubs::_objc_retainAutoreleasedReturnValue(); _objc_msgSend_setClasses_forSelector_argumentIndex_ofReply_ - (uVar2,auVar7._8_8_,auVar7._0_8_,0x1d08d5686,0,0,in_x6,in_x7,uVar5,uVar9,uVar10); - uVar1 = DAT_5; - auVar8 = __auth_stubs::_objc_opt_class(DAT_3); - uVar4 = 0; - _objc_msgSend_setWithObjects_(uVar1,auVar8._8_8_,auVar8._0_8_); - auVar8 = __auth_stubs::_objc_retainAutoreleasedReturnValue(); - _objc_msgSend_setClasses_forSelector_argumentIndex_ofReply_ - (uVar2,auVar8._8_8_,auVar8._0_8_,0x1d08d9c76,0,1,in_x6,in_x7,uVar4); - __auth_stubs::_objc_release(auVar8._0_8_); - uVar1 = DAT_5; - auVar8 = __auth_stubs::_objc_opt_class(DAT_6); - uVar4 = 0; - _objc_msgSend_setWithObjects_(uVar1,auVar8._8_8_,auVar8._0_8_); - auVar8 = __auth_stubs::_objc_retainAutoreleasedReturnValue(); - _objc_msgSend_setClasses_forSelector_argumentIndex_ofReply_ - (uVar2,auVar8._8_8_,auVar8._0_8_,0x1d08d9c76,1,1,in_x6,in_x7,uVar4); - __auth_stubs::_objc_release(auVar8._0_8_); - uVar1 = DAT_5; - auVar8 = __auth_stubs::_objc_opt_class(DAT_4); - uVar4 = 0; - _objc_msgSend_setWithObjects_(uVar1,auVar8._8_8_,auVar8._0_8_); - auVar8 = __auth_stubs::_objc_retainAutoreleasedReturnValue(); - _objc_msgSend_setClasses_forSelector_argumentIndex_ofReply_ - (uVar2,auVar8._8_8_,auVar8._0_8_,0x1d08e3a22,0,1,in_x6,in_x7,uVar4); - __auth_stubs::_objc_release(auVar8._0_8_); - uVar1 = DAT_5; - auVar8 = __auth_stubs::_objc_opt_class(DAT_6); - uVar4 = 0; - _objc_msgSend_setWithObjects_(uVar1,auVar8._8_8_,auVar8._0_8_); - auVar8 = __auth_stubs::_objc_retainAutoreleasedReturnValue(); - _objc_msgSend_setClasses_forSelector_argumentIndex_ofReply_ - (uVar2,auVar8._8_8_,auVar8._0_8_,0x1d08e3a22,1,1,in_x6,in_x7,uVar4); - __auth_stubs::_objc_release(auVar8._0_8_); - uVar1 = DAT_5; - auVar8 = __auth_stubs::_objc_opt_class(DAT_7); - uVar4 = 0; - _objc_msgSend_setWithObjects_(uVar1,auVar8._8_8_,auVar8._0_8_); - auVar8 = __auth_stubs::_objc_retainAutoreleasedReturnValue(); - _objc_msgSend_setClasses_forSelector_argumentIndex_ofReply_ - (uVar2,auVar8._8_8_,auVar8._0_8_,0x1d08d593f,0,0,in_x6,in_x7,uVar4); - __auth_stubs::_objc_release(auVar8._0_8_); - uVar1 = DAT_5; - auVar8 = __auth_stubs::_objc_opt_class(DAT_4); - uVar4 = 0; - _objc_msgSend_setWithObjects_(uVar1,auVar8._8_8_,auVar8._0_8_); - auVar8 = __auth_stubs::_objc_retainAutoreleasedReturnValue(); - _objc_msgSend_setClasses_forSelector_argumentIndex_ofReply_ - (uVar2,auVar8._8_8_,auVar8._0_8_,0x1d08d593f,0,1,in_x6,in_x7,uVar4); - __auth_stubs::_objc_release(auVar8._0_8_); - uVar1 = DAT_5; - uVar4 = __auth_stubs::_objc_opt_class(DAT_6); - auVar8 = __auth_stubs::_objc_opt_class(DAT_7); - uVar5 = auVar8._0_8_; - uVar9 = 0; - _objc_msgSend_setWithObjects_(uVar1,auVar8._8_8_,uVar4); - auVar8 = __auth_stubs::_objc_retainAutoreleasedReturnValue(); - _objc_msgSend_setClasses_forSelector_argumentIndex_ofReply_ - (uVar2,auVar8._8_8_,auVar8._0_8_,0x1d08d593f,1,1,in_x6,in_x7,uVar5,uVar9); - __auth_stubs::_objc_release(auVar8._0_8_); + (uVar2,auVar7._8_8_,auVar7._0_8_,0x1cf79614e,1,1,in_x6,in_x7,uVar5,uVar8); + __auth_stubs::_objc_release(auVar7._0_8_); uVar1 = DAT_5; uVar4 = __auth_stubs::_objc_opt_class(DAT_8); uVar5 = __auth_stubs::_objc_opt_class(DAT_9); - uVar9 = __auth_stubs::_objc_opt_class(DAT_3); - auVar8 = __auth_stubs::_objc_opt_class(DAT_4); - uVar10 = auVar8._0_8_; + uVar8 = __auth_stubs::_objc_opt_class(DAT_3); + auVar7 = __auth_stubs::_objc_opt_class(DAT_4); + uVar9 = auVar7._0_8_; uVar11 = 0; - _objc_msgSend_setWithObjects_(uVar1,auVar8._8_8_,uVar4); - auVar8 = __auth_stubs::_objc_retainAutoreleasedReturnValue(); - _objc_msgSend_setClasses_forSelector_argumentIndex_ofReply_ - (uVar2,auVar8._8_8_,auVar8._0_8_,0x1d08e0e24,0,1,in_x6,in_x7,uVar5,uVar9,uVar10,uVar11); - __auth_stubs::_objc_release(auVar8._0_8_); - uVar1 = DAT_5; - auVar8 = __auth_stubs::_objc_opt_class(DAT_6); + _objc_msgSend_setWithObjects_(uVar1,auVar7._8_8_,uVar4); + auVar7 = __auth_stubs::_objc_retainAutoreleasedReturnValue(); + _objc_msgSend_setClasses_forSelector_argumentIndex_ofReply_ + (uVar2,auVar7._8_8_,auVar7._0_8_,0x1cf7a182a,0,1,in_x6,in_x7,uVar5,uVar8,uVar9,uVar11); + __auth_stubs::_objc_release(auVar7._0_8_); + uVar1 = DAT_5; + auVar7 = __auth_stubs::_objc_opt_class(DAT_6); uVar4 = 0; - _objc_msgSend_setWithObjects_(uVar1,auVar8._8_8_,auVar8._0_8_); - auVar8 = __auth_stubs::_objc_retainAutoreleasedReturnValue(); - _objc_msgSend_setClasses_forSelector_argumentIndex_ofReply_ ``` -------------------------------- ### Diff of -[CNSharedProfile_initWithNickname:] Called Source: https://clearbluejar.github.io/ghidriff/diffs/Samples/Mac/contacts-sample Highlights changes in the method call sequence for the initializer. ```diff --- -[CNSharedProfile_initWithNickname:] called +++ -[CNSharedProfile_initWithNickname:] called @@ -6,0 +7 @@ +_objc_msgSend$contentIsSensitive @@ -8 +9 @@ -_objc_msgSend$initWithPosterArchiveData: +_objc_msgSend$initWithPosterArchiveData:contentIsSensitive: ``` -------------------------------- ### Decompiled setupIfNeeded cold path function Source: https://clearbluejar.github.io/ghidriff/diffs/Samples/Mac/contacts-sample Handles the error logging path when a ContactMetadata store fails to be added to the coordinator. ```C void __CNContactMetadataPersistentStoreManager_setupIfNeeded___cold_1 (undefined8 param_1,undefined8 param_2,undefined8 param_3) { undefined8 extraout_x1; long local_18; _OUTLINED_FUNCTION_1(); _OUTLINED_FUNCTION_0 (&mach_header_194b75000,extraout_x1,param_3, "ContactMetadata store couldn't be added to the coordinator: %@"); if (*(long *)__got::___stack_chk_guard == local_18) { return; } __auth_stubs::___stack_chk_fail(); return; } ``` -------------------------------- ### Bitwise Operations and Register Manipulation Source: https://clearbluejar.github.io/ghidriff/diffs/Samples/Mac/libcorecrypto.dylib-14.2.1-libcorecrypto.dylib-14.3 Examples of low-level register manipulation and bitwise logic often found in Ghidra decompilation output. ```C CONCAT13((byte)(uVar47 >> 0x18) ^ (byte)(uVar59 >> 0x18) ^ auVar50[4], CONCAT12((byte)(uVar47 >> 0x10) ^ (byte)(uVar59 >> 0x10) ^ auVar50[3] ,CONCAT11((byte)(uVar47 >> 8) ^ (byte)(uVar59 >> 8) ^ auVar50[2], (byte)uVar47 ^ (byte)uVar59 ^ auVar50[1] ))))))); auVar55[15] = bVar6 >> 7 ^ bVar6 >> 1 ^ auVar50[8] ^ (byte)((uVar58 << 0x3f) >> 0x38); lVar2 = uVar16 + lStack_28; auVar26._0_8_ = auVar26._0_8_ + auVar39._0_8_ + auVar43._0_8_ + auVar55._0_8_; auVar26._8_8_ = lVar35 + auVar39._8_8_ + auVar43._8_8_ + auVar55._8_8_; lStack_30 = plVar11[10] + auVar26._0_8_; lStack_28 = plVar11[0xb] + auVar26._8_8_; lVar2 = lVar2 + ((uVar13 >> 0xe | uVar13 << 0x32) ^ (uVar13 >> 0x12 | uVar13 << 0x2e) ^ (uVar13 >> 0x29 | uVar13 * 0x800000)) + ((uVar14 ^ uVar15) & uVar13 ^ uVar15); uVar12 = uVar12 + lVar2; uVar16 = lVar2 + ((uVar17 >> 0x1c | uVar17 << 0x24) ^ (uVar17 >> 0x22 | uVar17 * 0x40000000) ^ (uVar17 >> 0x27 | uVar17 * 0x2000000)) + ((uVar18 ^ uVar19) & uVar17 ^ uVar18 & uVar19); auVar39 = NEON_ext(auVar23,auVar24,8,1); auVar50 = NEON_ext(auVar27,auVar29,8,1); uVar31 = auVar26._0_8_ >> 0x13; uVar32 = auVar26._8_8_ >> 0x13; lVar33 = auVar26._0_8_ * 8; lVar36 = auVar26._8_8_ * 8; lVar35 = auVar27._8_8_; uVar38 = auVar26._0_8_ >> 6; lVar2 = uVar15 + lStack_20 + ((uVar12 >> 0xe | uVar12 << 0x32) ^ (uVar12 >> 0x12 | uVar12 << 0x2e) ^ (uVar12 >> 0x29 | uVar12 * 0x800000)) + ((uVar13 ^ uVar14) & uVar12 ^ uVar14); uVar46 = auVar50._0_8_; uVar59 = uVar46 >> 1; uVar58 = auVar50._8_8_; uVar60 = uVar58 >> 1; uVar19 = uVar19 + lVar2; uVar47 = uVar46 >> 7; bVar4 = (byte)(auVar26._0_8_ >> 0x38); bVar5 = (byte)(auVar26._8_8_ >> 0x38); bVar7 = auVar50[7]; bVar6 = auVar50[15]; auVar44[9] = (byte)((auVar26._8_8_ >> 6) >> 8) ^ (byte)(uVar32 >> 8) ^ (byte)((ulong)lVar36 >> 8); auVar44[10] = (byte)((uint7)(auVar26._8_8_ >> 0xe) >> 8) ^ (byte)(uVar32 >> 0x10) ^ (byte)((ulong)lVar36 >> 0x10); auVar44[11] = (byte)((uint6)(auVar26._8_8_ >> 0x16) >> 8) ^ (byte)(uVar32 >> 0x18) ^ (byte)((ulong)lVar36 >> 0x18); auVar44[12] = (byte)((uint5)(auVar26._8_8_ >> 0x1e) >> 8) ^ (byte)(uVar32 >> 0x20) ^ (byte)((ulong)lVar36 >> 0x20); lVar34 = auVar26._0_8_ << 0x2d; lVar37 = auVar26._8_8_ << 0x2d; uVar15 = lVar2 + ((uVar16 >> 0x1c | uVar16 << 0x24) ^ (uVar16 >> 0x22 | uVar16 * 0x40000000) ^ (uVar16 >> 0x27 | uVar16 * 0x2000000)) + ((uVar17 ^ uVar18) & uVar16 ^ uVar17 & uVar18); auVar44[8] = (byte)(auVar26._8_8_ >> 6) ^ (byte)uVar32 ^ (byte)lVar36 ^ bVar5 >> 5; auVar56[8] = (byte)(uVar58 >> 7) ^ (byte)uVar60 ^ auVar50[9]; auVar56[9] = (byte)((uVar58 >> 7) >> 8) ^ (byte)(uVar60 >> 8) ^ auVar50[10]; auVar56[10] = (byte)((auVar50._9_7_ >> 7) >> 8) ^ (byte)(uVar60 >> 0x10) ^ auVar50[11]; auVar56[11] = (byte)((auVar50._10_6_ >> 7) >> 8) ^ (byte)(uVar60 >> 0x18) ^ auVar50[12]; auVar56[12] = (byte)((auVar50._11_5_ >> 7) >> 8) ^ (byte)(uVar60 >> 0x20) ^ auVar50[13]; auVar56[13] = (byte)((auVar50._12_4_ >> 7) >> 8) ^ (byte)(uVar60 >> 0x28) ^ auVar50[14]; auVar56[14] = (byte)((uint3)(auVar50._13_3_ >> 7) >> 8) ^ (byte)(uVar60 >> 0x30) ^ bVar6; auVar44._0_8_ = CONCAT17(bVar4 >> 6 ^ (byte)((ulong)lVar33 >> 0x38) ^ (byte)((ulong)lVar34 >> 0x38), CONCAT16((byte)(uVar38 >> 0x30) ^ (byte)((ulong)lVar33 >> 0x30) ^ (byte)((ulong)lVar34 >> 0x30), CONCAT15((byte)(uVar38 >> 0x28) ^ bVar4 >> 3 ^ (byte)((ulong)lVar33 >> 0x28) ^ (byte)((ulong)lVar34 >> 0x28), CONCAT14((byte)(uVar38 >> 0x20) ^ (byte)(uVar31 >> 0x20) ^ (byte)((ulong)lVar33 >> 0x20), ``` -------------------------------- ### Bitwise Operations and Concatenation in Ghidra Source: https://clearbluejar.github.io/ghidriff/diffs/Samples/Mac/libcorecrypto.dylib-14.2.1-libcorecrypto.dylib-14.3 Examples of byte-level manipulation and variable concatenation using Ghidra's internal CONCAT functions. ```C auVar52[9] = (byte)((uVar58 >> 7) >> 8) ^ (byte)(uVar60 >> 8) ^ auVar50[10]; auVar52[10] = (byte)((auVar50._9_7_ >> 7) >> 8) ^ (byte)(uVar60 >> 0x10) ^ auVar50[11]; auVar52[11] = (byte)((auVar50._10_6_ >> 7) >> 8) ^ (byte)(uVar60 >> 0x18) ^ auVar50[12]; auVar52[12] = (byte)((auVar50._11_5_ >> 7) >> 8) ^ (byte)(uVar60 >> 0x20) ^ auVar50[13]; auVar52[13] = (byte)((auVar50._12_4_ >> 7) >> 8) ^ (byte)(uVar60 >> 0x28) ^ auVar50[14]; auVar52[14] = (byte)((uint3)(auVar50._13_3_ >> 7) >> 8) ^ (byte)(uVar60 >> 0x30) ^ bVar6; auVar40._0_8_ = CONCAT17(bVar4 >> 6 ^ (byte)((ulong)lVar33 >> 0x38) ^ (byte)((ulong)lVar34 >> 0x38), CONCAT16((byte)(uVar38 >> 0x30) ^ (byte)((ulong)lVar33 >> 0x30) ^ (byte)((ulong)lVar34 >> 0x30), CONCAT15((byte)(uVar38 >> 0x28) ^ bVar4 >> 3 ^ (byte)((ulong)lVar33 >> 0x28) ^ (byte)((ulong)lVar34 >> 0x28), CONCAT14((byte)(uVar38 >> 0x20) ^ (byte)(uVar31 >> 0x20) ^ (byte)((ulong)lVar33 >> 0x20), CONCAT13((byte)(uVar38 >> 0x18) ^ (byte)(uVar31 >> 0x18) ^ (byte)((ulong)lVar33 >> 0x18), CONCAT12((byte)(uVar38 >> 0x10) ^ (byte)(uVar31 >> 0x10) ^ (byte)((ulong)lVar33 >> 0x10), CONCAT11((byte)(uVar38 >> 8) ^ (byte)(uVar31 >> 8) ^ (byte)((ulong)lVar33 >> 8) ,(byte)uVar38 ^ (byte)uVar31 ^ (byte)lVar33 ^ bVar4 >> 5 ))))))); auVar40[13] = (byte)((uint)(auVar22._8_8_ >> 0x26) >> 8) ^ bVar5 >> 3 ^ (byte)((ulong)lVar36 >> 0x28) ^ (byte)((ulong)lVar37 >> 0x28); auVar40[14] = (byte)((uint3)(auVar22._8_8_ >> 0x2e) >> 8) ^ (byte)((ulong)lVar36 >> 0x30) ^ (byte)((ulong)lVar37 >> 0x30); auVar40[15] = bVar5 >> 6 ^ (byte)((ulong)lVar36 >> 0x38) ^ (byte)((ulong)lVar37 >> 0x38); auVar52._0_8_ = CONCAT17(bVar7 >> 7 ^ bVar7 >> 1 ^ auVar50[0] ^ (byte)((uVar46 << 0x3f) >> 0x38), CONCAT16((byte)(uVar47 >> 0x30) ^ (byte)(uVar59 >> 0x30) ^ bVar7, CONCAT15((byte)(uVar47 >> 0x28) ^ (byte)(uVar59 >> 0x28) ^ auVar50[6], CONCAT14((byte)(uVar47 >> 0x20) ^ (byte)(uVar59 >> 0x20) ^ auVar50[5], CONCAT13((byte)(uVar47 >> 0x18) ^ (byte)(uVar59 >> 0x18) ^ auVar50[4], CONCAT12((byte)(uVar47 >> 0x10) ^ (byte)(uVar59 >> 0x10) ^ auVar50[3] ,CONCAT11((byte)(uVar47 >> 8) ^ (byte)(uVar59 >> 8) ^ auVar50[2], (byte)uVar47 ^ (byte)uVar59 ^ auVar50[1] ))))))); auVar52[15] = bVar6 >> 7 ^ bVar6 >> 1 ^ auVar50[8] ^ (byte)((uVar58 << 0x3f) >> 0x38); lVar2 = uVar14 + lStack_58; auVar23._0_8_ = auVar23._0_8_ + auVar39._0_8_ + auVar40._0_8_ + auVar52._0_8_; auVar23._8_8_ = lVar35 + auVar39._8_8_ + auVar40._8_8_ + auVar52._8_8_; lStack_60 = plVar11[4] + auVar23._0_8_; lStack_58 = plVar11[5] + auVar23._8_8_; lVar2 = lVar2 + ((uVar19 >> 0xe | uVar19 << 0x32) ^ (uVar19 >> 0x12 | uVar19 << 0x2e) ^ (uVar19 >> 0x29 | uVar19 * 0x800000)) + ((uVar12 ^ uVar13) & uVar19 ^ uVar13); uVar18 = uVar18 + lVar2; ```